c199edfb6b28e853f3a8d729714560d0756890a5e7906e2131d3c0652af2c538

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

715b36c01fd992dbb4e13aae7e7e60f8_JaffaCakes118.html
Size

7KB
MD5

715b36c01fd992dbb4e13aae7e7e60f8
SHA1

dc5f0febfbe5c8d85c504e791fa302525111fea6
SHA256

c199edfb6b28e853f3a8d729714560d0756890a5e7906e2131d3c0652af2c538
SHA512

8355ab490c4ac8246eb708ef5e342f7a0a11785a8b05ae9940433357f218cbd4541c5fde44706487cfa4fb6b09c50c9000dfd2a8b9bb10c141e84f9603378259
SSDEEP

96:uzVs+ux7h1LLY1k9o84d12ef7CSTUNzfqK9xJVycEZ7ru7f:csz7h1AYS/2Gb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000000fba817f3fd9e66207e71615411f30242c52b220cc1945e5feb0c0abc900fc43000000000e8000000002000020000000b060f8c75331ba6f07a3b3a72b59545467409385004fa8275105421002d821c420000000eaad697e665a6b29a05ee554a8667670a2e124c779faf1568525638b65f1c52940000000f2e15aa27a0634817dfd78d9476bf98b24e10536e107f4c4b208a0024072069d9f08f8487f901cd9ffafc7d6bcaff0a21a98363866c24ddc952afc0cc9508683	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607a69f7dbdeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428105765"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2208DA91-4ACF-11EF-A69A-C2666C5B6023} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000707c0a5159690685538d2be0ff7d669917dbe281492c84576d2323d4310c53b2000000000e8000000002000020000000c66677b66dc519ec5e75eb21a98e492f0cd0e57e5735f5722bb24d39ab21f00990000000962a9ae656b9ddd250de36d43503776aad0ae863720abb9cd8bf12997a8cea8d67d2079ce6ee4fa8e8bc1e2f4628fc72b613adefd33cd641e65f7fbf58dd4619135afae01a393ec10a912f85a89a28c3c650e9d1570deb91c00cf6b79b8bf5cd7361b09557616173c9a485b712a13346de148df74896dce9baa4c86dc2bcdf571335c27f932014fac0bac828ab40099f400000004a161bb39b5173afb03a215cd349584732f0968a6bdac91bd01678513bbbc55305efc17a0a2eb32ab331d566841e35f90edbd48f9cbcca5604d567b1b7180f8d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2112	2084	iexplore.exe	30
PID 2084 wrote to memory of 2112	2084	iexplore.exe	30
PID 2084 wrote to memory of 2112	2084	iexplore.exe	30
PID 2084 wrote to memory of 2112	2084	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\715b36c01fd992dbb4e13aae7e7e60f8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b510b2a0c464249bc76384f0d88a1af4

SHA1
3b809e755bb242fd6266368e3ad5ab8f4992b5e6

SHA256
7d8b7451db1c99aaa5836f52a7753654fb203dfd827d0707c64274ac75ee564f

SHA512
6017806e2841f8c51afd26f4f0230024a5a451b95fbe3d962ca9432759bad59a20505bdb79eaa7947e9c4ddd6731b907ede82d550ba417a8be89966bc7beb604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dc2f0cc7d00f6967e5b3113d02e6166

SHA1
750c1223479fe073171b35222b4bbe611f428cef

SHA256
0973c20db4badd21798036fbf05e6ff635069b6c9c137e90d27d22bbd539fc0a

SHA512
71ac22f68ba69b126d6b8254780bfcf0430f3a7befb40df833642590cef8f8920ad19ad8474a8c78845974b828709cda9ad4d20521df2f3904683c3560421069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4e41577c3c7a5f61f6471e4da68805c

SHA1
5d63858bab84d7d32928d7bd70926d2903801d75

SHA256
a0d1fa9493033e7c370de86a84fcb60ce35aec54e116a93ab1f73f7da68e47ad

SHA512
f2947e1b2642f44cced3c2114272a52e5f72899854a647c89b4384c78f0d9fbc3799315b54600960806585b115d59fb2adb2e0ce2ec3040e8fa409f5ae7a04d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a8fb31575ec57e145cb08ed44ae4ac5

SHA1
38379dd87dad7098bd4e1b4b086dfb39e7f1748b

SHA256
5382356ba8e19a2e4615613b68809bf4d6716ea01c3147ec957684177454d79c

SHA512
a2f5a30f9e25227e955cab36e52ad18dfd9b83d4cc9a759aca121e42a12cda4c8c62f16f61472d5046f56667f2c5d26e04eb52bccb29ce757fe9c60d4924e868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a8833af8d229885be6f122a10b08a39

SHA1
fbe2f523e979ef9160ff02ab01529d8cebd5d7b0

SHA256
48a0c874e36ac46f5a0fbaa5d8b6f154d727b050122376b64bc78c484b3349bf

SHA512
836d86cba13f22fd97d498d920550b0995563d531eebbcccf6ba76b51c2ac124b558c5427a768dc09569c8d687f7c1084fa2f8ce431e96c3aaf6ccbaf9603e08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdb324a5fe5bd6d0816cdedb4c1305cc

SHA1
73905d9bf2e281c65e44d0b6791e69a15b7a99bd

SHA256
6d01ccbbad9413b7727489b12abb991259cedb73a9d4515c7e7d08c6de9ad885

SHA512
cc6bc1a34a9a3a35cc1c4244f5baa26169c0cf0f8a36f43c2da749622b8e100da972149cd1b0a372841e32a763d81fc7255e7b38bf15f88f7667d1bb243fa66c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53af68dfc0ed3cc37204259d6a256547

SHA1
a64f5277a9e62584e447e51137e54c66795060ea

SHA256
4647dd14bd83df5a371f4916800417e9e43a25473076dbc0e5a68a001c394056

SHA512
eb6ba7b36d3bacdf1f446bec798f96abb7e7a473d9f886d1f39a8e77504a13d40c5c7851f132c02460e0c4f7c513976989ae671cb9e5808b08406075089a85e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5b87b5b30bfaabdd269e9cc75732e0b

SHA1
77d4a3c548e446b88dd1508300b8c89d4962bacd

SHA256
04db57352a2813094439661e9f1c3b9edf310a4b3ea5b8f3cf1841f5b86a0a35

SHA512
2fbb1c2c4bfb6b68ded3ebbaad9709c96958ca4ce2cf8fb5a3d84e2875905d0c8808e39cde79197524c696c42840a9b9975e57ddf20cfdb400d7da4eea385e66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f23555feaf2a99524f0ef18e47117bfd

SHA1
7da0ca233cf50b4e7f7328a94cec24eff9d1fa64

SHA256
ab9e2c0d704d37c779edc646dc22da1e4d540dcdf7a47573988ec3fe480447ec

SHA512
6890e256e000f276a1c918ce0906235f84f2be11a447b7536127d3e46864fda694ea07de576ba8f2ab51120989a5ae97fdd3024e6c778dc1c1d165970acaf4b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8566cbe54d978421df776568b09ddb30

SHA1
32765a2774991c1d5c283167978d39c123be7e53

SHA256
1bab1546d94465c820dbb368a961995fe5f2225d9cb0e22de0a844f05cfcf574

SHA512
fbce8bb3d700e84b02b4bdfc3aa9faf896cfbbe4222c76390525ab023b8112a78f20006eea2191515674823c5ccd982aa6540776296fa0cbde711046a4340ee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9754028f2336864dd756aa324ebc336a

SHA1
19891c8c9a89b6924ea2dd554fec269aad5d43d7

SHA256
80e23ea6eae9d4e79edafb56f3431b61b3add8484593e4f9fdf197828e94c54e

SHA512
0a5e78009d228c776d44c93560ff633ef9426824d6a1e93f815317e5a20fb695735ece819796024b3593e07793d5a6a876166e18d0259cfa75a06f1062da06cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b43b2bae27932d9aa2fb99ace42e50f

SHA1
b5f65355e7ecc6e58fe070ac10763d8aec205e47

SHA256
9e5452a03f469b6b8d7754760369a59c3f2c26558f56e846288df4534eedfd63

SHA512
6817f191bb131b8f5f11974dd20c534439141631328ff50e896fa4e1acdc807dada4fcb1bea811c8850eaf7e9290c2bd31c7703bbd63f786c64568e89f2a3ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad252f96e869aebf2d5ee9f6bc245675

SHA1
6ac6ef135358ab2576827e9422b923bc0dd1cb5c

SHA256
4928111408953e289d2fd8b80d534d41126f3fe1c7f13192f69dea5f498b20dc

SHA512
344aeca688c61768aa423732247bcb70ae64494fe4a73661ca8b1901b1047888251e8a5bf3f754675518fe45d3804d871cc418dbc9e1d598bbd2125683cc8400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30a7e9c9fb7f37b87f3f5f2d9d156702

SHA1
c9c28c926bfa21066f24109604c0698c83348b3b

SHA256
278263cac99d1cae68e66df60aa1155698030c9c7e7117c1825d47b77399c2a2

SHA512
b3cd03662a6d3d11e958aa6ff4d9eb6be170df81f7cf8d8670174b5f2ba66c681287456a33b2b52578fa7d10cb0faf1aee30e9613a262ef58fa8b91048eb689e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcd19299032d1bfffe4e7718cd29514c

SHA1
9865c32fb78b2337c1a5a12bff442e9307800aec

SHA256
cfcd427b6458ca2268835a64f6ec9cca81488eba4e03b4af3b082bd8ed35980a

SHA512
29e456bdc25053c9d413fbc1ff72e309220dfa826f64480de923bd0ba380d5085a446c0b93f4686dccc19358abf35683cb326494e91db92ee8aedf889be0d363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe9586635ec401fdd0bbb555105a413b

SHA1
d4ee427972e604e23bbd5c235d0536c214cad57e

SHA256
4c1b8f48118687a8f263bf8e420ecdd58e45966696197ce48296d1aec2b3f509

SHA512
427ac89a95e4dda69d63450c36af8d163e3ddedbc7a18cb4eeff7de3da11515610784fa9ce3dd3ca274154aae4d5760bd80a10ff4bc69e22376d694d0c55eb09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06303552e9b1c8f4935f96ccb941dba2

SHA1
4d8f878134a8f90a114cc075a3718faab7a8eb0a

SHA256
c06c50d4d3024f823aa7442842700891252a40f1a2f389c1cc021bb704e1f84d

SHA512
636dac9a68878a7d4bc393d3ef1d26702f4ef2cfebe4e7412938be1a9c3d26e22ab46ba6660c2133e7f43087aaec26efc4f8778b0038d50d3a3d1f2620230caa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9DC8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E77.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit