2e4ddd224926dd578523804894b710d4e7a3733e95bd78a998c6886f86a2789c

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b513dbcfad9cfb96733639dd9a5465cf_JaffaCakes118.html
Size

1KB
MD5

b513dbcfad9cfb96733639dd9a5465cf
SHA1

4e7392085cb12821421da984e6913357ab695234
SHA256

2e4ddd224926dd578523804894b710d4e7a3733e95bd78a998c6886f86a2789c
SHA512

3e7dbecfbf04869d934d2a67abdbabf539d5a1380dd4de62e13872981819d0d6462f30fac487eac05456aac5d500e4e4c5752e4168bd6c28e71f636202b3d1b8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000008c91be4168e69a48772ef4777e5a5a1b3fd290e384cdc4da327f6b02c4fa35ae000000000e80000000020000200000003a6e99db0665ff0e9841b45ad0de3426903f814a8db750f9794296ef8af17bb620000000e03cad4ce4b2890a3e7d12589085d214f39060dd47a308f63728f5fd9d1ef5fd40000000d0ca31999d48f5d58e14520c6cb2001ed9babb7e590af6027a5e35775e0fc03895e8b6f7ccea6126691921a40539878b3a6e1c542dd65ac72cf52d95e9fa8da3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000d53f72e680d90cd07b29e1f366e01838036fa4316efa8d32bdfcce46c6f0f390000000000e80000000020000200000005b91f310bef1c74b57bfa858613a475504a3bec552f14dcd080762447de0f25590000000a6f9687a7f3cae26c5387e6aa5057b7e9811adac978cad74e222d191f32cc0c191df8f994e7eacc74a861b506fbc2755bcc602bf699a08a66726c05ff6ed6bc3260b38de6975b145fade22f2dca236bcebfe9f63fc3acffb0e668256cc5a0740784b9d9bc56d7697b4edce7912cc98fc318ba7a1adde12af3bb4d99c23d64865b5f4f486ac52d112116cb7154a8d4454400000003d08366e87b3246a1c9258681f28f3b90adba89145fd10fc023ce899e0efe0e9c4ab1fca45060a1b76b6e03ed15554f8bfb6429324a2ed4c1bfb9b2902b032cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b6ed920ff4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430436907"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC226311-6002-11EF-B5D6-4625F4E6DDF6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2392	2296	iexplore.exe	28
PID 2296 wrote to memory of 2392	2296	iexplore.exe	28
PID 2296 wrote to memory of 2392	2296	iexplore.exe	28
PID 2296 wrote to memory of 2392	2296	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b513dbcfad9cfb96733639dd9a5465cf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b8fdaa17f4946c5a6d63b9d7624f12b

SHA1
aa46ee0305305c9a6c256f57ed989d9a1bc14456

SHA256
07c4d0cae94b2e5f7e273b33860b543ee6abb92f57ed2236d9cf53fa522d5e5d

SHA512
a5d49424978ffb76bf597923a0f5bf80ec6e0727d06345442153892832d094519c474982a076425d5d3659b9e511034ec49eeac8360dc5f16020c6dd4bd65862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94a8c56f857bfa8bef6b93dddc3cd3d6

SHA1
2d36c26e819fc7e678d06039ac706d0b51b7f55f

SHA256
f5a635b03c9910ccee7e34ef910ba38e3cf4a376e0c7c9f7c909e3acb10ae421

SHA512
67b7f8949cb6b75c35b5fd9d9412a61fc78209c3cbe01a88dbd2ea494862a8c496b058bd411909a778438c2006219ce7209040cf27ea3805a19c62653e43db6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8025832eae720fda4526a9f0eded5145

SHA1
37cab5a309b9c3d93996a2d7c718a173ff049e73

SHA256
0a0fd85c3273777ede86c0fa53ec271d7e612da11d1dc9e22d06fb68a7ae8232

SHA512
b8842fdcf27259032d75c421d95addb8d172a7bcf1dd9f5032b4726b76dd75c3a2a6993d41aff9a76ca77ab44c5a802abc057679f59ea75be876c87888d6d273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02db236152bebefe237eeb14aef151c1

SHA1
ac3749048c8894f76e691c7853c69db152751ba3

SHA256
1b69938aeb32de822c32b32a56dac367ed2479006427e3dbe0035f4425f1ec83

SHA512
29c80c726d08968049c22855556d1b0f3a7edc1d1c8761577b47a1801413b936663aeffb45fdb35798bd0238523ea8405225613dd4220eaebb1cb17d865ec880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7454cf3c50c831b04c00fe7d5b3e6daa

SHA1
78cc2c0b7d44161e85cba5ee2116b5b163798e2b

SHA256
4a51f0fbb70a86d83ec45acd79b50cf00ef1ccfb416364405b186853ffacafe6

SHA512
fb0d24db1931f5efd7f4f8d3c21979d70074b1ce6da02a038f4346fcfbe650369ebc72f829dc32a8667b489dd5562a01e31431b85b64f83e936280ae0b8f8cac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42c1b1010e84d89e7e1ddffbc45baadb

SHA1
8c5dacbc09f605e7bb2560344c96fb3a9170c6a4

SHA256
2cda8b63a03c69685d6191dc95d70f6b4ae07a26a9111ba8deff2311328121aa

SHA512
e33f880dcee4c405de57f8b90c6f5c0424d0ec04fba79deb03f61895893014342484f60d3de7cfb14e005641451abafeb29c320596804e62e1511e85adedafe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c81eff2786be9130acdd8c25dbeacc98

SHA1
2eb6c94d12ca152e9041e7402ba84db537ae436e

SHA256
b351b3e9ce5c44829b0c59cbbf64a6f3d39081ba45bb9eb330991ca660902bd0

SHA512
d349be525d2529519373f8862105d9ba2b2c9324b707d98a75c4ff9c20342a7b1d4113e5f7a2f12ee5e1cc118ac955b344aff3515a65de633eb25d3b688faf4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f110f6c9c2985eec8ecf9a2b49bc8f7f

SHA1
f5705a24bd35c44a430f6f3cabe2d6e32af59a1b

SHA256
87e43af234a081f637e08b9ce4c7580d065e0059fa71e3b81df2b66e586690c9

SHA512
3bef939c99124cf246b8f95e95b7f887361cff4519587971645fb14191eeda10ea13b5c5f304263549b8c189355a90f883973c4dee5ae5d251631debbaefb7dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45bbeacc4d6a7690f14426660cba1d21

SHA1
68153cf0af99c8f6d3074c0db36e7ce53b4b8382

SHA256
771d57bee58dbdf17d12b96f877561a70613f8f010aaee89bf28eac47b0e5cf4

SHA512
f129b7cf0daf20d29ecf2cb49249553d5f903b8bf93292bf63acaaaf43ca505bc7d78408722225d8dffce6fdecc52360e13870ff6b6280fe5c2467fff52a4f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d6ae6d546f502fdb77bda2a8636c6ae

SHA1
667d5387190bc863394506140fa048d2b56929cf

SHA256
811a335b7a3ac1d45d0ab02fd655d8e3f3ad01220d2e324bf17160e63ca59e26

SHA512
430082f81f880d79814f6bfaf8a6951050213757f8a5d8d556439d119ecd17834e075487ecc69e05a0e8a5646a9ab7aa43c5c78b3e1710723a3a7890b79cd6f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
477c872e6bf04e879aecf1e87a47fe4f

SHA1
4ea6d41117d7682502d948fc1f3b2fb392b40cd8

SHA256
5e01f07856fda3dfddbb5a9e0a669010701cc966d82d512333c2c9227e5fb7f2

SHA512
0e31b0df35995d0cb3d98f059f25f33c33436f864de067bb17e8f6ca0a5e829ac03504628276abafcd288f8d06edb2670b3b9a7910ea4e31ab503f1e3dff6859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31196200845ebb2c09800f219c35672a

SHA1
608a746280e904de47f7335d52956e5faf983409

SHA256
a2d780f1290c7d304bc42647c2c0c10b653a8fc1812a7a3a76d4c4c5eac049eb

SHA512
451237663253cf193bb54c56c79c7327279bcb64abf99cd8247507d2ae9c8352882f8badd00df3d8344142cdb32db2a7ef4f31127311dce04d897c46793ecd22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e3581425a33416aacafdcea73a26a6f

SHA1
6286b4d6fee367d2fd6766837808cab4f3623720

SHA256
0608a9c245a0dbf24983b4e982a9468ed9c6422456c2f1b325bde8b4baf8023a

SHA512
0875506b35591f4f9a852981b6e7cfa4a3beafb151659bc0ec1aad788c34c718ccc7dbb7966aee084a47d78b7d6afbc7b2530886e74f060c64c797d2649af68d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ea7f5ee7faf4fad366cd361b26c6e82

SHA1
94dad4d6dcb38835251437370c3826939c73d087

SHA256
817997cf0e35b533107413096ebc91c4dbf7d5d63f8f87d06fd06b839de1b07e

SHA512
493cb3f01019b06f655ee733fa2ed048ab289d1986b65dcc29e28bb326c0fbdef1dbcaeac8f2b292f5fe2e2e1a626192c54d82bba8f9f81977bc99af909682b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a46cceb02d0840fbaf45f06c3fe89ff1

SHA1
6e5ba84c984ee5426f2cdcfb08fa6a802e45a3b0

SHA256
79bdba1ca6700e575f53be02a07316a5c7aaa6a877431b5c30a345753da76079

SHA512
03419788c3e83f0f2243eade6f2b3d3062209e5dcc0ac0f741bb83470d18513e8eab9bffda27aec8c183de1c0361226405064e38a0f0ea06cde805721418684c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22b0ad55007ebce554e08df7181fd527

SHA1
7a889073b2dc2ce17114376256284ef7e1598208

SHA256
6f15989faffc3490d16d3b331a1d438ad2c5542fc18f7e9839a19afae9c05b4a

SHA512
3f2aa6670c830f897f60e52a841ec9bbf69c5a0e55398384954d651a0ddd17eab8d7ee275a4784ba00a0dc35aa141d8d59673f88b15491197cfa1dec36662a61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55b12f0c5f79a70890f96842c2a8e901

SHA1
865ad80c3dbb99f564652612a101f0b9136db716

SHA256
4faf936e2a6bf4e480b4eef808eec703e9703f0b7f948690d012678c31cac9eb

SHA512
2568bb5e3ba78c0d370cd5ad855e2f01d9ca845d1a41616bc1a62c9576b3adb8a399941513085f782ac8856d3a7576569d95d6efcaffdc4342705978614b9e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB619.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB6C7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit