c0be8859c39e25cc70f19205cd9d3fa673bb03b1c24fa323a5c69234e1d6c36d

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4db885643350b7d4b9f2c5800219f1a1_JaffaCakes118.html
Size

110KB
MD5

4db885643350b7d4b9f2c5800219f1a1
SHA1

61f49fbfd6ff8c9af0c5c34651b25582448d0979
SHA256

c0be8859c39e25cc70f19205cd9d3fa673bb03b1c24fa323a5c69234e1d6c36d
SHA512

25d65fa9255aa3b7818c81310a41d9eb8a38f788dfa49274ed6d1ac3ef26f3fe87b23067960ef78266a668321663282940284f8a68fecb7cb8957d67666b69d5
SSDEEP

1536:0TD/CzvKzqxFvthcsVwfbxRTf90rkZuaV1cU9SYC8IjBn6dtHf9Si9B9SEoBx16x:mD+vKUqbTY6ZLcB8u2eNAbu/Gik

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422066817"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000007fce2bbc7d3e4d477d1b4cb866f3b5d21126181734bba76b195650575d94ffb8000000000e80000000020000200000006331446f4457d726209b4063f3d449e46abdca33ad955354dc4188b602351ec420000000a0314e96b12e0991ed46ff94050dda8863e5fac3adc36015a1a0287ebb7af15040000000b4f1a3a4c8d241f5b02a8bb65f3aebb9f63109afbb414efee3d154271c147a2984939657f88e7febe660dca01e00ca5725e3399bd8aee31fb9f56ec5d226622f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a3bcb53fbaa46a4a9ce15c271b883136469ef9faf17fa08ea2990593b382b6ba000000000e8000000002000020000000e1e6dda8155f745241f2e806fd80c28f60c26c04906dc8273523ac9f67ededf790000000c9af052afd7cca7311efdd6ad88ca4150aa2247b11fde08959b67c4ff6c5cc7fbb2f333f13005c92efa02c67cfff366fc3b3d90a38cd4d5da0d01126e21c1e980910c94803333f5c587921ccfbf0ac88749aa9182b6aba8c6625b5be89676f82b6366e95bd3d7b65720129bc0e95678f8c77976a998957e99836b4047580a30291e31469e700e7e2663f37eb577c01fe40000000d4c6f567b380d353d9248569d55ed2366a4ca6bfa52c8b0c08171387ca5eb026b15b42feb8124b86b96470ea16d376cc6775c0953ad9e95c73c59dd674fbc02b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D547FC1-13E2-11EF-B27D-6A387CD8C53E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f0f271efa7da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1940	2848	iexplore.exe	28
PID 2848 wrote to memory of 1940	2848	iexplore.exe	28
PID 2848 wrote to memory of 1940	2848	iexplore.exe	28
PID 2848 wrote to memory of 1940	2848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4db885643350b7d4b9f2c5800219f1a1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e827174a76fdb327ec4070345dc9e58

SHA1
9a357f0218aa5ab8c7254c0738ed7d7990c02919

SHA256
ac5a4fca5abbe7a950904facd8392f7de08bf9d8800c615a6a815b21c7904251

SHA512
728f166a806e56d47d3fde1ad7ea31cc8084b96b46e9b3e1e3b62f63aa94ed8688091a88f763030e26a829f706b4466a2cd5130597d0964bae60f5e6e24b9507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f279d3d339766cfbe4a78ea054521cf7

SHA1
195815f9b19077bb837f0fcfda769784bfe8873e

SHA256
05d6332e65db34cc8f50e526174b887d9dc002c03e2a614d37a43da2ec78d73d

SHA512
5ad473d5651ce8d1a19c8c41b9be8458d56242bb830816ff2352e02d4162e8e5fc5162d0d327a62c49ffc89262998ee9fa2dae0679ac484cb87b282771c7edd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2991fc85ecde3b38169e974feb9e256f

SHA1
62ac0cd197d58737aea57e683068b15bc9179a99

SHA256
ae1b834d177f2081b9663361abe6d4229baf709c64cc0b0765318079bc21fc46

SHA512
deee867b77f54f88ae24be7b63907017f5aef672397a1700b620993cf9ed4a31c45ff37e0851dec9cd2fd6870ea4c4de4dd43becce152c712ca66668e55d1ad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa0b939b6dc28a9ffa29cf96d08872ce

SHA1
17b14863eb86cdd243ac7061d33833499d8792e9

SHA256
28d618356dc5d1ebb9e98061aca853cc4bd2e2669ad175c027b4fb59a65cea03

SHA512
3ab0c9e2f086515202b280a70c8815a677e3cbef52e6cec8d2cf5e8fbc0459c798772142c1b316b11821cbdaac55604f4822ec5bff18f876b7fadc3f3ff9d2c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdd246b905ebf1c5b20475b2d71a0830

SHA1
74b687fa0176c9af3d003a26d4fea012f48437bd

SHA256
a614902c4712ec71aa91686643ddb3e704bd901930f494036404a8ba16c2af24

SHA512
80d49a36315d410d0e1bed4d8ecbec0ce6737a2789bbe1e15e28b910c73498ba60955f6f40cf587fc47134111dfc9b75a325e6ed0bd29882ed89f4e3b3912d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05b5a9cc25ce92ddfc77fec6b6b518c7

SHA1
da330cd04f8949e544b4a544da17c69a317fc085

SHA256
67369f740dd407563e54391044173cdc46c17a2286ef3307f3d19ce1b5213abe

SHA512
7d800f66a719482562456390a4de15100353149826dbce75e54ef43e5c7efece7b6d1cba12d5701606261571c4614908a3c9e6ef9f3cb3e010b4a87d8f6c5f13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82c47586ef769eed2cbb43b122eddfb5

SHA1
52cb428a426a926e5c9e6edc5b1c16cbe1650027

SHA256
758906aca44f1b4aee0697af644296e51f9ba9e1f2ca03bf73a4451d25207619

SHA512
49246ad9c74099aeac2caa8985ed5ed7f27f99ea6ffa265d819d3efeed326726dec043f67a4a664ebf20387909ed1793e3da419a44dcb3dc8b5064f108bd8a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d56ab1f28bbd052cb99a8890cc6c1a99

SHA1
d0d82c69585cb389e1384c4ff21277d6398e31a3

SHA256
f38f0e38ad3743f959463233d7640c8d79fb79f4476694bdda4794499e90e1da

SHA512
90a93421d77f53c263d9bd2d811acc6020da6b5890d26bf310d90480c0f6dc4188c340bdaf31a8b154ad241f558e93093731eb25a62f205cf10b831efd0bdf58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09c6c8fe273b915e85bd8425075b7b4a

SHA1
839806b145a15b13e04fd6b1b81e8488aba68091

SHA256
8691ceea88db95a41a59a1fe9621e9bccb7ea730b0e9f82a63bc0527dfae4cac

SHA512
aeb9ca88e03eda52ba7744870496f1fae35d4ea2e75d9bf558c59520144855c592a3c0076af90868ba6904d8112c09e5e461dc6eaa368f177373cadb2df70516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b88ae98b3cafb6249107f5fa57511f67

SHA1
ff12486682038ac2ff13c0ce97ee56361a0c6352

SHA256
bbeed449f6f7c175acf87f62fa5f8272481a29a1d1793eae33b6441b4e9e7cca

SHA512
f058683cf259d2aa0dd2b39c1f68a647eccf37e75b564051e41d3356ab9a1beb3f6356a9d1e43d6aed4b26531c29ff9324af474e8f5197489d259138e8cedcaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
052fa03e538e1850e546b7954416f9d0

SHA1
094d38513318733be17917a30c6df0f5e046fd2b

SHA256
be74ca3602a5540ce2c4ed4b0ac9d6015ae3fcf3d4628400dbb8a24edefd36b3

SHA512
823de62123a0264c8d63995012a1da33b06205a0636e50e70c587c7b717496f5221709534a7e1c11a7b9dfb9857f60a46009e9cee26dbec332f4c330f25762a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c0952687a1d93ee7ae3cefa6dfa3e9f

SHA1
5912d94a1263ea4527e751e32753d37957873b95

SHA256
0de2822c392cc4eb797a75f3ec6cf50eedd499d6414dc936192e2eba81b6ccd5

SHA512
40b7b03a32648bc301cabdbc9e33973c1c0db2a57676d0b575523f428ddbb66b219c8858bce1167598af6cf91a4a15b3aa143fb8346a529b16ac9be67e6d3d1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eab48055b74c287fde6106cf632700f2

SHA1
c632eed2f4be9338ca8fe574a3db51cd87a07404

SHA256
cb5e80fbaca1c600e370dde8b1228523f845b6976e2f56f9ca5afd9cc0ff8561

SHA512
2a93e30e7072fcc6dd1f9418d49430767e9f12b9ef8ce03b78a757c3e1920b865b144442c32537ecd6a19c7318c9ec58ebb124a6cb3398c68d936f550cde4221

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a93f94ab4e43d9d529a8d221552910f1

SHA1
f2424bedff492d588b0d595c34149506df786d11

SHA256
50a1f65a20144a3a30a55ae8bec415609a9b604cc89965479582aa848b6d11b2

SHA512
c2d895cdcea52d1f31c1fe6143411e8204c8e6e5891b14ad7b789f91dec4229bf7e75e2076e7997b9b8756c56cd9a2d8599063983cbff2ed6936908f1faad681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7154ff4e69cc27a0f822865b95fe2265

SHA1
b79a00e46098b05e561557f3355dcbec7c8fbe0e

SHA256
04452e92ed3978fb3aa083a33bcd13a452ec06ad76ddc876bb039b36d02a1019

SHA512
22a466eddb735f6bc0f0eac9de86127c5f1e5c6ec2484fa236c84ca45017c97330bb2e573254eb0378431ff87d27db8ec1afb3a549e218716871d9b5e5c8b61f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7031b4a99d3268d1a613f18c2faf077

SHA1
ae1107b55b51af0176f697d11dd263ef6a15c7b8

SHA256
39d3d148d55cb685709518201f4e22afbdc935c665a43824f9169651cf12080d

SHA512
c3414827df388c9f34bc3776ec92adc19c25a459baf2526c774d060fec19995b3ac43f5e130fa6003939c70572de47041cba7957778708b3d4f54a69010c3295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b618d2a181340d5b9d84312b05a0637

SHA1
6cddb9472a23cec4fcc036e660b37c9de8e4b46b

SHA256
32735a90a8895043c800c6296c761fd56a2e644b1f99ebb8a6d6a68a2e904531

SHA512
acef82e3ecd8b6eb7b907fa55134e0b9d5e2fa11ff661a839345b023cd78450d40a62c2c7089a23f577158d5c3de70a69765ea7781a8ac346a633f1f26397048

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2EA1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F02.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit