0c4e568d60290dfc7be1bb142aac930301f024d81655e286af8254821336bb50

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d64fc6e2fc62efa24ec6e3414826b5a_JaffaCakes118.html
Size

30KB
MD5

5d64fc6e2fc62efa24ec6e3414826b5a
SHA1

309aa8c38218d4b16301c5d04689848a41141c4e
SHA256

0c4e568d60290dfc7be1bb142aac930301f024d81655e286af8254821336bb50
SHA512

3fad6fb49db876be49f743725b60f051366bf7ece69965f33d8926342e0b5a1960ca309ab46d8dce56968e1af11f0ffa48276473d6aff21eace085e7c7a68ea7
SSDEEP

384:kDYmnw4teubF1eLaN60kYQuIfMRVw0HaoyUjpAUnXKKX:GYm7teiiLL0kYQffmaMyULX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000070a480024f51d4f615fd8868658565aa55008f5e221d7eec070b53fdf3fdadc2000000000e8000000002000020000000b45d6be3af583c8096db5214bb5e323b49e6410d9e22f6b8f6b1bb869bf6058c2000000062f5705cbadd4af7fcf5cf504cff2b5b485ae7f281a4c1149ba5ac705128ecb0400000009ef015c4b98f69f7b95b8a016bf58a03d7a06f2286491de75607c14c7852b8e19b9d75a52dfa8b5aeebd102eca749e9ddbed6a9b23d8e38d15e943a0283b7bd2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000074af6b91b64c0247402d04111cdd538b02ad0a12e254b323d0f6270d04b2713c000000000e8000000002000020000000dc8e43f5ee91dd26bc3cc7aa4d0c3bf4f601619fe6713c6779b98bd0a0453b9090000000d7c864f7ee5a4ec21c892dba2e243b49ef82415fc1659e3d3357c96975b9f2f85e720e3ddb212d1cb3e6b7fa706a91aeef2adfc0e0665e5afd9e8c95bb33c63ac1f7a52fe56ceea8df021fe6f1d82aa40dd1436700f5b77588264beffeffadbfc552399b58354e54da0afdadd71a3f4037bcd010e1bf2840bbeb629ee88065560e7e5fc4929a60e2c0f96289bcad852d400000002523515578ad640594885a539184adb33f2f63eb1e778d8970f97b223e0d66f2280f84f35b81557a57a2f9a656ba99792525743188c7bb65ba1e0df862f0eb2c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b3134676aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422344628"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7049CA61-1669-11EF-9891-EEF45767FDFF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2944	2080	iexplore.exe	28
PID 2080 wrote to memory of 2944	2080	iexplore.exe	28
PID 2080 wrote to memory of 2944	2080	iexplore.exe	28
PID 2080 wrote to memory of 2944	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d64fc6e2fc62efa24ec6e3414826b5a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4d119e476767f400fc71d1713f8bc756

SHA1
8c8d3feca3d91d7fb6e44bcc7b4851300d098f2c

SHA256
17e8c8fdea6f344a380c3352bcd40f34b69b6ab68849029a4fc7056c89426a35

SHA512
f1f2cf29e6d42fee13d475cd7d46569d8cd7893bfdc3ee55a3b4249f33624e8bacb62807f8f98cbd6e040c777d394fed37e910cf22bfaef98a93682c8cb022c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9df9896b698470bc1c707bdd09bb0bb2

SHA1
7f19401cfaa66425a55969d3fcd5a3562cce3dd5

SHA256
6bdfbf523d1bf0725c9418a6a60abc5f6159142b8509b625c9a16115b027cd1b

SHA512
85d8273f7f79273b597356d8e62956953507c1483072dd7a31310873fc44cc09df30b39e509aeacdb6c375965a575bb291d8427fd6df7a825906a4e0ac323e15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e78fbfca1cbda554e9bd7666efe3e926

SHA1
e98462954f714b17b52c047a73eeeb8d05c781fc

SHA256
a4aef50ec616dc7e2489aa2969452629130fe19225bacd6dd1647e1292d299e2

SHA512
a9d63930708e9cdda7d76218bc970a3ba8c17fb2f66c1366b453bd4e49c32a2f63e2fdb2ccc4ca5b427d7a0ad8ee645d226980a411b6fa064dc20ea935fd1e2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b85c6f5eec7444d0565efcca2371a27

SHA1
480ab39e83d25d5c6e17a9e181e9c93f3ad1b9a1

SHA256
36b30981a08986e51ab7f20d9a3b4d399edbfb6046602e09067fc22d297e783c

SHA512
cbffe6d037a2b00b238193990f97eca7d6041d4a2c3e638d5f72a460ce6ce12a9d2d7ff977c4317cf34d983985da5dec683fb5416bf1e8d98a7fe7631a228377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08b10ebc4f27528c12e7a46a846d24a2

SHA1
b3975f79ff6a0a32ea96f6ff3ec735572d8b3bc6

SHA256
12bd568891ff71187f471d95722ff1c15d719ad77a38c8eadda73ce32a97e4f5

SHA512
85281a015a6b1dfddc5a77a056620b5afb82c5b6ca5800be9b8d705348eb3e81002a803d69df4e5da7d743419fa3e664cbdf4b2f47a6bb880e19a75be7455a7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f7395b13d8dc3b92511419a6985035f

SHA1
7fb586dfd78c817977f4d8e41fd4c8cdbb292a9a

SHA256
e8ce55a216ac625c27df3cd9dcd0d28793ed8f7915e982f5e958a0523564eb6c

SHA512
c5ae9cb965390c484efc7f67b571a69ddc4c79e49738c85a1be5f3458afcd72fb724bffabbac3a401e6b8324dc044b6ca08704f45413a9bcb14c1f0bcd24db61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8ba1d22682ab989082b2cd0d37cff7b

SHA1
e6ed2c7661a0b63a164abc0cfeeff9890fb22886

SHA256
5911e85cf47da7790d90b6f2677174d81b4a3f35395810a18ad21b6d15a8709b

SHA512
d41219daeb969198f266bc9cb9a85b89086d0fa15e3468937ca8bf8ff57e81c38c16b909f1b5adcd55f203a20411c85eacd444fa75f312956f5cc1e35aa2cbaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8731d56bb2f9848cefdae9727e6caa3

SHA1
87f6c40eeb99705c6485cdd66864a7b4c5cb09bf

SHA256
5dae286ae86c8b7d1d0d5eb6b24904a64fd3948ac85bd33364481ac6de8c5da7

SHA512
ac8e43303fe5124e11ba7d9546e72243abb525c158d3dcabd2c58766465c86277b44dddf3e5907f45bd9a1426eec2ad6ebafd1709e37f374ce51975cfc43d4c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ac681c80ec184ec0b6115bc73a61c89

SHA1
a00494f2a665b0c781218f80cbb3f5385744e2d5

SHA256
a39d142be8b2a7a966d02bd6feb45686b14244cd5dd07ae3123589e8bbaf60cd

SHA512
8f76317cef6c18e18966c19bfac6932d781e37eead1fb50e11f09da3e886784b3563340b30785f41843a00fe81dd6b2e06271d5e2d47cf7c48cbfa8269d145bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
850e5667bc8cdb5076c910a08ac16939

SHA1
2a525ca3cd5ea3aebabdd6f9ac7e921c19b51704

SHA256
b5207d1571aa4c1bf4e9930b4a7ae4de2bb0abeeec3bf564d23ee47c03b453f6

SHA512
3f5b5e3e784ba10d684ab6633172e391921faaf42a641fdc9375fe9970e424b57b3a734e957df2a1f3e84eed9f3b9aafb4551cf9187880d842516f7e2491c894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6d6f8ea5d3fbc4c64986c48e11682cb0

SHA1
cf9002642ebcfee26507ed2fbba8d48885b346ca

SHA256
68c244779f5757b5c85c20985738cac45f52fd211db7a4e1e5e1a1fe0995932a

SHA512
3323f20a46248a50b70e3a882e7b8607a9dd9ccc889e00e465bf25878df7c6d0ffd916318a042be7597a60a2646f41e95073da4a0d25a39b445910d7e10ab790

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\cb=gapi[1].js

Filesize
64KB

MD5
63e5a0b45632b3dde3694ffcaf0e3f7a

SHA1
923736d0cdc308331d5cfaa0ea159bfedc83d53f

SHA256
889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db

SHA512
5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\rpc_shindig_random[1].js

Filesize
14KB

MD5
23a7ab8d8ba33d255e61be9fc36b1d16

SHA1
042d8431d552c81f4e504644ac88adce7bf2b76f

SHA256
127ffe5850ed564a98f7ac65c81f0d71c163ea45df74f130841f78d4ac5afad5

SHA512
e7c5314731e0b8a54ab1459d7199b36fc25cd0367bc146f5287d3850bd9fe67ba60017d79c97ea8d9a91cd639f2bc2253096ce826277e7088f8abfe6f0534b63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\3604799710-postmessagerelay[1].js

Filesize
11KB

MD5
40aaadf2a7451d276b940cddefb2d0ed

SHA1
b2fc8129a4f5e5a0c8cb631218f40a4230444d9e

SHA256
4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2

SHA512
6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2898.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29B8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit