b449366b6078e965ed0958746977422c4726dad0506fc65c64fcac8704b75cc3

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dac8b03f35ec9b13e5c155b0d22addaa_JaffaCakes118.html
Size

52KB
MD5

dac8b03f35ec9b13e5c155b0d22addaa
SHA1

c7df4818cab73e76ac5cec756527c60634aa1e34
SHA256

b449366b6078e965ed0958746977422c4726dad0506fc65c64fcac8704b75cc3
SHA512

c1892d1354491331ffe814c7d291a9fb0d226767d5237cb64c6286f649b12890fb64495e70f2edb250bb8d58e3e581845e5b2f1ea04b333a86e107f583d0fff3
SSDEEP

1536:8r8lN80XZukWLz1UQp9/y2syE1F97z7JAAlrmJkObqiy1F1k:blS6ZuHz1UQpVy2syIF97nJAArmJkObr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000f96e988f356ced45849bfe883c62eb0ac9913b7414dc7b728046d9523b6b8f08000000000e8000000002000020000000a9d75cf834a50d4ee5b6cff9a9e121fef425d3408c551654a7d6c5a5b64fe13290000000c7714f058a4cd794058da13bcf8b982a1d8755ad88eebc21f3555ca5f53888860c497cd3ecb08f3640f013ada24b05897f42920ac44f18277e26348daab2cb534fdd9bd0b47dbb5488c57f137d5f191aff757ca93e3dd308d7ad59776f1c0ef53851a11bf8ed4a54d02cb2dadcf69a9448029541113781c7a04759a9777160eb0f50fa3dbdf79ef07e00452af2eab922400000007abe7b8202f83821b2682ba376365b9a170cb240bb4c87089b1ee1f85ad80f19585207104dc3f430538799e8894b6ca8dbfb109d5dee51598285951b292c7144	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432234860"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40cdb0c46904db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE82A441-705C-11EF-AA6E-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000008745c80c4f97adb9270d20a74b0e6e4b667edf927ab843b1ca991df0f0b67ea4000000000e8000000002000020000000d15a1a00a9ee83632c2207729b95b3d9a644dfa93f3232133c9976360db333d620000000f1ae29dd9e5ea7c6410a69862ac3ccbc1d659a5b9da3721227a14819ff39ac8540000000c57e494a0ebdd0edc7ebeff8fab54a3abc4140b836d3c84748a36345cdf8c5625821aa259f55648c63202e7217ee91493996149a58127559a345bcaa900916ef	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2388	2160	iexplore.exe	31
PID 2160 wrote to memory of 2388	2160	iexplore.exe	31
PID 2160 wrote to memory of 2388	2160	iexplore.exe	31
PID 2160 wrote to memory of 2388	2160	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dac8b03f35ec9b13e5c155b0d22addaa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3850971421c8c29633ebd167729dd79d

SHA1
d0cde33d7ff5040afb9d12015b5b095f85694867

SHA256
4e4403502b4974d0897834120b4ab7aceed7abb733a4b3c21a4b8db1b5d683cf

SHA512
64f7e9d9fd03896cff913630ca640ea07526c4734ee1ebafe2c237430c6adf4c54e4dfd64850a4b31ec0e8a1e8e5e63de082077af7bfafeb072e5284bae9483b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
118db76d3bdc0361ef284bcbc36d69a9

SHA1
3cef65ec6a3be63273343887f963a91f428aa1fd

SHA256
a1066317f8688320c8be618ef5e58e49c719b2fcb3a33a76a8b2e2894ca8e52a

SHA512
0883a4fa59fee2ed9ce086957c76c47f99fccd0429c30358d01375f5b43590b15cdd673840a15bf1c951109de696ecb08772e5624d2cf15175b0ed5173cea945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e661d709e75aa3791f64003a69854535

SHA1
609a375495533bbb587caa0054bb224855ddfe96

SHA256
ed8e723b1613960bf2b8b811cdf618ed008c13cc8cbd41276edb812f598d5651

SHA512
2bfb7d71e6f94d2daec22ef9a52b0fb978c3b036de22c7ad62765276cd6bc66c8d1018dfe1f9525479be6164ddfa9b6d5afe0307700b22699c25fccb1e734fed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63162180c760bda0244546560456cf19

SHA1
f4fe536c408cd76d6f19b3a4e167a01a8260fedf

SHA256
e922fc306232d8e2ce14f2543748c977eca046400395b8daa3897680da310e97

SHA512
403178f1d81330f447108f8c9e50044dc0d2cf6bbf0badd2f8c888a69632181b2c8df467ef5505c21341693085725cb6369d872aaa17de2e851c08ea0f704dcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56101dab35fefddb482f19f410736e88

SHA1
904f84e5f562e2b4241ba98b7dcbba7ab1e88f2b

SHA256
eb780b5cadabcd0dee19e3511e1173b818043a353bbdaf3a113fffb84ad33524

SHA512
b73cbee9a16eb236ec662d391043581257f43dfb31f17013682699c3e92798fedbe925e0f0b79896f842c01e256d655db6c8f577a256d9c81791a313097b986f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51ee239d0dab904f87a6bb3455269d5f

SHA1
7c5529eb8a91cb0546bdf2a3c6605ad95f0bfe4c

SHA256
0fe2a1805a1b6133736f72cf2a2edd048b78ab981b54041cd14e621ffe0ac422

SHA512
c22a8143f23aaf0bb2f2cdda62d3757362b5b45dfc646433524c473b9261cb8956b999acf2ce2df7c71e23e3cf7cc3451f66730d72b22c3ec19713678b91360e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d5e09ac0d1a1a63169bbb3afad1dd0d

SHA1
5af56e9c87bae12303df8228b0df4a008c7ded35

SHA256
cc9e32bd5465d3795071b339bc874df3b64e8517926fddb7b34b1d26a33eea8a

SHA512
07c31d03bbb17cc4b4dc2cdb422c0d2819f512f7546baef89e82589a6603cc7f88ab5b320349cbfd4b3f6cb1616ff4fa94ff81fe39f27a6aa2f61769b643187b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac13b1610b0cfc0bac3fa47a27cf66fc

SHA1
6d3ca2f72854131f137ceae4a9b85dbd4e0de13e

SHA256
126ae0783c480e79cb0716e7431a67dab93f68cc08689d3bf9e46a267f81b5ef

SHA512
c7ac6916bf03e17a6c04de8f826e1338a49375f8195e426ee3f04418ecad8e5c480f7b20b493c649de78bd80fa02e2256f1e8d1ebb00b97838a1bbcf5520e018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59100c055f6f1c00fcad427c4a42d1ac

SHA1
906fd5ccdffc8f83e5bb41c6cdaeaed3566fa121

SHA256
39009423dd4d2cef3762fc7c00866967baf7cfb246214e7bfdf2e6d96daef2dd

SHA512
f9ac6ac0a0ee440f424d4449412bf1260fba91ddfec2948387487d4eab958955bae2a3a1a9169d25c3f9f299aa1ebfce5b460ad1d1cf26f8813a4247ff05b4fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8a03d4362bdcbf505ef08d418b5afef

SHA1
41bd3f9259dd27fdb1d18ed0df5e4b47a9576ce0

SHA256
71671dcdec2d3fa9713b98d75550cb57fe858cdf730127065d530f5febcabc43

SHA512
2e5b0365dfeea906295f363f7db314cb0823d74b437ffd4b7bbbf16cf00890a0c1caa7fe6c66e7544b76db217e1e16be777a38d7411c584b79acd6da0b665e07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
664a86f22eca9a7aeb12c85fcadec372

SHA1
1b7f9169934c86c503136766b553e09ee9a0fc69

SHA256
347cce2f85416a4de93cddac136285603e0be4cffefec65754227f5ec2f021a9

SHA512
0d1d029581d2c8a2d3e332ed91db0912a51516ad95e69128725708ea10bf865ce8b33be352c0dbe974ee0357dcd3a15884684b8a84b0ec29968b1a7fbec3e43e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f53db5a813357f05026a45ea85a291a

SHA1
7738ff1e7d6c9fc6c31e28b795ba5b3766810af2

SHA256
0c4482e8e879a82e62efebd42be3e385b973c042aeb2adf29391bc6600b46b06

SHA512
ca9886cb046471639a28f6e9860084a237b32280ab96e49c7658a6569ba6e6accddee467f385ed35119b19e686c537f41775827bda326e563a0a1b4c8d334dc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7e8bbaf26911fefeca5c2caf9f704a9

SHA1
1e038af2c826e6577d03b523d59d9c99912c7a33

SHA256
f34bf8a160e80904333e141fe4b25dd1554b8acb2a79aeac7bd9338811c3b227

SHA512
972bd4ae94e422488760131dc3a356d6261befe0fdb0a2cee1a9c589c6e0e94f25907e625ff261ceb25da4f2952f9085b1af75f99fff6e8f7665e0e26d86f010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f76c69ba22aaa59e41c7a004afc47954

SHA1
9322fdf880fcce28ccfee9bd676869420cb34b4d

SHA256
0d41ac80b7656d7213dc2e7e45d4b5e25059585a5aab30f55fe2ac0447d5857e

SHA512
3c12b8f8c4362948bbaf5eca6ff6fcfa5bfb8a0b1a1fc79f7a853ad3411046c189a1ef6cb3be661c8758662bb757ce766007cddd70ab1ad42d74682b7f88e373

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc76400d29847b3af244bd6cad0f029f

SHA1
68e53a979df18850dc1b73bc7b169cbf7a134786

SHA256
bd9b334c203c7069219e3fa02fb4cdd3ab6f768dc6b15696eab5bb0bb80e709c

SHA512
45a490b66b83eb419418e72e352e588007e0453f3d64de4ee1cc6bd64979fe6e334049430e660ab4115222d603ac0507f6991ec97fcc7c5f1be1666458bbf4fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dd9b812e08a689bb963990e983709cc

SHA1
8e958e3b3b00af966b9979bf8f30ff66224257fb

SHA256
29e9187cd2468cf6f32a925f51f14674b7ed91fde11c8ca98f168597e35f525a

SHA512
9828a9871890401a0458de64884f3907654c2cb40a8b89709a58fac0a558de633611033558df437a6f0e944c8b1f3808482e7c11081990f14c2364dc77d0984c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
687a33b5502842908d4ae765f264b699

SHA1
253f1c369e9f8851ea687a7b30e8dc097dd52f57

SHA256
8f34b99ce25c2d8a4efa91fc5860711468a1e363bdb2504a568668b2ee9da803

SHA512
e0e0370aed5a107a7edd51a18776cbaa8a051932e39b7f0a440b349dd80e8d02c97f3b700d0354f11a6a1fa74892e3c581a382f7e6e8848d367351e066e9db8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEDAC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF241.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit