938220a05ad96c21c0b4acb5e3a8bf608f09396c6153c88b7d0eb21ca8b95583

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2777fa784ad97843d96af3d131b0650_JaffaCakes118.html
Size

60KB
MD5

c2777fa784ad97843d96af3d131b0650
SHA1

2b2381594a67084ea0cbb1bd9f9c39deb73b98c8
SHA256

938220a05ad96c21c0b4acb5e3a8bf608f09396c6153c88b7d0eb21ca8b95583
SHA512

a3e336221489a3a02af14f92d6ab98eaae7a919fbc3ea9812e71a8001eb992771a5f20fe7c78b42e46e197b6c3b5ffda4677f2624244f66b7caa151c89010e18
SSDEEP

768:0uSwUZgkQykIdWkj5bpH1gB8vuBJOy7xEm9kNg/VQxFtukqYzsBBj2/b3pxIx3E/:0u58NVzz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430816143"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000978e85c5fe18a31db3b9af7977be8efb2a0cb523039408525c268e6e64934e5a000000000e800000000200002000000088db15cf650f06c07352cab9c8dfe9d5a6746b1163e0100621d462583937f429900000001030af3a789de1d5c3e189ec3ba777038979f187946e8f9ca3533cdc4cc281f584b9ed64af31d61749e46c3cbe6a7e3a816303bfdc6592fb4f001894f01447d9d61889e918d94bc20031ad855f464787db5c1edf7a8029608085b8d6c2a19f444ba9d8d1ee461af9cda0b3adaa6ce01dd03479d18f808cb7933471328a079f36f7734420ac61e19b67802db4e516c1c440000000c837a5ac1cdead34760d008bbf543b54036e0f090ee729373052891debfc718ca25e773f71e057472c02cab4ca2ff22ad8a7ee07cbbc248fa34d3cbe3e9e7273	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B95518A1-6375-11EF-9E5F-7A7F57CBBBB1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000002ed54c44660988c4fb37276cfbf9c9574f41da7ddb5d457e9dcc815be3363020000000000e800000000200002000000007b067f85f5f317671aab19f755a99aad1b3e23af0aeb2a2a0a3b54b673921972000000010dff6dcebfa4139afcb5b63543c2bc62624b262f346953c851b6ee579e78e59400000005f8ebd741649f85e80b224fe28151a252f9fd2411c950d6b23a23c213afb4a683c3d8729be330f9b4669fd58a3c1bdf7ac163ed85c7871a2c7273d6211191ed4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c6c78d82f7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1792	iexplore.exe
1792	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2764	1792	iexplore.exe	30
PID 1792 wrote to memory of 2764	1792	iexplore.exe	30
PID 1792 wrote to memory of 2764	1792	iexplore.exe	30
PID 1792 wrote to memory of 2764	1792	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c2777fa784ad97843d96af3d131b0650_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0648b98fa3235900608da320ab55bfa4

SHA1
16c976779b0552fe40f79319e72d68a99964e969

SHA256
bf919bf01dac427c6564d187d9af6a87e44c0ca27c1b9f9fa4c769295b43bbf6

SHA512
daa0daec9b27bba642a516744547fc506baf5ceecf6d4980eda06303140e68d9be3c48783cf1c0e2662af323904d98cd1dac9290e8ebfb0787ddaa53d7843aab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9fb043d5e331a3fc035bfaad803f107

SHA1
2b58bac777f6c8a3ca7623d315dabcf5883f636d

SHA256
cfe3b1fac691e18858bd73fca65a6478b9a608e4665b128c5316f41ec0446bda

SHA512
43dba4432a906ed46b33db0491e411da6b1e155c781a681481e43517755048b92efb0114de0cccd0634b9385071794d00c51a4426e4405a5158421fd845296c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14206ba4ff4dab393c5bc24fdaf1b912

SHA1
ac11e43f6c6c75df760c41524f68ac20e8e683cf

SHA256
d49fba70c6f629d74dd8bc438b8f88c8299258186f899b283c650d8c9007aac5

SHA512
3336651c44f83e6de9780af47779b12818d64efbefb104aa63626ce3d7b26f4bf478d49670a2b6c6e0816c93228a5b23950fba66ca801b766434384436a85f18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e86835cfbf2296cb10b9fd2400929a3

SHA1
0ad06d04defbd2ea604a6b3115c97d8b08f26fdb

SHA256
d29fd9ce6ea1947339672631b88e8039b7268b319c80038b914ca6ee3ef65b96

SHA512
1d3615d248bd60ca50d98f6676b63cabd2687006df057ba029886417419f72ddf1cbe850c62329f4794f8f45e5f4bb9bbe8108a935375e37b8660f3e26c0c50c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c4c6b43c2989eded60c86ec4ede6166

SHA1
4c32244e76c118b014666a3c17a75cad642482d1

SHA256
cb275c74e071544d07a49e864b795c3663297c6602ae24d47fc6538d188d7c71

SHA512
40538ca1157f70be1f3dc7542dec168223b6a468d505dc4413f0d291cd9c7052b9bc016b9a028615d903cf11d8a0ce0f627e208250067008bf644773850abe08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
378b17f88019ec454e4b868740743d84

SHA1
482afff8f2f6c459d0efa6af50351f8eb2ccd326

SHA256
a0f07e80501e73a525f0ed0875ec76b5aada6dc7642e9958e4713695f2bdc305

SHA512
63b74bf2ab75b847513847137184096429ff10d2072b84f4b8df4c546a73a75f93142fe248f9c432758909eec796afcbaf486fcbbae071dfb97303840e731434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c9b3ff5024abbc76d50d5daa2ee7bdc

SHA1
7d3434e8b115b0ec60dd366df27309fb08f71d53

SHA256
0bdf860655762078cbc7248e91611d05be6269df03439abc57a1163cf4087590

SHA512
68126a4c978b13e72cd0ca4f6cd36340b93ebb22efcb24f16449dc853ee0790bd4b5d76acd96760f88e7fcb1caf7042cb9fcdd5eac1bdb20b6b5ca99015c1045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fe638bbb0d22f004995288817c9bb93

SHA1
5e3f044a89a32849427c506ebd3215a317bd8e8d

SHA256
82ae70d4aa6e620dabb47de13d43d5cef44831ccaa73addc0e3d661e24c44de3

SHA512
ee294868284dfa1d2b5da3dce461565eb1f5e16057719dd57fd93a8b4f8c3feae38f60d2007051187786026aba0aa7b9ed007b1ca7d80e17d120a882cfd76b36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f61876794e9c091a992b95462addd2b

SHA1
004e8b7265cc0cb07a16ff27666c2c75ff5a8719

SHA256
5c9411858ee328baa9390db84ef578bc1aaa62514abfdb1ceb83e3a6ed67dbb7

SHA512
47755eb7ba3d719611ff85e9437ce0449f1ea49e6e3177396c63cc1d24c6d8c4e805c1228072fceea8dfa4a221a101db841b0cac628954bb4572c46629f7d1db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
780c5ee5cd963ecfb3e436c2765b28ed

SHA1
b005d6179a4b9b46c37efc5ae5cc3e19428a48a8

SHA256
ac6a7d45ff087ef6e4eb3297cc7212e00bbfb8939d01cdbb58f1a861a182a1c4

SHA512
e034a512695b3ca83d58a28bd8ea9e3c81329db4636d5de1e465e350e1c05e0fc671e94a59539fb973c0af982a4c1f2750150c72725e7a5f3a9612e65d1a450c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c81249ec7dd7bba786428704b48c196e

SHA1
d246e0d0ab07356b0a2a38c0e15547c036fffbe1

SHA256
49ebe49478e6dc003eea84260331390b7958bc0d851c582b05415e80bfedc80d

SHA512
abd7a498ab3345386226a21ab16a4f6e5916c3a85a02345f8141ab4ee8b0e782a438089b625368e097a346f0fea97480f3c3950b0b403690d9e4610caffa4fbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faee9c5cd89e0a36f9e6763e80296cd2

SHA1
32dbb86f959e68547841d1fdea8dad78aa8e57d3

SHA256
eb35b02f07a75ba77661fb29855706342f7b8b825a1f69541f4322fad6a4c08f

SHA512
c2bc25dc6df5ecfc9101918b49bc7f7572719c5c63af8b745618928556d7eb1b807eb0fc03cc35145b6aaacf0d65a996a35a70d11f6a10b82a01f51f654d1938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd4f653c9d122e698c3de33a50870d52

SHA1
ce707054a580fdf5fc280a0e9e8b6b1d4e0e88a7

SHA256
b32838665604c15c2ec98c4fc4662d185856efba236564c407d5a1bc30b4ad31

SHA512
96386f4a062ecd84fe4dd582a99d1f910e4b8039a1f096b1ecd6bcb0ed11a0c2139b1f502f37d0bde1716ba91e287368298298644b37b257f513b7599bbc1ad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65e5af5a65ec5ec9a5be4b1100ff926a

SHA1
f1410df706d9c8867cff2d3f5c45e21c44473e4d

SHA256
30436c0ddb8157551efd7135b6067b77b08627c11861e900a510ca7b2f2fc4f5

SHA512
4740f7063e53cea83ca1e8e0fbb304d63045f3781f98a77203e2140e2bbd7384c3831fc293c46ffe1a01e6535373b269339dcea4b171637f02ae2c9720350d24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5ee2c08df7f224cf61fe181d35de6a8

SHA1
c8d09019220f89b46ebafd3debf99f389ffb1e03

SHA256
b3ec5ef4fb9c858432f31382bdf9d5086a0797703e1b632d5e264c34082659c1

SHA512
60c475824928029ef04a9fcf4c85a50181e45c23f27ebd45c722f035861854e09e7ec5718de436d3a8ac9bed80dcd855ea38f89681681e25349df90a7197532e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcdd65c8666791183ab30e9a7a4a9eeb

SHA1
eee007321246091b8b295f4b2675809b68ccff29

SHA256
faf4e637714a65fe70e5b598cc0eb76e48f7cc06d6d3a6dd735cc663d3a05731

SHA512
36f503e249acdc41e066db8e0da0446c474ad7cd3fef9869b5b7343d2b841f92d8f3b322ccd73b05aab873d23f84588855f76141dabaf105c247c344fa89b71e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
443b64cec114d1b2c324d7fd53622aca

SHA1
415942b5c82a98770e85ac4f622ff44d17d89efc

SHA256
a7b71b5b038b5ada35bd16f39ff39cd37d569c9d3b16f4796d47481b162becdd

SHA512
1bf648faad5e91a8859994fbf383877d1f69c405a32ad89398ad136909b56c8f4736f46f128808db547626ea9abdf96252aab1dd77e210e8a4ace8ab0a131220

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab55DF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5641.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit