d149777e17dee7c106feb0b50dd15d2356c77ad8f0b32ee80179a4d70d031ee8

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

690f9193590d18caabbaa72e57427b75_JaffaCakes118.html
Size

22KB
MD5

690f9193590d18caabbaa72e57427b75
SHA1

e28554f210ee5205ccf2d42af8367def2177d6d4
SHA256

d149777e17dee7c106feb0b50dd15d2356c77ad8f0b32ee80179a4d70d031ee8
SHA512

b3e7a21ce0a6d308b7d3120cdaef46d96d69d93739cd34d0d3779683259b33da478a14ad364c7caa9f0a73d8f2948ea4dcbff6fd7e7629516b1c33eb4b5b0796
SSDEEP

192:3kuU3QCUHZ0xDKJvFD3uMWN4Rio4LDe18auCaOvuAP5AylX+fyChQ0h4S6Zq:3kuUlUHC6PWqUoQLauiiyW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4A68591-493C-11EF-A19A-DA9ECB958399} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000003dfe7b3a2dc2ec8b10023b12f8a06eb78907b4ad3595e74e220c5959fda560f000000000e80000000020000200000008c4ea962b1509fbcfde1833b75d446817512ca8a0acd36a8150a76fc86a5bffb2000000057af4abf46dc0d34f0df332afd17f58d62c5fa5a2d1b1225aa10a7dad71b345d40000000a0c14324bbaba7995ad25d3e5a029cd4c7bb7ead4366b021551956658eae89a1c25cbd2eef2e0e3de5a2407d9b494d3e290c8ae46f9160cf782cf526c1ca2947	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427933029"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f168c949ddda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000528f83e4c1a150f3b58a6ea0ecd4fb3e769aab0d4cc3af83adfad2f4da30776d000000000e8000000002000020000000aabcf81ec70a9a4b245030f891e3231d6faaa8ed8e292fea5692caf48c8b3c2b9000000072f1bfc2d9e237c999d8c1417c40a19f6560bb1fdf3004f217d012e770bdcfc9cc8b58f267b5277e2750c545675c5c2d14c9780bb2807ba7abf7aa6653ed4c218b80f2e19a8204c8990f0aca30fd92209ea7c84ff9818f5446fe27ec176e27d3dadc9648c7e2ce1ff1a17594f26cf2e3ac94e2c78de58fe5477730e42ef36345e2885f5814695e236c7b8e090ed2286940000000752f24e04b362f561e130b796e8e211cb24b484f7bc7e9af6730f2f0a5788e2b67b0e9e4654228eaa6f3cb81353e8cc0cf5eb0c29150f0eb10c598bbdb83e3d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1572	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1572	iexplore.exe
1572	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2376	1572	iexplore.exe	30
PID 1572 wrote to memory of 2376	1572	iexplore.exe	30
PID 1572 wrote to memory of 2376	1572	iexplore.exe	30
PID 1572 wrote to memory of 2376	1572	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\690f9193590d18caabbaa72e57427b75_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1572 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26a890b41b80baad3c4703194780f25e

SHA1
aea3e39403ed53e741455a09643ccb15abc3d309

SHA256
1e6a9f61bc329404a39bbfb9a441fc251ac15d60463203f6e50a3858975b334e

SHA512
acd0f50ddc734be088ab90cdfaec32c0cfd3f452345a29225f5c8b4495a68282e13ca4d3384a60b072605a5f0a27ba0577b09f297c11927657f9991ba051e693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e933afead6c474e80b2bd6e951d50e88

SHA1
6731236ca717e9ec5ff5fa1367449a415b16e406

SHA256
8c70efaedde0697ca50987cd384c37129fa41a78e4c588b50804785b81649a3b

SHA512
6cac7008217e8d6e10c1fd6c30dd66f6d6bd281eb46ca0837718780e56f5d1def9366105a8c9f651f651ffbb6bec718450e86c9a45ad412e90f04d6fcdbfe0b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b129e91631577708025d05026af30a90

SHA1
9ee32a98096f475d9d95916563bf2e5596a29131

SHA256
a154617a77711495ee77572aa794328834c352f94b7305629a4b35b0009bab66

SHA512
3976e7fcbd57844556ccbde130cd6a898e70363641354c7a70c1501b3370da5a58e22e0845a688e89827a4759c4ff2bd252566dc28a5ff695fa003ebeec6e9d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b36b1e76eb38c0cac4b6a0c8c08a9c1b

SHA1
5399425caa8fb15498ba09764f97959656572f3c

SHA256
920bfa5faa4a299b68d019cb4036acc738c7167ce218785cd84dc10609faa2dd

SHA512
433c854795b1c795a6f3f1010c180dbf27b9a7e466115c5227a5f6929f07f556df86ec818195d12eab921bde6380396d83c4ea147cc0d890ca3017b94652912c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ef2001d60b46d7e954c73684faa5de7

SHA1
6d2cdc37caec31447c28f09de47852d3f27143c8

SHA256
7f126f4af917355e5391cbfaa70d291f44180036e00198499ced2a1c865fb6ba

SHA512
dd3e3313be0cb939e3952a1156dea522873b9d1906c9d9acaaaa6ffa08bb935f71450fb803c6b75eb7b1e63c12b9213832c59a251ee9c8ad111767c27be15946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93c17464db5b71ce277951077b66f5b1

SHA1
a702bc6f7175ffce933d069af6f2a1f269ed0f11

SHA256
ad149494127e480bb9afdeccbcd087b94ab666d5681ff6d4c14d9730b7405e2b

SHA512
e265341c86fbfb8e3a2ca2c8bfeca3dffb96f43eb09a00e355e6a4f27bc35256eaa2dce8f4c6ffc81ee12dbc826a9a6eda4e771d859a7fd49df8459291677af0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0a38b0bd26428870b25145049e6cdb6

SHA1
dabd2d5d4e5337a6ded39c2233222e65bba85765

SHA256
8853fdf126f715a3599e90c6920c2ad0e551431a6649082c7a3f8b922cee429e

SHA512
af48b6fb3a18ad6e1e9617e783b3b8b747a5340297cc441a8d37386d153e5f40c1e90903f339cb880c1c077840471296b2f3b445ee170a776dfc425af789e815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
335a5c81cd1f4c08ed01b0101069b848

SHA1
b221566d07ff4acd178dbca7bb201ee04de56022

SHA256
12833ccca7b2977f3c9c9243f4bed769670c31b60b886883349fbbd968e9a915

SHA512
631f8f46154492f25a733a9aad9e4c926e82ac9fe79987226d9827686e21ed77572a72593af1e531260b5c6d7c6dd2cb83c571c9c77dba0b284f9551b434b862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d2455bc68dff324bca6e11c38b04c3f

SHA1
6741202c61e1dca639eeeee1af9b4d36b818293d

SHA256
a8fc77c62f93fc6f259213869f854b5a023e7ad29774d00224bdb23c5bab1a8e

SHA512
29abc7f74fa8abbcd619a3fe2464a7f27b1457a9eae391d93804e2073b566f037b9ba4768ae75aa6572141f768291fe0fe032a601d873777f7433d1f93cbacac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff5247a2021e36a895e6f086febde8a3

SHA1
51dea34c880c98263ad5dc38bed9e038c82d0bcf

SHA256
38b3a53c92f4f674fa0a47b254840fbee43377b1b1c0b667fb074f5b2430dbfe

SHA512
ec7e62a8aafdd7ccc7accc3bf9f15d1dc16b2e086b28534d760ee8aa7a283b7d74d7d19e495466b1451eed65301252dff8443610fd664d6db34d96002f4801ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd9292d86bac74df024d97e88b831f52

SHA1
072ef246655dd0e33e2ee58a3a7c53d9b2f8b131

SHA256
b7f315c96723085ef6519f61125f6e334318517bc06aee3048943c6096d85cb1

SHA512
f8da1ca4c480875388fe0f51700923d9ef4e82702c414c4706bdb9298c66f16d459d656839784255d436ae16f7d7beff7a3170542ca77edae76b3714fb2a76cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15a099f0689c187a8fca08ee43f2e99e

SHA1
8e338779988c3fb4b8c57374868bd4fabca70a48

SHA256
6f27a96d2be29b49b5373c642481d1c6ce0f8f3db20fcfd21c3b67580476ed92

SHA512
557c4e2c7b136315401f5bdac6ab752c21057c5711e643130c4de5c8ca3bbda217441558570eddadd1f0565b704bf25a61cd23c7e2d7aad478e3c35de10f8013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3f65cd688524bfcb8312cd5a14e0e4d

SHA1
860098ba17472bdbed0b2bfda8835e9807068022

SHA256
07820e1de44468065bd837e23c35738849ec922802249de03338b0d0da92b3f5

SHA512
611dbfa986f1d7f1927265721a95b47b560f57c4cf427a9975709510467940a6e9e47b1852cff287404aa08cdba8c325028db76736cc383cce23ef3cba9e44ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fca2ae509b032253c8cf4d5d63b01ab0

SHA1
8a52d98bc25a4a571103771e7a8aa71e1cbb0201

SHA256
92e61a9f21a90904c0a510d12bcec15e14f653bd4ce4909c8cb70d77466ec2c7

SHA512
806874dbc638e2843117c46e784354648e52e6d4960d2abfe5f41d1d3e086cca814df0202fac88875eeda54eeacc8b4e6ca7ad6e284c129d071e8a269b79c7e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b730586c2fb346b158f2dee6861d2d8

SHA1
c32f12ef9378e2e0c70159320eac4e6f8a2bb5d6

SHA256
638d5b59317736a8ed28f30afb66f86ad8480f2f5f331a5395c4f7dd8b0a4b4f

SHA512
a950f7e5fde7b92d6c37445392ae2675d5f50f9a34598ba574edb79ba3a653eca69b64fd18a752eaaee572b542798e3f4c3a559cd9cde859eda4a8691ea92131

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd02f345f1d86be35418ae450504811d

SHA1
eda1869861164093da6d65b8d28148c50208bb94

SHA256
3366e1ac99cfa6a5852368e1db24b82d8c961018ad87ffd3da3a5fa807f7e0c9

SHA512
67328fda4e9340459d669ef29af9406d03e4be798355dae7b74b3075f99149b53d2c2408153b8dda55ffc141917238204cf19e5ffd83930836c292a6a80d3e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a29fee730ebaf59c1646d42890218380

SHA1
42bf8ead0e3d558cceb07d7d9a10b712dcdd03dd

SHA256
92982033dcbc38ef0a4dc9597868ca2a17314cc49a23b09f9763216f1dcf5b61

SHA512
2897f9b8da647eea1d1b4043854f3aef40cf0c5bf4764dcff01fc71566dda075c958eeaee94ddb2342771455d84ba7f80e4564c25634c8172482481480d8ac1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC84F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC8C1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit