ecefc775600148fee6d928b6534c6c9ae2cc0c40383a8dd901d40fa32b72007f

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

384f70d5efbedae13d5fa11fc62a1359_JaffaCakes118.html
Size

252B
MD5

384f70d5efbedae13d5fa11fc62a1359
SHA1

19b92e4c0f467b1a2417eaf0280198f95c91e7e6
SHA256

ecefc775600148fee6d928b6534c6c9ae2cc0c40383a8dd901d40fa32b72007f
SHA512

7370f577b79bf0c2b7447d8448e2a1273c90fc02b5f49ad899d7b04d2f93bac422a080221667096f4c4de837898b87033d62ca58bb344cb26acd0d8893d4accf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f435a42f3d6bba25262f5c8bd1b7e0fa57123cad4a49fb708225a052c5cfac1e000000000e8000000002000020000000625b578cfbfd026f70c010d06391c37ef57d2fa869deaae6726b02619b6f31d42000000042db34e67ba13036a10bfd16db8aeebed0c5d72acf9c16bcba67e0da95ad055140000000279a7b7a8f64ffd74a982731a891f09161c5693d27499c31a90e2fc2c5be25139e57e8f89decc688b23c9ec45236db9420cbefe613ef9fcda31815fc883060a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08472d726a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02C06CB1-101A-11EF-84C7-4637C9E50E53} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e9b873a5860ce512294138a3e43538c7841fc28e7fcc6634157d92b9a862eb9b000000000e8000000002000020000000ab55c007baa11aa47cea1cb004b7899405799ad6d65a76bcebb6704174c6281690000000433b3499843fcefe9aa169be36887409a75cea980712bf6ca124f2be6b66d4ffce14b99852d9336d1b3457e9b943e6283f1f5c0ea029b71c84ec45852010a46923be7e996ec2e09c87d42fa2e84818d62b664942f8e1e38051e3d07468009f36e0df0647c039f59be7f32bf609cd9393d0f5524484217476812b423dc047f71adadfb39fc616d01c657d052a251fa3a4400000005107157e02fe7981f8b8fb408524b8df8d5450e85adac4c59f32abfdc5501c9b10284886e33c46bff570f69a864283e6436588115948adad19cc05b80a92e402	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421650804"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1912	iexplore.exe
1912	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1964	1912	iexplore.exe	28
PID 1912 wrote to memory of 1964	1912	iexplore.exe	28
PID 1912 wrote to memory of 1964	1912	iexplore.exe	28
PID 1912 wrote to memory of 1964	1912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\384f70d5efbedae13d5fa11fc62a1359_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
853fe5ea26e20482624f3d6a6e17483a

SHA1
bd46f6b17c04ec088a0ac7ac562b05a35184c215

SHA256
b90e70175a6847265d54d56f38665d35c2bcbe29ac7c31025176d8cae6af6bd6

SHA512
f7126faa7b552983d374878c8d7fda09e7e5c6c6086cf91ac948c027127d2402e4da73df06b8bd3ce8c3f7864a9a3dc8c85a8b03eeb4b210daa2b0ef93dd5238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9955c1e0d9a21cf7ef4508918f14d62

SHA1
2d18aa525e363821f9d6184d6edced0a756ee148

SHA256
0ff56babf4eb1e230e66191540f0e2d0ca1f14ba8a1fdae0a3ee764f9c4ab688

SHA512
22f4cb62c4741b4987e76a5c52d787b9a1d41b551e7a593d45fcec9b471a5f37b78487922e1f4ce4c9094bf4948fe8a5664180c1569806c8f897132bc20976f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d88deb523b6acacc76e4574b3e2b042

SHA1
1cdbb7d39877fdf6077fb189476fd8f40954d0bd

SHA256
7fad8b5296f660bedcabfec6b8e3e3e66684333f4026468b9af182ff37d8b74e

SHA512
f5f4fe901546ea9e82da8b8cbc3afa642b5356e772d934785f56f08d9caceaaa121b14fa7740ce731552337005c8b00a1039708d849deac50ca5d787a7c4cc94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a920d9b1723028123c7192be92b9cea

SHA1
cf96a13da38b8529366328798be8ed3b64ee84e3

SHA256
af354247ffc5b42bdea14aedeafee1455f8eefdef80be4da0dfde1ddb366deda

SHA512
ccb72f1f60cebb44e1baaddad71dd9b83e9d72567ffe1ca7b83f6cbe3cedb7d0c435f9fbba8b3b7032d6da42ec6e5ed4750c1b87b818085d756e75e315b3dbbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f49b1797beb551f5904bcec0f67cdb2b

SHA1
6df10261eafd1ed685c848ef6046e07462b7d31a

SHA256
b9702c7ef31db69e34a33590531c58975281881a4d6c0c4c99cf111cbb64b98d

SHA512
199e9d97a594812f78a720cfcdb420289ccc0adeb1c756f420369f4c049fb5a1ed420009c0c48132b39e34a7a6a9e6f86a94f29739b88ea0198893931d770a66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
994621278ac9e0f95cb496ec25c84b76

SHA1
d75ef8daa0cea9549e78706561237520038e1d6d

SHA256
bcb45e5be0e6509b39a16a17e67a5117726a712ec54180607a310d33639549db

SHA512
fdd538567025d9a39cbdf08fb97e767d0820714833592d1681313199e772aa9a51a7b6ddfbe3295ffc5c218423bbfdf65bc693777c4f1e91c923958ab9f8d7ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50e6042af126102223e54d2a3b4b556c

SHA1
2e6eb7387ba5d41a10856be9edaf3e22dbdeeed3

SHA256
28835d5f1f94d8a699237fb857265bba0a005ef59a5a4fb7b98d7e972c51a9d0

SHA512
33e7450f410f7eb83b8d60f48b2a898fa344d9da529fdf7fd632ce67999bd7b0fe8ce855bb09ef130565eddd6dff179563743b1cf200780720b8402fd7a80b79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d819d8741fd6656a55e5c1d1a94293a8

SHA1
3458230ce1ce418846300716a9051d9c4f1147b4

SHA256
51ed0f5ca0a60ee5651a5dbb005793711d820d8708626c4a00059c3e989b6605

SHA512
d4bcf5ac2df6c1f040c3000b0d0f61f244e3d1e4947ad9eb0b9d411b4557282fb0649de829095fad0964d7578b51a7e19b7c433642174587f0b6430bccd648e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c305ed7c9170caef7d10b7d33a5f9af

SHA1
0f4fc3fbfa5f29769de625db2801a7c60d3f87f8

SHA256
0d9cfc6061de23920f276df5c6a5574ba37e5877401df569fe0bf215e78e55d9

SHA512
81fafc861c445e82af6086f1b56e55febd8231655009ea054534c7291fbbb28a181802ee0f51f5330f00448c25350d9dbc936b7b5d5ec9bf88924ab508ce5d6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b24608a4d62dd6b1741d7dd3ba3dc35

SHA1
84f610018d9ada1b2d6ea0662e697acc0c69c63c

SHA256
41c5cb6324b57ca9d57675ca537ac67dfdb78b982e265d1173d6d518b70193f2

SHA512
4d2512ec2ce818b58a58423b3f6c2f5ce15eb1dcfd47ced5a00f541bbeb9ede5bc30a92c3ef45d76f0a8cc002733ecee9120c13f069fd6336a68507e748acf0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc08a9b75472d63e6f427dff6b96ab01

SHA1
27b1e742585c8da4703afdff07297ac49c86f0eb

SHA256
78f7af84fb4fad3e06e2177bf82a752ea3c44cf346e34dc5e83d8c6053c2daba

SHA512
a61c34e284333d56f50e09be68ee74ddb7244cbc03641f0be85985e2d43d16178927e498c259416cf33f814a542ff92bc14cadb906bbf4f1facfad90267954ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
263454bfe36e52f2056b7eb65f51114c

SHA1
3ed07252bd957cf4a17cdbe01e7721d8a930c825

SHA256
037c8b28d5dfc95bb95142a782c0e8e8f795cf1fff163aa7d15bf7f89c73e60a

SHA512
c74fade0ee199622774c405691a15dd29ba569df6d7aa92d54b127cd441b3d4f748e16bba0721b7495b61dc8c0b1d29e5d8be2a6e87afe37be6d29b68448147d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8313478074929b7e6a7b23427bc0875

SHA1
35dfd7553e2ed8961b2fba8124d9fbcefb15caee

SHA256
9320b2bd835d0ba4594509253ea41988875b80f7d0331bbae96eeb1872243daf

SHA512
3736b462d8eb60e2677a889e630264c836e7129cec570f35b5d54c008246a6b4622f8ac23db8b87c5740523080d41e7a3442867e4ff01f73668da0b27c3b6077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeb10f1fc2932a218d5b6bf298bd5f68

SHA1
07f1cd39f4feb30da5696529d2348647dfaaf16a

SHA256
6ae24d0410bf96838c8209590ac7f5c22660dec7fdedc46cd4b9ef23f94bc176

SHA512
3431120c523029d9538feab2d6b8dcbd42be429907a4f4b54ce0031cc3d6d7411f27cbe924e30f26458750bcd1f3f6e4054448a0a6e55b090ead5867a2e0de87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bad8cf015ffc6854651ee1802b555991

SHA1
a82d055b14b61ab70e3e983adab06f7cf207c350

SHA256
2ae6c5c18c1edbb53b8948c7ce15c169321552aea51d230230ccaf4fe91691d6

SHA512
9a601344a00a9227755f997da5fb4cb756d29df8a96407eac78573bf2f05f949a1174fb7f32e802bb48a2279ebfdb6c717e6d2b53641cff888401bae28881872

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c19c9fe261893cd69608549776d87889

SHA1
7f4599385dc43978f161ef4a643d800da31c8816

SHA256
ab2f27546cb51d339de92f547f3abdd84e42e17e2b56177b6eaaf84132c1ac92

SHA512
2d63b2b9c1f309615439d6350c403f4306a064aac47c65193f6db8753160baaf45e7e2bdff9cedec18d17ba60488aa5e3993ee6e5560615e842a84387be05dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecdb7d2d442580d34c343fd96b759376

SHA1
5d0004bf1299c778d48165267d9ced2ea017ca5e

SHA256
aeec7704a23833275f7b98f763ee0cef388f52e92a60681f6c10f277eab84434

SHA512
a2005591de45488874b34605b6f4c8c24db69ea2236aeb6b66a9d8485b5d802519e4e7c79af7526bc8afa08bd2cdc25f5bf39187df520a93789292d6dbf97961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c887587cc9c5bba5567122dead62df70

SHA1
1f9d3a5934cbf5194ad8551b4a4db628eb195fa0

SHA256
38455a9613cce8c00d3fdd36b96f4b6cc9a7edb728764af465784b576474e728

SHA512
8a2e139b703e4cc8ef39fa016407bea4a441e4baeaaf1b19c83a73a728f87bf00e55b966054bc226c129ea18ad901940884d83945f7ddfc871331f8dd707322d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26B5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2707.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit