622c0973513185e465d71eaa88b8c2deacc082a0059ab9d593241ae0656b87d6

Analysis

max time kernel
135s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

029632a3bc8e44517b4a64829f9be479_JaffaCakes118.html
Size

769B
MD5

029632a3bc8e44517b4a64829f9be479
SHA1

aefda5b5a7d0aa4c3459d4169ec4163a0a0b281e
SHA256

622c0973513185e465d71eaa88b8c2deacc082a0059ab9d593241ae0656b87d6
SHA512

585a97fed1bf1274b83af1a12f674a08411c843073c55c164790ec9148a2dd0214acb65d9e218ee866aae48ce7031e06066087180bca97c602657d69c36534c6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420359743"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c29bc96898da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b940618de7a6e2ea40e8afe962342329ad7822e3ef6cd6f94e264c91aa85fd6d000000000e8000000002000020000000f9b78967489003bd8da5f0fbb20858b4032b9672d893af22f226e4662014ca7220000000cebf98b5ae36633b6f543896bee114405d511e735f3ae773b4488d16658d8eba40000000fb988705b5f596bc8112cfc98b688a89009c8c35f639c87cf90c223c7a4f4120922f781efb4dca5457974282c0ac04acd82fab7100959a5cf41bbce45e717afd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{059D25F1-045C-11EF-AFF6-E61A8C993A67} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ec2e5bae1b39d0b9b870ecfb286e902d30ed9fb8ae349a3639114146ddc95ac8000000000e8000000002000020000000093cbe0bc7a6fd71158bde99240b1d81eb31a4836e2363c782c1c579b33070d590000000a40f3440d32343110fd6b51621e6f64744e04d365ab46db0a6c5ae9e1e8fb353d820d45af5e65b2a5a225811ed85ce4f04c3f35750a34b67e7db43747f173d9add7b7031804b6f273efae2e341daa88e46d7a8580f51766d7145b1bd0af866033b5ef346be02a3d807a99281bef43f6bd71d00700ce62ab5c0e8063c98d355f59b959836eab796bf69fcf970a4ed39e540000000eb8201bde05df4a0c6a5764b3a349c296240570c6c090c61e4168ef0637df4ce72fb98a6040a3f703c5896643a65675c2bed7dd314c4e0f6c2b7bc87f674f377	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2696	iexplore.exe
2696	iexplore.exe
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1536	2696	iexplore.exe	28
PID 2696 wrote to memory of 1536	2696	iexplore.exe	28
PID 2696 wrote to memory of 1536	2696	iexplore.exe	28
PID 2696 wrote to memory of 1536	2696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\029632a3bc8e44517b4a64829f9be479_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e12e27e9d6c4aa61cddf12ccd4514026

SHA1
5426e7060170dd0cabb700dd6df575c3135a0667

SHA256
4947fb73bbd4254b15505696d4f8450b60647c6f8d98a37f3400ec36376ae818

SHA512
4e63067316cb6f14134a22e29957700f948f4c70ec87bce79b333aa8f047d9d293d096d82fd84c8c0bc26ca59def5daaecfa160ba0ba605b0f984770d0c79532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb1aa8ef23cbc87ab381b0f7ff283e11

SHA1
ef9fd691e712eeb5f7543e67234e6573f240d60c

SHA256
b9962b4d42f7e041cc3f36477ce010a84a06691ab400db535a90aa6e6f0332ea

SHA512
469982ccf314e075e2dd0546042d760bb0dc56e2dfe798bc6de518c5e02c8501e75bd9c1bf7a77c7768fbc755f12d8f55bd97db39b8935d45e244c515e03b0e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cd6bbc88ab2f6b726cdf534d731da5e

SHA1
599a8455431b147dbb0b2fffeb27b7b92bdfd255

SHA256
1f39b34fc5f278e7c4e979790c834aabdc503446fe120236f5cea9f07d65a1b1

SHA512
f8607d255fb6200acf708f296570117ce4e52a78385330670fe6e2cd5c48d44e70eb2b39d119a5227049ef8463f8eea92fa9dc1814a146f11526304184cfab15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8c473dae7fede1370f1bd8279902bdc

SHA1
ff1ea1276f087352177a645cb1c8456e31150499

SHA256
4a8998528aec40d2a3a023528a3b1ec4e930ad8c1e43401416a73cf2cff59c5c

SHA512
680b7a284f6c1ac237f3caa5d6c3b11671c4674ec5c6e355091a2a917c3b0549e32b4b64b1efc333412afebb2402848d99fd60534579ff6f0454bbf137436058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db1976b7198a84755223d71d0efabeca

SHA1
50926e77bef59f9e26cdcc8b5719d6bbab2416b9

SHA256
72f915eef1a3b818a296bed362d64d2d9df02949711f945d8dddc120c3fabe32

SHA512
7af75a40c5c7b1e1e9376cad0f63acf8026836df63afba069d2d7d15280865ff8909d3b0db3dd5c79b4df4a60551a462aa2b4c75cda1103f4f46ef5c8ad905d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc134dc07e5f4aca3565bdd150f3ee5c

SHA1
7f051e0ec325c379183c939f2bbede59947be61a

SHA256
224dfa6e3f8c138db9d1802376d75c90c60a3515888475b41273af9e80c73b6a

SHA512
89934f2605a2ac13c876bdac4352241ec2f21729a3866a2b193a35ff4003b79ee92cee6e8c1a499d912d64ad9ad4c0f0ec7ea4c477f486d16a0ec079af74a8bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d04e30f5666e615e5eed12b43d16a11b

SHA1
d82759251a2b2bf450fbb4e844835f90a4c40b01

SHA256
87c60d877e24e2f67302a8c3d8c4edc079dbbc9e7544fca0e85dcdbca9575840

SHA512
2f8df2fd8b263d50506f5b56e9e9e1e00a97e53a1ad48a784470dffd13be32110c368543bef8d5f9732a4e69651c515d4ceac86b28dac4c1a8583c19be2e04e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac61d6e6fbaf70ce9082529693cec791

SHA1
e95de7735626813b0a29984efa7a62d241e83520

SHA256
bc384223ee4d4f13ddbe3d2ac8d30dbe71c18f2eaa712ef692a0c87219b9886d

SHA512
aad2e18cfe31224ccda54e6dd94d39da4625cd16d5bb4b0295ee67da18e8131aac157379ef69028e0aee1e9317a456b25e41b9ca5d4164805dd712aa61a2d928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4588a1a66cf3ed6fa2f857c28dd9a01

SHA1
6a1fb9af6c14b74d4052cf890035159508d5c157

SHA256
ceada57c13e854f8103db9a72e222213b0df7e1aab2473b251680fb280a138cc

SHA512
0e8ad26c044586098225681ba0ee2dc6c41ad92bcc9af9b564936aae3d4e109072e6c5c8ea01b895b262801b332a0922d6cda8c4e37b985e6539ea8a6be52365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3ed0936638c58ebc257116d629acaa5

SHA1
e4d8996d273594ecd158e88eb5d762286d7106bf

SHA256
f48708d0437861853afdd9d65310fc5dbbc07cd101cf3c43eaeef65197176e23

SHA512
7dea568363a690eb4108eac6743ed00f0e6d51f5397ddcb6970826f4158636187df9e4ca3e66f64432124538384ac67073631341469ad3eacef1d1a81a80307b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc6d3811830673aecceadd0fd43e699c

SHA1
7804796134d52a159383bf0efd093aa7c2c780ec

SHA256
0622489ab762ede2b61b2f2062187758410780e971aea295f25a04477ae23e75

SHA512
10853a225a04a400c89f4bb08c7bbf6b1faabc0f963e764b5f831730f369ccf316d9b386969a1fb6c6a2ccb8b58a057d19d3ed4c28abb9147a235c1f5e7a4e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
074684153f18ccc18f105c03d151e966

SHA1
af07c56bcd529e0d59f9b552982bbb771dec0838

SHA256
13c075e201ea4b1102ad2ff7436025d5e75704c855c56e71e75aa92f2b3ded0b

SHA512
7fa4a92d72ff0e105902cea76b25a2a8cc83e2075a7d8f423767d606bf52f050056b9d98e3398dffd967197c0d3596aeec37aa4e665e952996c4d41d44d05c86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6711f26630ff67f2bd7595679131d9b2

SHA1
ca6ecc1b8f344021af6b39f4e8c9213892b6d7b9

SHA256
d662e3a77cecaee6759a7e74e4335769fb95239811f0ec697427172b7f23d405

SHA512
1ba1128976f40e5babd9e2b74a516abb7ea56ef49d70ce27eaea3d187d1691bf658458ed1545c4c839c8121e6973666b9c13992fd1b6cc4c69f5877d1a4a9d4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4b638dc82d594e8583b7aebd4b9fe77

SHA1
602c6a281ae694d79304867642901b57d2b60e3b

SHA256
d189f58ef84589ea2ab4463c69de5989ccd6d741b0dc9143c247b3b886bfb809

SHA512
0de83e66ab7efde37360bfc8e5ff32a43de906e97ac99cdc512a3807692c0b61fa05bdf0ab3c1fab1de2178cd4d287843f23ea6138f399d07baea78a9a25a815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f38c2f18cae139c904a029e4b4c6e2c

SHA1
443dc7b1d54a55b27294dcaade4b64cc0d846a76

SHA256
99f6a463d1bcb28a9369cf27fdc9760d9db0a87325d76b623fc504d6047b82aa

SHA512
39a1c88c674f1b01b45caa38e7ad5c888846524c7db1af75b885cb9350ab01dc9ad10808f92aa1617fa7c3b4abb1b8bb7dd7110eb2c1c813c23e7fa856240069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c3e55cd726f6ebe8ea2a9bccac515f4

SHA1
344d711eba2ab069084f6b4e1bbab0065081b53a

SHA256
e87c9dced589a3c4b8e8a2dd62a685a31555f977b86bdfe5fa41a2e08185ca7e

SHA512
fdc162be4e36571efcaa1524a49dc7ca53d907b76c4020f036d45bb85bb8eee1add5160be83d30a1aacde6aa3a114d8d72ba4485e025d8639c219b607f59a6cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5503e581673ff6255e16d3dfedd8b6ce

SHA1
f9c95c426efc9a8b0c1399975bc07daf6e4f6e60

SHA256
5a447846b2c105ce3694de0c8049053c3884f883e477d15c72b48de5cfc5f342

SHA512
ba4d8be2b268fb41928af83b1d52f77da0105950fe720312fbf8c1c2a9e2a6145c7f07cd0c2ef92800bdb317c4c54fa22c5be2a2e27971c6678b13a2d315795b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9510.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9641.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit