ec7b286e6d38211523b4fd86d33b613b8ece61f6d1a6a2bd1abcbdb679beca3e

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c87405e2b6eeb049c3cbf6c2a7336dc_JaffaCakes118.html
Size

11KB
MD5

8c87405e2b6eeb049c3cbf6c2a7336dc
SHA1

d6ee7c453e8ef88b801221f43321439097bcc74e
SHA256

ec7b286e6d38211523b4fd86d33b613b8ece61f6d1a6a2bd1abcbdb679beca3e
SHA512

b71cffd5cbb49a7b1a7ebde24c0469af756bd1505b57caf8e56c1fd07fbce8f9cd488d814a27cf4ecce831c2fa523f327da3f8eaa2d3af8a10d2de1b52e70e71
SSDEEP

192:FRbeYgqIJJmugKBb2bxxf++fdRYiZql9iO+vZ0lsHjbA/adbLO+v3fbUDlb3JM5n:FCvJJhgKWtPVql9ijZ0GHjbbNLkDHeQm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429582970"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000008226694ae705fe2f0aef6e0e20c43c11c8bd948d885673f6ea3ea84bfdee6d60000000000e80000000020000200000007f5f745725d24ec36e1eed89b8c4b324557bf20d9c11d245e20b803b4015137720000000be1697ccbcbb156140990b73fc4fb3e2c8223d1cbcd3f2c234ec95ffa3b5bbf440000000ecf38f91bb1646893572ab1bbef13a683aba79fcaf147dad097353cfbe88d75901cc7abe4acd57a5db94ede5e44811a46942b2d53fd5617e76eb81c19f55fd41	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6072655e4becda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000e9eeb53ff49b6900c0f2a78ced262e3051db43b37f906a2c9583fa112f84b188000000000e80000000020000200000004aeeab474820e6cded8c7eadcf2b946b593097f95cb8323efb2cdf61b66eee4490000000cc9108ef65c7cbd0b0a9dbf4b8db5d42fbc83a43e8a83244704350c91215c1fe28ba4dc613daca2811812a8ef6b31a9e411fd42ae828ad5b0d086fef6aa7173598afd07f03eea363f3a186cb7f001681b709840ec528940ec376f59f5373415e76ea3ddc73dce9344d8b6929e41e28d7633aa8ceaa8c30cb3480e1f6673232649d1ecede0d1fbd9c994b3b0b6e09717140000000e45611245b580b1d4e10e2aee4119999d921e1d54341af21dc520db6d81d06db9acbf1a1c2fe7faeee09aa189343aa8cc42ac8bd3b33c928bbdc461826c8e9d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85856FD1-583E-11EF-AD83-5E6560CBCC6E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2548	iexplore.exe
2548	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1988	2548	iexplore.exe	30
PID 2548 wrote to memory of 1988	2548	iexplore.exe	30
PID 2548 wrote to memory of 1988	2548	iexplore.exe	30
PID 2548 wrote to memory of 1988	2548	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c87405e2b6eeb049c3cbf6c2a7336dc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1d2c944ef6479efc2f2d995cb186cfb

SHA1
99a0ed35acee11c532f3ed6b73c268da60badfeb

SHA256
07eb0137dd48d77f1d5de78f46c79b30a12baf45524b3180eff7c2511020df42

SHA512
ddae97e075efd559b13b945823fe8cd9e2855a1a37181a0520b53d41af2970ea37d1e30c323f7306262488f174c435337c7efe466a2c7a96e43ee7963b5218e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daf0483de4f05ee46add135d48edddb6

SHA1
b3e1af62d19c8614d21890d1c85d9393d63e5c2d

SHA256
1a11cb10c6a6c43d97fba61e426af1ab97d14e8de0645280972de54187ecdfce

SHA512
fdb18872ecbbcca0cede9fdff0f13865b35fd20b73e8ec2c3f3fbe632df01e90c96bbd8b092a696d44332400e9bebb7fe286d9bd5015150c9c25d2f43d46931c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
762ae68466130f5a75ea32615db4b7fc

SHA1
d4975c8cf036f1a30047f1552091bb79af2619af

SHA256
7eb5cec5fa0ba7b2690ee60dfa2a2f5b9369d2941660d1d38fe37e3b65c39de0

SHA512
0d436d54a30f123a0de359a3d222876eb61067aa4ae348afb45ede92df203200bbc6ed26679d8d5cf3a89f6c126412d15fab626d02cda62972c5eb102b9ef4b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e20e3b7b4ec554d150fc4a1533d2c4d

SHA1
6df2d1b8efb398879b408e5605b9cc649c6b32a0

SHA256
35bd670a2c9cbc2dc745668ad85c14da16735cd961e9e4c2117f2b232c6c1886

SHA512
eb54cbaa733c261bd6368b6beb415a90a899240a9a46e4d63ceb2287e8b8de3db80b24265ec19ec55c5dd4a3faddb2dff4ad60470cb4e20c0e5f9f76492e0a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d7775df6b147d5e54993dfb67dfb2a7

SHA1
d61f56100db6ad58b7885bb87c7c5285098124ce

SHA256
acfeda9420173dcf7dfbc880c541e73c30caa94715e8e5384a3ec05371aea023

SHA512
b271b49af8408e3e7a2bd56c937ef9d3b6aa4f2d3676ba3d326209ed970977229b857ba2e9c462567594377134888e7c447c151898cc5a53ce88d5f5a990b73a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
790f80950ea8b75de406354606e6a35f

SHA1
dc3f0323d8c008f559ea31b9e08837c97b88ad63

SHA256
22a6aeddb01b7910c70e95b6bf016dadfbfa9f3cf9176f78a2620852422edac4

SHA512
aa2a088b12ee7e39eb6802e5d0a04b9a29b1ffa7bcc12b39f6d4569cabd4fe9342fc64e350a555656965015abe2f951c28de91071b38b1c87a699b45d32f9435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b40d7e4c3b3a729acb5ae9021bf3407

SHA1
23681f35754697bca3c06af692cea5dc9b648bf8

SHA256
edd77abc8bd194dd40732e7eb1bbf8bf69118ce06be1dbe805182bc5f0a3c9ce

SHA512
24ecbe890dab185024da6fca0acc84e2f807d07b98033eedfca7214c85588afbba80fd8d3956c8b44e51797f8653b4509699d15b245fb01bb2c25f54e7e2f219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3066743adf803bf31532b480b75e057

SHA1
ac0eee57e27d92f32580605e5a269a8568516545

SHA256
9a6b983e99c33ba06759589fb886a400315e044b6e847ba277544420569c32de

SHA512
6777dbd4a52f2256669648f0bcaedd999af32df2a1ad91c4aaeb66f105668e8d441d19bf32240e8f6f77aac98dd25d9ac2097eeb9a6b5fc6b6569f3c5dfd3537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8d2e664d4c064f3bd8f7830ad95f892

SHA1
a8d12447a9b60369340c42614e1ce0249a6b79ad

SHA256
7c655152708ad338a365fa1c072eb71f29c097fa28ba18d98d7a743c36f8055c

SHA512
4a62fa7427839e7aaae7097cd7c1173a4953e5e46b01e50c45abee1cc04abaae4f9609ebee025eefb8b5e81d18ea3e5dc85c81877bff67eb06d407abaccd47d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fdab2e2d099626afda6cd88043372b7

SHA1
cf7b98b1ed0d66549c4a61cec007d08c6d08b169

SHA256
71f9fd0c0e1f3145b6216d8c7e5338891d15b00f15148af62979437f8d0a8dfc

SHA512
26a2475486164108c309f8519d463851a65c2aa1f8f05916aa0b93e7dffc238e464f2314511d5a237361f76f027709c09b01411c50bc0f2e964439a65e13529a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5066eed5eef1c172543ed0a56bcd845

SHA1
ea589b945be88fee03a21dccc7b1cd92b28d3d4e

SHA256
b5a743532e4c1d1a3b10273155ba580cb24fc2ded09f46371b3363b57e38d2ce

SHA512
47c7d10dbfa6d8896e3291fde3edcfbc19d413c739b3b255cbc81f82e86567a0868463b24fbb97e0ba2adee754dbd82f6ef47be0f44e71ed78c65f70191957fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
787be19140059ec11d32022df3cd19b6

SHA1
f784e58936122235cacfd04654a88e2a9e383c3f

SHA256
c9a872709bbd74822f8c2ae89f985d1ac2aa5c340c271b6d94410e2ec40b8069

SHA512
18173e8d0125929aa5806cfe11df1f042f10c8abe96219bec6b4d3dda3efa0f56bd521d704fb88787ba233f9101ee8a4687d1625a3a23111a28e53a62f6fb82c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a56f8b4e5fd3ed94ee33fc52842d2f2

SHA1
d1e8f0c468e9c557adf409bf348c77a7ace9bd0c

SHA256
32558bc122d3a2e556c6327db369f73598e3d4b0dbb1922769aee6c3a580566a

SHA512
8e0482602acb9197797eda5098714f6f24c9f4bdd7bb53571f4de51b10ae6de5924d7907162c5b8ddb7a76f56a354b6948682237d7c2afc38e25dcdcf332f722

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6257b4a2fa98b39565946a5332c89b4b

SHA1
8ee212d6cf7e77184cc54aabbe6dc76177d4633d

SHA256
130b67e63beb558920dfaa0273aaa318b288e9d3b8a935a43e84a6e05d068769

SHA512
d683c1b9d911506f4ca74830214a6c6b265ec1cba1a381a96e5c830c097338f8484758ee9d1c2ce24b93263c049d4cadbee59e29038342a9bf7b451df33c35f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccaaf225b3c1e7cff0039c63ab85b048

SHA1
66e266cffa5e3ff7d74af7712be9fb1061fc67da

SHA256
a93a6c98a6cf16fc2a0ce51712f0a067b5e7663c2dbb318daa7a6a005dc8d4c3

SHA512
b1eff69dbff7753887f23b22b97a1f8d82f9851ccdc506d957b543cb1ae9de4da04299561fa0e1aba0f9bb6791ba9ace8ac14e2cf22454368ad4ae5eaa0209a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df27d49220154be9b03e249161071239

SHA1
fffa2e803d9d1f2740ce7dc2d5d34aec7ea98534

SHA256
9b0fb81ae82c4d46e9f8ea2634f2c52b5061e78017caf64dc0995a92420ca5b7

SHA512
650a432ba28a33732d42809de811e48d69daddff1d3508bca1c34d59cf204322d8e8696e50ea970f5850081b15ebfe3cdc693742744d6733d5586b95e24329a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
967447baf8469b083d21afef3067bb29

SHA1
d1111b52b4ee823b5d22a42543dabb9a2cd38382

SHA256
20a917b693effaae425d9b33bd07926f9ee61b4cb481f2f81f4740d602c06790

SHA512
3d9932a0f622bdcfda9e3d653341c7872a5fec9dfa227ab202cac935fd353f84148367bbca64f98f17d520a59d2052ead8c5a0a8b985853006a967091ee73d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE959.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA17.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit