f7b64f902740c1428c23f998e9e4d7c926f6a26374553e217fc31756acb445d6

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a9c5e3bfe453f016d8f595e9e1e9a2b_JaffaCakes118.html
Size

665B
MD5

0a9c5e3bfe453f016d8f595e9e1e9a2b
SHA1

938bcfa5ecc04399e05d86b28b51e7105cb484a9
SHA256

f7b64f902740c1428c23f998e9e4d7c926f6a26374553e217fc31756acb445d6
SHA512

cd463533eaf047e8be36436d0620cd6ba51c61b497d1017c96e4e122260f6427f989ca6353e29434852636882efc63ef0e24935deb0607b3fa46ba7f68f56e25

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000041f69c0d43e3cdb3975776d06ccd59f5b4c2a49514412077b3474d25f44cb447000000000e8000000002000020000000ab14ecb6750b6f0cbe7435a46ae3edfe721f8794bd1469208296caf6ba52440f20000000677527cdc3dbade15f930a2b121fd0df2bd0a4904c0837aa0dc89b02a4cdbfea4000000071dcee3fc417e4a484031be17110f64e2bfc7d7a0fc4d00ad4f0d216cd10314100b3c14dfdee8a8684719bff4c7d6a5be52056ad5851361d1bc846077d092b63	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5F98111-0745-11EF-8840-6600925E2846} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000da50f3fef35487959ddf3dbc1166be929d66b2fd2d781efc4f120af373fab823000000000e80000000020000200000002482bed7aeb3b0b8ace75af870021179718f9a8b67ccef0ef173761a4f08642290000000513d0659afb3764da299699664e9e34d5e3fec076a7a4e5ebbe7255c71fc1b7fd1c95bb58d31fbe8e0cfd0caad6aff97d8aefb43a973e65538fba42a668b212faa9b677d4fd65c885d01bc642472416b478bb1161fe0d48663679e12ab24d72aa557db8f8876526558dcb98fff2d77fccafdfeb35227c9c41635846ebee3fe59b8a610176e583f915ce1ba7dee7f6a3a400000002d7b5dbc8517802a040bb21114e93df1a68056ddbde33db512410a0b9112bc84d3723ce0af0b81aa5fe28eaf4a827284e6f84ca4577a30811d7d7495a6506625	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05365b9529bda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420680121"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2600	2268	iexplore.exe	28
PID 2268 wrote to memory of 2600	2268	iexplore.exe	28
PID 2268 wrote to memory of 2600	2268	iexplore.exe	28
PID 2268 wrote to memory of 2600	2268	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a9c5e3bfe453f016d8f595e9e1e9a2b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb153e541c1b3424343e8627ec776820

SHA1
81a09e4537ee49ac7330f7b9e9e82ae129d679cf

SHA256
6d8e219e9f65667aefc9b74c2a206da4fc9cfbdd2c913ddbd22df6d418e2f65f

SHA512
fe1a62fec3cc33572eae32da7d956d834f4ea27219f841226683135ac3e7e849317268125c13067886d689e4304b9c7432cb6b31919b1944c9ed075a3574dae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
721c3a0fc7e9a0fbc23669576ba2e776

SHA1
3ee8c783cd8522304d89f24e02c271ce1349cecd

SHA256
97c0f6b20b285abe52b7b97fadae006ed450fee3e522ce6b2b087185e7f0ae8e

SHA512
fef8d5ff291857fc16f70762e9ae83cbd470334214fef3d53755ad14904cf6b449cbe1d182745d2fe35174751360b716a0539d73efb4c7951ac84eba5fb1fbbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ca3c1a6c94fb4daa56691c42afbf84c

SHA1
242b517bcb198b403c617891ab35068d8e164ddc

SHA256
f6422b3dc3238636da502aa818fca792123399de5cd1e52ac95e727af6a75fa9

SHA512
b1654c042d4d660ac7e9a2e544386bc9481f70b61b52247335aa537d2623756ec142e924359f63e2226e5a25ea7564b517ae254ed4cffe611672ca23f9bf9511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11843314dbbcd7093e4eca52eb3f1249

SHA1
a561499fa25b21ac6856fde2e9529ea5c7385422

SHA256
c3eb1127c437987fc4ad75343ead73a8e04408b1298810117449258c47a49e0f

SHA512
053ea81fb433cb5c574ba94d302599e154d59d988e81271ba26c3a0daf1334be5297a8f68861f607ecb35e56f8a33e21804275112d5e4a24e16fff2a4cd6db54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26099f4ec147fc7adc857e9a5ff43211

SHA1
8cd72db2113c8ca36b2e5b770b07db4ecede64e5

SHA256
25e0184a0840c0e3942f41f2cc0486e582e55389712007d814be32d0adc94c49

SHA512
cd20569f2141ef2aaecdcc950dffb2c1680754e7425a6dba83a28704ee012cb7c14bd59065f7b23cc51ff63d129d73858106cd2dd33f73cdd8f63d083fb4dd52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c81ba7227580829296869643bd7c67a

SHA1
83ef4c839283685057d01346cebb98860bec9b2d

SHA256
a533696c60d843aef05a92e7f14c12f4adf379978249167a25992cb24810e94d

SHA512
5836a4edc0c6a8faf688e76f265c9793d4bb97492eab31c223e14196e0a8110133df6a90dcf6727777beb5cacb2d4e64023bb1a98a4ed3d239db02e5e6fa7b3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6981d78435b6e1b4a7bd8491bd0cffdf

SHA1
b2c6f0736de2d035989ec2d883de9d650fd98462

SHA256
1735ff605e971c958fd9721ed297632c551354ef1d904a554673a363989c4015

SHA512
0a9bd7ae18156947ca24912c3468a0d25f94488cf4fa447163aba5dfa9cfbac6f3725d5d5dbd7b3ddcbacdcbf67b593a8af3e139cbfbd4c72c1dbee4f66ca0d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46cf2e2af2c62a22bb461536e41b8a66

SHA1
7f36eb2dbf53549427f12c0ab7ecb36e843ff44d

SHA256
c134dd5b7ec948952cddf65c8a14753f30a8f6d8112098a21878c8386210e863

SHA512
83e2a2b60459ae64cfd50c388dfdcbca9f2d51a7b6435e0cdf594b44696e01dc1724f41b3f00ec4a08d685e98a2cf3871b2d25117126e9761bf303ee93a82107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e41a986eb7408456b1e974fd59894901

SHA1
74a36d3eed97a687e2b8e72c925f14eac27dd219

SHA256
6c5e949be1dd2ca70ad08d5aebe17e9916a83179b65785b4a39275311ea2a9a6

SHA512
c7a90317c85cc4c9ffb2e6e5f31f81a05add9d1b7c1fb56fda0c6dab9744312fc4777e9771c7880ce22f7e5c6a94682932baff18728c6542a3093614423b51fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b7e248699c0c8a6cc03e754d11c1e77

SHA1
cdff84e19343bfb0122bcf8ffd1dc5df78014fde

SHA256
e2b0cb2426f204e2784072a744e138ba6c67e5c4cbb7f85b6f83b914b608d785

SHA512
8bfa820c1419b4e001f20ca9139279519fcceec1aa70cc910f5b574de3a82e9618cc896b347d1bfb51f8d1554d405fa5f8aee63f33c47a9951bf0acabbce99de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adb0b240845935d17d7fac337a42ebd5

SHA1
35d066e95981436acfae49b3f40cba4df8e1a03b

SHA256
edbd06aa573998f304d7f71d83f375266345159d4f5e85a3fc6230b714bc686f

SHA512
67d7f70b18ce5706034c3999318a3e9f893bd25d18942be8639796df134e1545efa458d30946fc966beecafd066cb98c39432caeaa448afb8717896b67bfe683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
845c4bb3f839bd6fc73e4bb4344c97b4

SHA1
a310cb75f158a13ceab35bc6927442e0cf2a590c

SHA256
e0779ed117d78fc5945067f045ce409d7180baa0db7cd95dcf9beed378e3586c

SHA512
132ae487664587c051fb0fd12fe1e42a099d5e3a15f98742da1584752750f52b62965717e8aad09298865d3fa83f2248414ec52bbf65af44d881a91edacaebb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
443a5630ae3f27a0bb79ee80c441eac1

SHA1
5021431cea2bc708e9e65f43bc76a433b3e189f4

SHA256
eca885ade9947879fa416ace60ca24dc2ed640ed2003e3617aeb29775e92afbd

SHA512
6e25cb95d3c37d19d81304259b87b150d2b23f68c2dc5f6d62a6d6668a39602daa20d8602ec3e81634649eb1dd80aa663645209791dcf599e7ac8933cb64b42c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f99fbaa1fa50485f8760da2c3127143

SHA1
7a2a6781098a2aa4175d4fc4150dbea94d5b87db

SHA256
9b18f0bd0589dba15e1701a2be63ef9d727caed21df314e4e124c61bf68ad54f

SHA512
8a6d4ea6c8744b30152f1ff4eb161005dd88b8c8f1c46365efcf6b03ec8ad5e171b8e2fc8eb46848bb66880ef414f422ebe1fe049024edd570178597380a0744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fcee674a3c0ff119ffa478d9184b23b

SHA1
836964de4f5f433fbc5c1336657e446ac4e37ddb

SHA256
d62d945162ff8ece56f29b4a74667cc93fecc8ee8613893cebbbd9624e8aa96e

SHA512
c07abde001fd2fed63aa7a6ad195458ec5162b6c43b8d82926cebf2df8cd4a796a703d7cf98f21a60e1e765eda4f107391c13f44913393907f37359564f384b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01d4222677eaf76d63581fc9d2309825

SHA1
517f3d5e24d734c4f82a4943246b53fec9f9b2d3

SHA256
c9149f1c33386fb3c9c9da379eb3b4203d53d67869c7430f2b10f29b3d5d24f1

SHA512
bbb9de6638811e4c9784e51bfd8494da0c016a5708fd2778c804f75ad29201d90cfe0a216c67dffe0641fdd1d73eb4fda79e85b7e225f9ac7a32619e3d4e40d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5e8363caa9a4d617b9d5f802d0d3589

SHA1
38a3cdf04f34da794229c637a048996fa8ff0777

SHA256
7594033858c84e3386d00edb3263feb5a4b453834f3e793a69a2ff8e5303589c

SHA512
64e5614bd8c7cc8f799b207140c41ca76e55e90e06cf41c4d4d8e6247564e9768c2e844df997efa2d52117377453148b0acbaecc471a686fc3b8dcb73cbb6dbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24B2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2561.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2585.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit