728d30b3458ec77d97c6476bf3b24adce93fb46636a8a4a7b33897d9976d3d8e

Analysis

max time kernel
137s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db0c255422afc3da6297e26e034e2d24_JaffaCakes118.html
Size

3KB
MD5

db0c255422afc3da6297e26e034e2d24
SHA1

20ff0721793b4abbc3f0b56f920c6c3ea676ce2f
SHA256

728d30b3458ec77d97c6476bf3b24adce93fb46636a8a4a7b33897d9976d3d8e
SHA512

2456b5e05629a26e64c50038fac8ee7794a49b5373843367d38739f2f5e735c4819b4c7787b14453530a32c0c77d5171e9e57c09f2abeb8aa12db17d767f3ea6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000086d7820ddd1c14b0385a34e684485ba2c5d397a923071868c2f384c3455a588a000000000e800000000200002000000017e1502255b6957f5666126280fcb2898f420e1ba865a55d851186786ac432c0200000009adcc6feebf96b45d2cc628a67553caccdec21d9d6615fe19ec29e2f400113d440000000dc11c6b4fed4cc7a298351a4b36812e0a663e51bb23168643e760c10e0f755ed78bc369b794768e095eaeff8002c92b9819f6ad16ea129442799e462ddda74d4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000093f0bd6c0b68a6696fafb2700b9f85c534d2bfaa262c4aceaba75a3458d0139d000000000e80000000020000200000001ec2b5e8629dd389d573715f35a0fda3a7526fd3fcd3a85cec2e2626bba3209e900000000bf1f3d48dd7da6b8dfa98367d4f1c262048fe6e9551e65c427e633de1e8766e834d1ff11dbec3720648fddfa3faff69f9d8947d62c752b52f31d9b1834e20cf16dc0e2f8087f3235523ffb004e14e8414f7a13f4b219f2da4f26cb052c39489080f45b27ddeee430bb46ab10c00342e04813d4310ae8b0ff2c28c25003689da6d6d600d5c48669050d7d1b610e1deda40000000c382a397a774d4661ddc812a840aef85b9907e923d3b90d8d0c0f69bfd2d74eded6fb6690d47f8bb701d3b98bf08b472b237fcb5dec884a756bb33cb30a6108f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54E335F1-7072-11EF-943D-F245C6AC432F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2007482b7f04db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432244053"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2712	iexplore.exe
2712	iexplore.exe
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2948	2712	iexplore.exe	30
PID 2712 wrote to memory of 2948	2712	iexplore.exe	30
PID 2712 wrote to memory of 2948	2712	iexplore.exe	30
PID 2712 wrote to memory of 2948	2712	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db0c255422afc3da6297e26e034e2d24_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49d33d198f6feabee460da187e6dcde9

SHA1
d2157d674f333f8d6c2f11787a359bd7ae12cd73

SHA256
3707f06e2bd52b07dd56f43af90e957e1fe4722b5b5cd0311cd18b49942d745b

SHA512
ae954d5cd95d8c72a8adeee24dd881704a21add51dcffca87f83421b09478f0de16647b46c32b25faeb5b8205f361d06864654a3ec90f95f8614d80e29aba906

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0836e8594a9e12ccdd574576468a7970

SHA1
9023eae6a2770d038310900fd825f41ef244578d

SHA256
3fbefe60a1b7e0b706b509aba40567a7c8f4d1be98f86dc36c2dd36fc0dd74a1

SHA512
713e14f27dbe667ab33993b33e653ba4ed68a79c563e11251a521ce175880dc85062929a9dcae41663f95ba6409d1a4c013600d81e37d4b29dac033b99afebdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4051606dbe1d51851ac9da532958d408

SHA1
9dd593c6e45c530145855373370d0a6ed6b57dda

SHA256
50d304678dbaff522d7e074985ba65257f6083fec0fb5c87ba039b9d994240c5

SHA512
181fcb93d7bafa7b0323c1c2a44facb47c4f7d83035dfbcf17350b180521183369d9dc9afe04c057e5c7dd325f60aaa446fbeb65f7b6118ebae2729a46cd7bca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c180efe3a7d1089b466c105b1069b3f

SHA1
a76537141da1dee459327dd4bbb3d9152d211355

SHA256
b127848581c412631f6f61dfd84129fa00f2aec6d302b82383f175c59159906d

SHA512
1138fcc7533bdb00e225556b6f490ac0e27e88f39654f8068e314e42b39bc34f0e4377d2ab4c7ce24e1a0e963b1cb935dd631478b4911afc4efbeebe28864d66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff44d9e333586f59a9a743c17ffc67fd

SHA1
3ffcd2d2d473c1ff1f86e1a4d2d88459d0c095d7

SHA256
360065d768e5bf9d8d7bbc4ade0e2ccfa73f8d942b7dfe43dfef1af13e2fa856

SHA512
3c48b3d3815eace8f0adea6e50c488318aaf952c5fc2168fe9fdeb153a68bf43bbf80c02aa232b242f20e0ef7bc82fede7f86d1ac4add4e56b98e403376025cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f4d5dacc8cedbe56ae2347cbe45ec55

SHA1
deb17b6640387dc2d7435a32231d1c0c2e3f38c9

SHA256
16ac1c346fc583cf2ccf09287f07811ed434c200dbd2a1e06d6e90d70333b6b6

SHA512
515757dc11e8777221d7121f5dd815562b197b451c4e4b99ae626ffe465c399ff92c0ee381ca38b5dc773b154c6a96acebac0d1be26ae28addecc04038275490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b0a4f6e6d32080dc55c86b18f9258ec

SHA1
fd9f1468aad16aa9f4712f636e8d5fd12e3c01f3

SHA256
efd102ad3a3c91f381af76789f442246d1e86d0a19be7d51fe4e2e00ca0c0e77

SHA512
d64d71a1bbfa4f70604e2d56a1a2e9f87fed3023acdf6d305a654f72b2f69c8c12bdb04ed3b04d4faa8789e4e9342590593681adf3cefce05f1448f0aa129949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
810eba85b592802f2be9b0faa0bd2da5

SHA1
38319ac35bfc6bab3f5705c29cabf7ee4110e6ef

SHA256
a4451f75185ba69bcc7d72dfc2d03bddad5c26b0935c3eca56d06bfc8a393aea

SHA512
7ff678d1cb2ede9bf03dac7437b25bb55398770c2b90f55eea27640d502e61a6ceced5d6e46117f2c9769ec5ffc4b1f0eac41c47810e0f1276f8f7255b768327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f052ebddffdcb1b0bc4f6ef032a8fdcc

SHA1
1e065b0d0e4e4361ba5c9d16eec6052730ff5e55

SHA256
b14ba05052eddae3647f0c2ccd352eb9e0ea96a947947a3d11de67f7ac0a2efb

SHA512
9f9f51889fd027e52ce92d7fc3e605959dd97b665ccb40c8c4ef9641750d5856abb427e6b0fa6291b407364d8be5fdbb66190cc6f1d1f6941fc8f38b02962570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfcc5c9f94234c6ddd2d2164e7ad389e

SHA1
7714ad64e9ea3dc8cdb6e6ae8d50600ff0d7e5d9

SHA256
75e84673efd976e60d166b082bdcce2db25637cb95108c23329878bc54c19392

SHA512
ad0533288f684868f21f7e28e7f36a66daeefb2e2e265734c8bf31698af283c62b1a9dd103f7784dd1925f0e967a7a91866b145e209a8d27103f3876aae4ca71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8ebe6ea59a92246e51d8909670834e9

SHA1
8037927c9cf7945a96e0e49c6677270fe37d4400

SHA256
100fc59f55ce96f8fa9467ad2624e7b1256dc285d5f6d9ee173b4eb2b0a38991

SHA512
7f425ff542c1fdfebf1e527a4281f2fad37d4ff6a1c3b0bb358f96c30ec82fa78f1d719407321d5e9e514bdba15aa0da38657e82ead3db9d6470d2b2deadd8be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f2ee09acbdd135bfa5db27d2a277b57

SHA1
229082208e6c67b1ab5a02bfc630af1ca37bd834

SHA256
a88fa981a48bff9aa74637c66083fe36b5d68e9e6c392cc2b56beacd0dd0b646

SHA512
5896ee7ce1b0225b5831091659d4da927ec4c89aee3b8d67cccae42be3f1567c070511328b8943fc0b9cd26f67853af478764442f3f8768e2a0c6ace26694735

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d9ec468efa126daee41d9d5e8b718ab

SHA1
e949351f519ed4039dab50f3b3f168784dd63c36

SHA256
1999c277505a33ba1d61c2d8987559e92d486f7a17edf1355a59b7e559c51a82

SHA512
fa376b06ff86a075f9680991821108f89bdb63b47e780b703dc13e3d5ce23e6025be6f5b4bdeec1c6ddfdba3d534e86c5f4d56c98fa00a442d131683a3038ebf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbbc0e2a6ab20d7e128d508a808f272c

SHA1
5b417719433b424c5e2e407c5e2de020122f9977

SHA256
f70a012984ff9a8a56b0da75c9fd9ec234e35ebc8e9b36b05cc220228914b613

SHA512
33a8646b2558c966049aac8a59bda85bd2533bf0f87d4f461483394c27fdb9b19817e3cae88f610fe3f3268c12dfee5ab6d18e53de515266ef88fe4386e6d3f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99dd7b27afa1aa0cdb095f01c09cf888

SHA1
4e88a8dc7b220d13cb1eb1393d43f6c39ffaec63

SHA256
05eb1c5f73a43d60c682b777a245ab9d495367ab6f9a16de6ac7166012358fc5

SHA512
d77a74047085499bc8aef37f74077b2e2b8465399fc7fba084ad9f775630c39b7fa6f6812d3be7a92b50d9054200a4b70678727a988e533920035a2efac9a780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bad72b420e007f766d5407c386a12cc0

SHA1
defe383c462be445f55f966d099731c4e1cdc49d

SHA256
4cb3ea72d85cc48ded5f7db5bba7f2b718775ab3df1943da9a6d0016f667d103

SHA512
68036d9741e35527582091613abdeddd58d80d2db2dad9fe4a0fc965121975dab0b9f7cd02f6c5816f625a4ef5330074fcef9e3bc8ac3ddff510aeebc1f953fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c9a647194dee8dbfbf1b7b77d38d90a

SHA1
49ee3243cc75372eb52c8b237d4f9b237bbe4f3e

SHA256
d49226b6649d458988a71060525796a66804d77a5e3f1de4df77dd9c71f57204

SHA512
fd4ff27a407031bc83036798a298f055a5611c139f11d3c54d808a29d88824f2af3b7af674a2e48449e1b17f4103340a0e024b17c7dbe0aeeae62ce098e7c340

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6BC1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6F1E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit