7ef84f05790fa09f54fb570d97518f3546a9a8dd98e233d86a6fc4719d670bed

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04bf5391cb24bd75246d36d19edc14f8_JaffaCakes118.html
Size

30KB
MD5

04bf5391cb24bd75246d36d19edc14f8
SHA1

9bb5561625c9764ffc435d3ed34c23ef23614ec7
SHA256

7ef84f05790fa09f54fb570d97518f3546a9a8dd98e233d86a6fc4719d670bed
SHA512

89a24e83bf626c27266f862fb41f85abf3990c4228cc5800baf50b01c0fee9b66e0d032cf34e20ad729a338dd83d1f0d0d3b75203d8ba7f478694e5423f0f66f
SSDEEP

768:OEwN4kjOvjAq/dG+hUgQ2dST4WlP0fjjUCLs:OzN4kjOvjLo0vDs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000571667f1f696fbade6c8dd1fa07e31497e4e95260792c873a2b1b662d7d51674000000000e8000000002000020000000ee7fb635561ce935a24fe050c5a634efe8f7802c790a368eb43b9c27e382a40b9000000076922fbaa0b3558a195f1137860457cefafa91abaded147b377317e0e7f105b17575b7f858dcd8d930dbce06566d3d62e6d0351da9f97a3cec1f17952ac97f36b6100d3c41f35516b0092b17cb08df44dafbf6bc04f112f3e9daee914d46e28ab7c672affce8abf1a78d5e0960e4368e95d655b480c93fb04556ed45a7f767f28b1cb263c56094b56db549e1f1531c294000000019f32f9f82eef076052d5e8579493fb48b819ca994ed5d2197cf0cddfed4b5bfec4c7a6973d83c868d54dbe87db06db54f8d900c87864c6e1da9b301134ef0db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003c33af4399da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA3CE721-0536-11EF-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000e86c36d19d689049b1bf45ecf3832938fd060f83fe9e50970f910d3665cba7b7000000000e8000000002000020000000a07406c87bdd8e300c0d248a84f618fc20a6486c2b65a4e68bb245a8b77c7f4420000000dc6595797f21a0103689e174643fac9f310823dc725328c4e18e6ba31b0d177f40000000ddfe5d05e2d9012f7b007af912c3534286396c9d2e66d470ac9277f8bd01cfb1fae43839ca628f51102f9685b9ed5216e417f2853e8a967a00cd6980aecbe7a1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420453731"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1440	iexplore.exe
1440	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2696	1440	iexplore.exe	28
PID 1440 wrote to memory of 2696	1440	iexplore.exe	28
PID 1440 wrote to memory of 2696	1440	iexplore.exe	28
PID 1440 wrote to memory of 2696	1440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04bf5391cb24bd75246d36d19edc14f8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e96a716d9f9f49d2121ad797c604cfa2

SHA1
55170782c927fa0aa2365881589430830361cbe1

SHA256
603f08c20d7bd13d240746cc7a40700c0b512da671e49f19df5e777980b51a45

SHA512
5b96326cb8669a6ac51c5d7efe0e53feaeec0faf31f9b42aeba61d745e6ac9c27f6590f36ba1f68551af837d186ccece436c5e07e71f7bc2042a7b7ce85e0665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b8d00ad979eeb67594a43af25d0bb1e

SHA1
57aeb1e7af45be406cb8b1f878a8110c56b6f8e3

SHA256
03aa3e27dc36a16028d1df7f0d27891097a6cd37907b0e441d717fe6886044ca

SHA512
32b0be71a57a45e1e9d0a6f99c48d5a322f5d33b952e60e68ffb8d8b378ead13ab54a09c15cb606527f375eb0c9d49293891fdd83fccf2a6a12486eea2042873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
513b01a9da15071afeb0cdd8485a8fc4

SHA1
1c7360ba737315a9b3259a665e4d259d2792364d

SHA256
158cb33eb557d545fb25517198ab406d660002a4c5e7810d60863559488865d5

SHA512
a37ee507915958829397cec00bf3d497bfae7a89ee7d639cb8089b45491040a126eb71e88560edb99687f2a6b57a4c7d84175f7d1fbfad1877219cfd8b5a312f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30c93be01bf17c1477137abdee479182

SHA1
f7cda8684c1a33202546b4cb5d1c0098866d0ea6

SHA256
7689561ae7937e1c9dcb6f19ab09e9bac3db0c66de5490558f734fc6be9b2cb7

SHA512
67f4bef51538961eb95a4cf299649194f66b7a4b19ffd1710c17d4ee6795abb8926ea73f6ef9d617bfc35574c5c5c8118bb4be3946536fb596cb3ef5a05e3eed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a9215dc37d204e5c4a29aacfb4474b8

SHA1
db6b1a462e78490e76f3a433e50e557dedb80e6b

SHA256
2a918d4888294c1772db482fac06d64946a4e29df8275aba402fdff9c2bbc9fd

SHA512
2d68279cdf857982eb8557fbdd61f09289d4acec872cb1c038bccef89c07e6a838ff8d8761dfde696531c7139036dce719bd022942adadb9f4a966a23c8f446d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6da5c2ff890c1f80272ea146ce11ccd

SHA1
b212984dc9cac49b93d57631d77680617b52ad0f

SHA256
fb251941de8561ee80e236aa169e65481e5ee470e6ef9aacdfe5502fc69c3e19

SHA512
49c73b68b03cc921521596a4143f7b41f3d19642dcd5f5411f94f9fba7c140d4b56e1eadafaca2e2b5f6851f7f6e335849c75150094efb8922271da04fc4a60b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f1852bf49d105aee8789edce8808d54

SHA1
0d0650195e24acca3c39f0a6208c930ef957ac46

SHA256
e89f0d8756a11501c447a7c964f1dc2d0b61a09ed423ab237c5b7e4d39f8d9d5

SHA512
13c30382c3c78eb2d28502af2b508700015f412abec599a00b8db9afdb3e1ea4c6a275d567106e6f72fb43200dc3a12e7fe343a656a57b821fab928447bd517f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bdba01293d603795439857d50f1e60c

SHA1
c2e20e7479b80e8608172c3d468738a711257555

SHA256
8b81d9f41e50d9732594edecbb0c231474f0da778eec1781f68e8b2b1005bab2

SHA512
904707b0768875377292977566e17d24de3d1ee65314ad4033a8a679803c3f443e63b9a62536d63436da7823bec56b1c13b8b1d0b3afa3af30e2b1a4be920abf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a3bd0204a6672755b96b6de966ddd20

SHA1
339bf6db3b919879474fcd14384efaf85644811f

SHA256
3c90e2f9e46ca08bf4bcf5226f9d33feeb111304158be76839cadd92cfb64d42

SHA512
5a16216b69be5c16bb385729daad3d2ec195bd6bcdd45a01799777d1ca527e38e7b9cde736d1ed7a4dbfa155a599b8e49ffc784dad9041a6846a4030b7952eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1ae0bf9fc7183659ff03be395185d45

SHA1
4a937dfc9390ac7a7bd67fcaba1141974ae92965

SHA256
24b2544634e6878d14e49943763e02883e92111638b235b7ddf303412578224b

SHA512
648dda69f00831ab8ac717ead93760af9604245ec1d523778c3cd3c817482a6baa985fe8f72f766c6325489b3b91ba20b9621176c934fabb2da247857b92b21d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42fb13ff6b49e89a7a5ba45296e4faeb

SHA1
cf26606713a6af4636082883c182ceb75016acbd

SHA256
17bcb30c94b9aeea77705214e15f7ea4fb9847164374b75bc0974250a1a6603e

SHA512
c9d185f2ac1b84d81ca997d88c1b060950f264f7e4e51cf0f82fef651c91acbb44480a795c5dfd590fab20c959e99330086975d028228adb296a89e55dca4ddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6b88c163ee2e7382f1dd002d6eabdeb

SHA1
4583a9d738cdaaed9cd244e926339dd1d804dc7a

SHA256
888c82845283964f39a5cf351e16a6b0fd6264b4557d687383c9a1173747d514

SHA512
f4eac054d43c4e4bedbc39e920093a0a334b3e033693f80eb6b4bdb3cfb42d91d6944608102679e8d2e23d416b07dad808febac59c288bbd8465b09e2361d2ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
097f3bdfdf099291f03d1a03706a92cc

SHA1
263a91ef03a2a54ea9d376ecb3f4ec0375e56929

SHA256
8b87cd07282eefa0406eeb68fced308fba64d5b310c5bfaf5270b5073681fb73

SHA512
01676a41526b4d90692db457f990c1ed3a4b09bd2cb22dadda3d737f456e0b9dea6df860f429c1b888adb85b56c26bb028b4128cf0e5f2150a1b2b15e0d51eea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82408926d21e720ca189c663912ea0c9

SHA1
5314111c145a73c463f5d41609a0439c7caf6495

SHA256
0d7596a238eac1e3eabdf33c3b2768afda5f852cdc6bc0c6f13ed44a1d143e85

SHA512
e327f6c795c7552f09939c837731bfa09c3312555395fadf63c2ab6b7525463be983ec97b29deeacd59b82a5e0b4f32a67e95ddb0b697a9e5e26c24fd830e812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
553b71f1c1e4f2b32efd9ef534c659c7

SHA1
45a0b3aba63c7b3b1a42f699b3a9a69054fde6ef

SHA256
d8a45c1083db6507f2306cb739effff7579e499518eb4d16da33b8ec0ff1c92e

SHA512
f9eacbd24785ca1b7b7cdc8bc7f36ee1639a323e7b23a1fdb0242134ad2e2af656506528124f81918ddaf18e9af7fb10b3f1e9d0249229337d61a5862bf60b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6063e3ea9dda82f7f8f2bedc2abc5f6d

SHA1
87b98eac38aa520c4ab19f6173ee81db0a0ee687

SHA256
fc50f74841f6c7aa67a8774903c3e0a1e4f65e32cb609a31186ce141a28b3d26

SHA512
1003e2c6654f6ba9de3a412f4a04243ddf94ddd8b2914a8030fe86ea65f405617fc5bfcf14930a76ebba13d6a35a99a3350335d8aa287ccc5050a0484f92adea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc1a338ed1aa726c1989ba36bbc737f5

SHA1
9a5faa4885dbf832b9f75e1a4c800bfc3947b900

SHA256
2d3a7bf0a0338a153338c1e12b7bcd9458cd8bbf79edaf05882f5dcd9847babc

SHA512
df69fde68b895444f13c903df8d511460468a4accc53492f229a05c568b47a4e15b0d1fa9d646ed729a1bda06da8a0969bfa5516f68f53c428f6f17c86af05d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA7A6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8A5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA8F7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit