04642e65d595ee66a46c9b5e42adb2eab1d7b4322ff7c289914e041a3208329a

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36cf9fd7645128ba560cb2a04fd0f0a2_JaffaCakes118.html
Size

21KB
MD5

36cf9fd7645128ba560cb2a04fd0f0a2
SHA1

d9291c57d1e5f56b18da9b878676f05f226d0575
SHA256

04642e65d595ee66a46c9b5e42adb2eab1d7b4322ff7c289914e041a3208329a
SHA512

a41a1dbeb5e9f1ada44050978c687ab4753709488d459837868221e79e1ce1a1253f7cf6684102eaf8681abf7ac0a0ff53cf00f8ebbab09221116a4a1c61c942
SSDEEP

192:wIVuJAF796eFDY49TV71iEa1PzogGEohAheuTV7Fy5AWoKaQ3C69vMimwg65CFzX:wIVuJW796YDY49RfyREax6f5qWG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00570a2f0a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000e84fb8f653f4734237232e0450da8ca3a81ccf22a689a91d2013ad2fa737017e000000000e80000000020000200000003ddf2a8c1ee42609684f93e717944793cd7aadbd7e03b224709e5ea4a0a5216c90000000345821f2e47581fa26701a0a80a09de9e6ff683c561a676231dfc14373722967ea050c4ae6334c14039b9c63ab5623492a2841f06ac7a6b1af40e384f7c6ad4245a8025a8df1856a07a36c5f0bf5d4a60d681019b076b1cf9dc7a2b07fd4a01f2225ec28d3e73b26cf9e0b0d34c6c9af20c2ea0f47d673182690d50966a129dee0ded8b53110240fab3be7faa266036640000000d235d90e6dc3c7664596acd5186ab7a51194c26831a4e7de78f6e62b5ccd8b3ad05630ce802c80d511c734ae7ae143edadecbeb09ed4fe2c6835fa811e2ccbec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C98DF7E1-0FE3-11EF-97FB-6A55B5C6A64E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003b764308434abb27880acc7a327d73cc4c22d7a3435a440a1c1db4f4c946bc9b000000000e80000000020000200000007347d2246e49be45caf878af7a7e1df0658d480f0da1895a72d36a9f1c8e962820000000f9e329cc05a0a835b6ee0eac20b2458e1b1651ce208e3b4458825d3e5be87f4340000000ec2723c01a54daec5007a03d5f13d8e50a85711de2bfc8b2b9cc6fc6be15fe6c6e85e272b5dd2b40d3a34ee26d97fe5b3f78de3cd09893c8b692ded7ace43691	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421627518"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1808	iexplore.exe
1808	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3012	1808	iexplore.exe	28
PID 1808 wrote to memory of 3012	1808	iexplore.exe	28
PID 1808 wrote to memory of 3012	1808	iexplore.exe	28
PID 1808 wrote to memory of 3012	1808	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36cf9fd7645128ba560cb2a04fd0f0a2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dd3bf6e3915950ea714653b0bc9384b5

SHA1
ed099708f4a18d8513437110898a4b9ee330e779

SHA256
99808974dce02e41c544271dedde48f99cd90c96209fb56f27edb528bade926a

SHA512
1990d31f2a37c9b182998a569cbbf5afa9cd3aa17216cd6272a83defff67a24894d05fe6406bfc91461f0fb0979152712e71a9236d8a17feaf8f9e05cff290bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
22bd499b7c596f91dbe25d9e969b147a

SHA1
10a51b56d2d00521b8aea3bec6b1b1435c85a329

SHA256
81d2567039007ca8dcea38e2973c4a6913d6962325cc89ae2d726c2d306ef9c1

SHA512
70b7c64520611f5a7a9ed19b657205bf131f2e0085163a9aec88533bff6fb00609fd1743cf2e581a40d6f28d8c9e2fa78587068e001c55cea80d50707e2dc1fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fa41f2aecd317a5db85505ade5d372df

SHA1
5d9ac445d44813ada5f5b0cd43398fde3fec0c04

SHA256
b18b4721e99473164b7c8393c6de08eba4edabff94534b8ab710e2e350fa955a

SHA512
d5ea5ae41092e8d573fef810f2893598692f40c3adce591ccc88ef6dffc5fa29570eac56a287f38d0772b98e447dfc267f7cc227155484b975bee5136a07ebd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e1a49efef3e7403ef54c3a7e54fee0f0

SHA1
c8495cbb9cce40ea95f9f45f244ac17c11dfc765

SHA256
edf544415039dcae3cce0ab7d8f1706f22560ad4998208cf3233dcc4b09be348

SHA512
a6631c87e15b655a4be886bfc0734e8cd84efe3e68a509b8d48650f033420a9644a96516e0911319e17c34210454dfc1d46ca5d0ee9599ad363b3586fe6e1a4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fef0228b8720ebb5c7280c1d33af671d

SHA1
a553bd07afa23a32b055ef9952f3bdc38c19bb3e

SHA256
5102ec0013fb0f8130785c0436e45ce90de42be22bff55e4e024095b039472f0

SHA512
b8747c20d54dcee64b2e61fa6703c6191b0bb9293eba5c53acd17a6325160fb187d7ff04da4acda11f32d13f942eadd9816d5981d82b0427d0b8c29e30dbb58d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c0b67745b0c1d2cdec0e5e141a4eab8f

SHA1
7d7336503d2b2f05023a158db9fb27f8dd7b4812

SHA256
5456666dc1e929ecb96ec41346dbeed379f4aba471a099631297f1435d166104

SHA512
3175948c747d6931e0f651d71bf491d286029659935666f827d68a29187f1440f9ecafcb6cb9e10759f1ffdd81bb7f4b49128135cea600baf81bb5a1707ac287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7f2653d4ade1d36750c6d2a5d3bdd245

SHA1
065eb74852bbb7d49baba7ea29cb7f23c5335f76

SHA256
e3fe8e2054fd846549b8e1cbb0e52e09a1585de34eae9c3036347c6b3ceeaff2

SHA512
649667578ead29d6792b5c6188cd4684b2a91e5adf15fbce6b00fccbdacb55b0c9320acaae43870dafc5d6eb72c904ade94db8a3e7cc9a4582ebbf67a46a7e35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b5c9da2dd3cf8af620d48a2c5c5a80f8

SHA1
5e53f13e45f244fa009418bf518401f1cefddf9d

SHA256
a1c4aceb581618d9f375133c0208f8fecfc87e249826ff76f2551240e54daf81

SHA512
f08591c2c4d22616a439e21a64f3902d59ea7f435a9df4e450fbe9b384c61523dcf32a962e4255ac50ea5768e36ef78c013500d95a694f945b11552777c5442d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
feaf8ef754879b50189b7fd016848a16

SHA1
5e4e94cb96ac8d7137d8ac1d6b09007394cc1333

SHA256
24444207bb63503eaed40be09b37b22924158a2d0e897bfd9e3f21254bf90d3c

SHA512
cd8e9b0542063ba73bf105150203b93ea55a0ebe676c3696e718d9a40835fb2c79fd766e08285bb6eff6ef28a7ea14f1fc9f688ded180b0fbcf174f99bb95996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
15a0885c44e85efc93ffe8622f36101d

SHA1
5e8a577b8cd02a65176a08938f87f690b3830b64

SHA256
41cc78ab0984a4faa4e90550bf3ada5288be9330f60645266083a8611bbca449

SHA512
ebfac5d74d6369da3d5b45da2dedd4f94bd80ba9fd44ea3d879a4e901ef1019ecc1a71e947ecf6c4f36aa8c136cd72fd16e5b1c073d554ab125394f06a3fbf41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
50ecfbaa38e061e0c37851bcc7105a23

SHA1
3a4755ba434695e2ef1fccae48f40d2790a8fd19

SHA256
f6cd90c5c0898dc3262c04e929322af66a05125a62da1278e610881a08161a2f

SHA512
29c36ae907bd2b27a210193f531eb89e19c39eb36ac103a214c3b2d04e1c929ced3d8329b080573891cc86f6b9aee6cb10311fbabf42cae7fa36ff05fac9005c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c3821324af65db6664c49adeac64b362

SHA1
0f8f8f6acec4536529bbcbe6816b1a5e8e80e333

SHA256
b53ef185d3c36a299765a82cb62d309e4edb8bd9a36584f7ec54d871e9c3b5e0

SHA512
d34b6f1c60a8f535e0d0aa52650cbcbec2a0dcac69b5f2d9c2d3b14db877fec0c48e9a89898f7f93224d0f74ff41e0de178bc81d7682d838715cb20ea194c4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4d934190a7d8f8759c66bafd7f885f5e

SHA1
920b74f3e5ea4f116117e945e4ae1b0ced4bcf1b

SHA256
c60eb1850e9a394b28c3cb25d062814aa2284e7441f90999ecc97b8aceae31e9

SHA512
5b27065805a25732df131463e05ae54df16a36680754da89cf8e52f4b2cd4764b3751c714462a3eead27232227a0c64f6f663d30c5809f6307db27e0c012c0d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f963d9d61206c4a1bb17dfdb0793fea2

SHA1
d21d9741c86d3b54c19e143036fa3713721bc380

SHA256
ba4b083a057add02678a6fb5358a86840b065d71013aa8530d9a95a9294a6b75

SHA512
45f170e9a37cf02ffb906ba4da2be3a9b5a17a9e4c0fe763e225a86c21a4e73433a36e04628ac3249c8df1c718b8f68f29e72537c6dcb2fc19d463dfd143bc65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
882b51243bb69e0c7fd51064e3457edd

SHA1
9fca7c3e7a63cd32cc62d343ead0ff0a828f9aee

SHA256
17e3b0fd7ca7b371e19d3daec3d292512bcaf0fa6f10c3e09a30f66728fe09eb

SHA512
eae0036c81c90d15e58a1f26c6bc36cba5c45fb2a35b52498b7480b4fcb205bb6224801d6da2f173bfc661fd27ab3aa95b9f3df97a1e8344234c045aeb12516f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCFEF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD0CC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD0FF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit