fefc9e969ad84f1d2d706fead12dae0fae2279106ff698cee6b45be6e1f42ec0

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

646dd5e9eac7b66f9c8f50795cfa5e0b_JaffaCakes118.html
Size

748B
MD5

646dd5e9eac7b66f9c8f50795cfa5e0b
SHA1

708ce85a253eb386a93d354101274874254df7b4
SHA256

fefc9e969ad84f1d2d706fead12dae0fae2279106ff698cee6b45be6e1f42ec0
SHA512

dcb76f7c1ce9093558015ef4a54eced6b2cb22b9214639ca1823f9374cacc3d1c8b35435a2036b8fbbd94dec47d941d0da41574b269f79efee6adb6db1ab72a1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004c9e7343c60edff37bad88209e5a990b024e1401ead11b3942039f75bd4bf36f000000000e800000000200002000000078f557db5a718ac9b348dd6dd705cbc672605fa5534b1075c339607fc6d6946b900000000aac3b1787145f5827630cce5e5f9cf8634979aad6ce6ab437ca4836496f507d290e9e1c7e387e18c6022018e2c4da0d1c59a1a95ef91ead222216a3be30b84cac3a53af62b1dc95744d1109a9a1a8381af2dc76bbfcb84a7cbabc7d06a52bf867fcca530e188e3d416959cd72e98398fd51955c7011eeafbdc5ed0eaa90ee7d2ffdee43129854fe7601896c0f7672c7400000004ef50584283843674bf358ff06fb051d3b2f2e5fa297c279f2d3301b629e9c5962502f6ebe16ca9813916a23dfc534c12cea18afd489c80749d44b84583ba8ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422480320"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000012d86d8c4c5d769b349ea5fbff4035f899578bcb3c6ce9d6e938d02f6b19a943000000000e80000000020000200000008eb06b6107a2d2db9492716c624bc59a94388e25cc61dc15fccfda889b60919c200000004c9ae85c8a2e4fe1458353fc25aa7c4debbdfe7f9b608e3829afbb03953bd39c4000000003f0861b5846c2ba50d0c5c8ea165ab41900bcfc73738bd37805e13b24f27df26e288123c148e77bbb5c9e4b962bba1dfe1a563aeaf11e145d8bc637a7a3366e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60CF8C41-17A5-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0bc6224b2abda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1148	iexplore.exe
1148	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2240	1148	iexplore.exe	28
PID 1148 wrote to memory of 2240	1148	iexplore.exe	28
PID 1148 wrote to memory of 2240	1148	iexplore.exe	28
PID 1148 wrote to memory of 2240	1148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\646dd5e9eac7b66f9c8f50795cfa5e0b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91e729740d7c3b474fb98f1a3ac0d2fc

SHA1
e602c6c186104a846f9dc1e3a0bdfe65a70dcd50

SHA256
fe2caa9c94330e2c77ed1280f0df193da54e19667a9876b6aae0582336bd12e5

SHA512
7eb726f4818ecbf69e3e3713eddac8ddc403801949e1bc6cc872ab0dc5ebaab02fb2836ebe873732baf0d3ccccfccb505a6786b493f9cfbb6a9a3adcea5076b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
973ad846ac8dca44ac35c9c20c4b2ba9

SHA1
9206155fbf77772185de5997c8ca34cad7b528c3

SHA256
5c5eea939aef2c531acc2a98825ed5beb915f1812885f457db255a3a9ec2b0e1

SHA512
009915be332deb58388271a652bef56d9e642b0583a2d0d44ddd3d3bc956eed60386e793afe4aa28316afa0962249d84e26edf76f7ded9fc669157f09faf7abb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c98b94e3b5760cd2df46f94024bdeca6

SHA1
1a7741639b436bf1379ec4d17490fc1eacbbf085

SHA256
483a55b701ee8868088d9bcc884e507f3bad57bd3d03e29fc3be16b2ac9a4960

SHA512
dc40112bd68e7b11c580592a30f6ea9a8b6b8924d6638cab9c5fe6aad9509935da1588abb88ff6a2c184f6811cbd85dcd70d5d401bf3c969a4e6bf93314bfb13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c474320f00477516a0fb4d324573c48d

SHA1
12ff38dbeb0d1ed4e4b34924673edd0b2a259645

SHA256
fceb87984b8deff34954512eee0c1f425b4198ccc1a98353caf0c5e43cb5513e

SHA512
4381b80c0618dab11508c4257f7348569309fcca79805b110e5d54e6d8278ab6ee1d211213de820c6942b4313382421c4e778a0212ce8761949933f02d815144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abbaba97509f8bc84dbc9dc57c300988

SHA1
d6b0bc91cbc22530e13f1238fdcbe978814bf704

SHA256
a03d5c2fcb89aaba2758a932fddd235f08763d45b14782d1b79ca831b430b6ee

SHA512
20f70dc417d48530ba0e9da3e4ec03c89116ddb30c077b613ba24e6aea6d4649cf1ec9d03622619808a1ce26ed46629d45e47171d6b32f1cfbf9802febd90e08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
697ff4d3e1f549a64ab36a5b476697e0

SHA1
535e55ffe5cde1b6885b5743b4d2a377f7c4ece1

SHA256
8d26f97e44fc6b531cc6703c8dd6832cc4833f344719e8e2ed27236fcd142807

SHA512
2990bd17640ff9076d693fe369c51d70a4abfbc08165221f9605178fef61aeea3cbe85f0d0e78129291130c40e68cbe365bfbe506b41effe98357de3cfbaba8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8a65aa08c1a1f718496aea8db922ea3

SHA1
38f5314e428488d3c4530ee7d40f7e291f7a8505

SHA256
193acfcd3daca252d1b543634fe242ffc362d24ad7c81e1cfdf4ec3554e37abb

SHA512
5f9c10ce077a397fb4728a696a7f989c16a98b26658ff72e9d25de65ce5e9340d6454f583ffe68e7bc85389de98bf02823b35081864ecd0a3a16bc7b02e286a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45996737d0ca0aece004a04bf5129338

SHA1
1cbe9286480f2d786d2572fd5daf44e23e7062aa

SHA256
241489c46f8937c05026333e123c5211558f5f29b6c9eb6226993bdd1849ef19

SHA512
eea46c53087c9648eb54474f6263f0df9b90eb34ef60863c60f8032e0234f4adf3b04e115879300c2be5e2723bd4eac9de312c182b80482eadfb3a69f440a144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
579da97467b6367e30908679df75c929

SHA1
af95dcae8eb6d37e679a38df8edf5d9806e126b6

SHA256
154755db5532b50a0e08057a9229405b2fe4607313db0b6bbe06924f8745f090

SHA512
0acf9c2bc782eb0733960e5aafd286c23b0d433db626a66331930567fa6f61b1395e88d17b4c003f309ff75bef184d9ed48cb5c5b18c79651d57f9683624fcbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
697149958e31056adfbddb5c7309a750

SHA1
6150fa35bf0d670fd9725f782e70e765633bca51

SHA256
b4c07ffe4e2ed937763319bff2e6d4449402a50b277253a6e68e8262ce3f2ee3

SHA512
7dbe41b1d993b03596d44468e39ffae3f73041972266e8df1a1c563ce1922c3ba3b01dd465deb18ea288e07f39fb6459be5b34056242b5334f3207ce1a08c60e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d21a48937424a65c3d373937ba6ea77

SHA1
0d0d9ec32330ab2dd319f97b123d38c1adca8bdd

SHA256
2139e6bdd0c490ccd5dd69b641a3ba7983e0caea091382656c8772493862a279

SHA512
31de91a8124e95997e348521e4dca2904c1aef78d9f71c1a3e2a1fc783176e40160f6771058f5327a230bab2c315731f0b75108def852eb241da97c90790c472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f60f8248beae549cb18dda53fc17471d

SHA1
301f352584f74e86e8cf717c83136faa4d1794a3

SHA256
4c83a84a9dd1d84289907bba4ee618dd18146bd6f446ded285a97b50593b8d70

SHA512
8513bd91e1676598d6d6d787aeca67eccc372a92a2fa64efdb359ba33d8ce3fcef57b22a9b531d9c18de494fef58028d4bfc6813c3a3db66817fb9034e2994fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eac03620c4a8459f571acdb874d97ba0

SHA1
d43b5a7b49261e8d9f7a346e03f882cb190e9cbf

SHA256
d8d7eb4b570e4a9ac672b84c0294f799e5aae2a933a4621554ce873e493e1adf

SHA512
8a45fc76b2a235b5f9423f5ca82b8534ecae149f886a7d605c88d1c890fbfabda747bc57d5f892ef0ccfa669a6003f9dbcaf34f01a9e348b1eb6c611cddd7eb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7cb728430cea8578c11e29dd9569036

SHA1
90f781812ba02136f5684d82abd6122cd959bbb7

SHA256
602228093616a63a53a570d43e252575c960929ad5f7ac7963bbebd32c422297

SHA512
ec8624ce4681f7fed532079ddee824ba6d3dae213211157579c876df43eb0da1280961b2347cb9069904ff498bc0bc77e0a765cfc8f6ce12947ebdd8b741d6d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dc612c818249900334fa598e990bde0

SHA1
23a977cd4f4fcd247e78ab4b0e306f0a6085bd2e

SHA256
e555ecc487c565eaff3885fe3c930c53c23a29ce5d2f682c3031a5ee5b4c58e9

SHA512
73f55a83fb1ab1edd8feac6b7d6bdc79fa802c3b27fe1406ede13982299830c878120bd4114a8a6bb0aed602f85913f1b968a5932ce983df8af6ab6979156988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a86cd1c8f9e90f24395deb61fcb642b5

SHA1
93b79e4118f0f69acd563a7defc8db3cbae8e2b0

SHA256
6373f2e92f968193cfd3a3dda7d2afcfa3d055d274738aa8e57789f165d7271a

SHA512
166392826da20274b96dd9bdb00c52c22355f34cf0163114c52816e4e6b7580f9b012a93ae5a523c75c380fdd6787e61ae746d482c3c0dd3cb4a9cf1b2498c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f64b256b2e80fda4ba6ee3d057fbfb7e

SHA1
a53ba673465468edc59de20f09dee1869a787c0a

SHA256
e6be7578f2d846f82f52bb845e661dc2086c95d8681b1d02b5269abb0399777b

SHA512
53d880666f6348b87aad968234202a449fe1a044c690e0747526333f0a6984041b1b74daa3c9dd08c0d43e4288396921c4e82b2677261cea84ed891db9e04706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
730d54a3bfc3b5b9fbe309798cc7a873

SHA1
339592d390b94742a3fa4c20858dbdece5864b4a

SHA256
9a4070acfd693a6400cac006d5c03a219e397a1fca3faf72ca7c6dda0deebcf6

SHA512
b7e12f3b49e2edc654b18250530715ae23a1fc48d61b7b920112ba09cb0ce704d3bac1cf74acb5c57bbd6916bb225a63dea9b144288a5e587b051bbe6361bb78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2262.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22D2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit