980635e0588f521fb7d4a0c533b17921222afb9fe3ca28c9116e2cc1b3ba203e

Analysis

max time kernel
68s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77e2b8560ae7ddb8efaa255bec1027ad_JaffaCakes118.html
Size

53KB
MD5

77e2b8560ae7ddb8efaa255bec1027ad
SHA1

2a6fd7c14e45515e6483b063771a663cad9cba1f
SHA256

980635e0588f521fb7d4a0c533b17921222afb9fe3ca28c9116e2cc1b3ba203e
SHA512

993dfb00016b1072c47769d5b3e49e2794024e35625667c439179396c0f6745439f05f067a2b4d65bd1dd07a19d9ab65a360155f487734c894f7021f82030c34
SSDEEP

1536:CkgUiIakTqGivi+PyUlrunlYj63Nj+q5Vy0R0w2AzTICbbkoY/t9M/dNwIUTDmDn:CkgUiIakTqGivi+PyUlrunlYj63Nj+qZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428490749"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f652555ce2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000fee9cbf2c2e4ce7f25688cd29630dc7d9fba8b3148e09deda7d2853cb9eae8ec000000000e80000000020000200000008e00a4e60c845e247b04d4d2e919ca59b8247b74e4a97aaa5bc5af290cc9ad0820000000c5022a1bcb43d2e6fbd383adc29528be59effa92ed65ba9c31d20dedba6fdc5940000000f7c07c3ff179c9815b88ef4a0717e19e9d9f717d7682bdd0ff0304903b37b76308148f92366bbe13ce69417073ca2014053e466b26da84814daca5a7d8284c48	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7FAD7DD1-4E4F-11EF-AC6A-FE7389BE724D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000003b1ab1a7344a81aca539f78196aa0da824e937b42641c5ddc92b3e42bfcde3a000000000e80000000020000200000004c6b59a1cc53c22abad4ae2c56f1c84df18d02b1520cf74df398b804417f52b990000000542bd848e58e2f718d569a1bb62b8f8d5e7afce026b6b97f15183791c73316b6cc46566decb6a56210ed4fa0177e08fd3ed755890ce1bbb1e5f03ca064e091c882d84a44b7064be77a80b0804b692bae20057793cea17524fe1c1eaec406790cd57777344c91ccac4043f6b7b4a51a20389d5aed5a918c045a418f3d71c6e7dacb3bce56f299696e62ca70c2d463b00940000000db42d5f1a08482db4ddb5451a203a673135efb8d1eabfb8abd61de14a8a5e02003f1cd56c462d3a6c0845da0ee5f423872bb463275cb5254450c0608466c5476	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2860	1984	iexplore.exe	30
PID 1984 wrote to memory of 2860	1984	iexplore.exe	30
PID 1984 wrote to memory of 2860	1984	iexplore.exe	30
PID 1984 wrote to memory of 2860	1984	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77e2b8560ae7ddb8efaa255bec1027ad_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5ff6c56812445a8d1c6c0b98909a0cc

SHA1
652eac819d377728742089c0531c087b1a0a2d99

SHA256
917f1664f102a99126f5c42ecc6d38c5c8cc7a272a593ae1b4353bcdc4cc8fc4

SHA512
80f0797acd2923b4118a66f543b90c5bdb3edd8563fae9b08a943f2d084490fd08362eea125996c714c3ccabb475d3674e557bf1c98d3fa286f70f3038ec2bcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8037defb77e202faaf25056e575022de

SHA1
ad14febe148132b57868ec7b20b39b2f3ae78cda

SHA256
cbe4dc914116e3766507f33f545551ed19ca72f6b7627cf725d98b6cc93da4d4

SHA512
6a68b94d0fe5750fa2c5a9fda1050e23f91c346a0bf52fd157e06aebfc8414789b549b0c6c13cbdcde755f3f58d60ad95e8d938212abc5aefe44b05d7d7fd34e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4ff151bcde6c5dd66aabb3b187b6ddc

SHA1
3c038edb84d866f4a9f7176b8aaeedf11bbc1dc9

SHA256
97e52854a8d7f05d041b1eb7bc7395721fe94333a34a2f0ee64747067e7c50c7

SHA512
c1eb04ed84836c6d3427f73ab7bea6df31f372bf449b021d7a14f416d98b4b3f2b328876cfebcd27a5d064bcf95cdba1f9b5e961adc460a6bffdcf956206f3be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa55f97661c73c89002767dfb62295c0

SHA1
d318af0db5f5cbef480442d43d6793f8b3941b0d

SHA256
4e1e0e758847a0f03a59103c375a48e9616f419686ab2b98519a72fa2a83e10c

SHA512
176a6771d3026d827ab9c4c824d4af1c18582b1722a2fc29f2c867eca33011e8dca8db2cff77f5a9587fb5c85966c85022e12388ca73e86cf5445f456596e0ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c9324033965c0dbd32472305526d45c

SHA1
92cc4bfff567817234d3830a0b7fca653e999631

SHA256
0f19b8642eee4dc818cba07b65b5ceeccd81c9107934da512958ddd4b1c2d96b

SHA512
edef691370de7a4cff109da722e095b7b2ec0b57c2008130ea2a0407634c8faa46fc31503004e6e69628052d6895e9353d4be5b9f4e65e08db7df5e7b639eb7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2984b7e4739a005eb1d721f1d2b8d4a

SHA1
07ab8c2f05e95722b8b36e2adaed8e07f5a6d06a

SHA256
4c5bb2936b5b2124017bac75035878b9e0f4d81abc46953a66b9484ae4163c90

SHA512
8fca89d9b6bde9a6fc2583e740c1fa242920293c949c25cf09a23692fb127a1539964777795d3d81ebec352aaa0021da76c06d45bb4d11b364c0b90adaf904da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e37be08caa479e5dca12dc03d753678

SHA1
973d10e4852597bb3fba5aa99a345e60f77cd6e0

SHA256
8252f5f52dc7c82d8c345352c66a8a394f27528edd25e2c8f562c44bc718e4a7

SHA512
e5b621ca41124621b3b53e4ac6d0c948edc0714e56bb8e054dcdc8833eb90c46a63b16440ee64d13936257b7e901caea8fb76f3b35807c7e76472f2355ad16b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7244037190f3688a29df3bc860aef1e3

SHA1
8ef196051019fa91f450aa4f02d40b6c776ef728

SHA256
cbb5dc7b1aaf75b3610afad185da5feaf54405017f44b6791c6b50a719ccda82

SHA512
9506e50c3766b84d77d3b3809bac0e28bdfbde55c990720a825a9802ccddfeeb4bbafe7ab46b3f16d73794151122170fb6899e608255f512049796f1d685dae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cf243613190d152c9b0d926fd67a913

SHA1
29c8859d122d37fc301c55b5972956e5acf0dcbc

SHA256
b3606dd637fa62ce2beda9810071becc4650ec2a91219c8c7632eb7513636a5f

SHA512
d0c19d224323f4767e02365ab20b69ff8f7617670d773a7accd172d09ef1eb98e78b3ebb1c9c25b2f8fe79e62e36c48bb12656c01a93c82345f82b3438fe617d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd5ea964888ea0accce74c6cbdd03521

SHA1
c51d3a1d55545f4e4e0d4697eb8a7ef8697d9254

SHA256
da3e78214bc789a109798569e819c2e33027d9e071364102ab6cbec3f4906f3b

SHA512
0c91eb02dc64513883bb0f8ac02258ba267aa4c7951b97428f4cab68e7c4d0b4b26257c0ce1f28508472f6cebfc5bee9a775c100230cf7b7874b1a5d86cc04c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b7305a1750d8d0c753c80536a113060

SHA1
740001741887dd4a461e1496f13fa4b28d7f055f

SHA256
544cee9ae4423f3ef617e6a821fcc0dc2eddb5feed548da584b9349f3ed6f7f3

SHA512
345fc118b4cd770d18a738c53984607dd82faf9d505403f33c119071d1000e367983dbc0a83656fe910b2071e646913f6709af5c58e6598aec5a270c1a54b963

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baeab75d71bba63e52080031c9caffa6

SHA1
30d0c1e0871fb99f6a5aa0b6d32baa1c657b0d08

SHA256
33fa457c71ac4fff444ec0d6a9f1a5bd0eacbab5f65be83361ca4e6ceffc4312

SHA512
06f1a3b29af634bdb75b862a791d976d7c0ce0a35ceaee08308ddaf98452dde76e15c5581d74a199d68f04b979ee295bf162ed2d6080413693873e449888985d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
964ea1425815366483875a0dce5de72b

SHA1
1edf86ec05687f2f138156f3d0c9c35cedcd546b

SHA256
40d6a12e85485b8236fd8d0b417c3507ac57937b43d9602334a8e83045262179

SHA512
aef3183be88ecdaeba783fcbe65a6b91fff36a8ac38055ea5144f34dd636ce0c7302d5ce2025daaf9aa7cb2902ba51ec77d83294e536721feb2bada27db469d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d27c269bafff7855daba67cc4c37351c

SHA1
b483fe0d43ef0082adb83433c054e9eaafb22f88

SHA256
d4ef1ff414a0188b5d695ab08384837b1cceb38743321527b19aed3c127126c2

SHA512
20fd8c7ec67f22cadfd29e510e344443cd20a6c52afbb3476ed4ead3e86a0633a716fb4fec0676ae036c2c2778cb66639328ba11e9ab5baf061ff7964211ad17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96b5f214274855a7a36ad718bf5e7a8a

SHA1
eb0eea9bfd86316cc598cfa58df1cd74a4b772eb

SHA256
c4fd5b1543486a649a3f038a9a1074b5e9eb0c09a1edb670012cdc7801f0102e

SHA512
a3b049dc47d29844a69174fea4312b54e7fb0c38d29620f52397a4eddac5bf67421986994057e283891768b5e5510297b9c61ee846c715927a231fe8f7405279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff87ab062497ac66e920806c035f27fa

SHA1
8d74f527fb5266610cac16c35c8b1af944b2bbc5

SHA256
880551fc78e30359bb02a09a3e92f63371ee49b6d1f361830e6ccdfe25638077

SHA512
7d852a166f1ce091bf223983c04bf4ac0229d267675049d4d90a9a6d2f0b5e4c4c42e5211d474b903202536649f55afd0f6215fa536841e7d878a9ba47d7600c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GL24G53\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC140.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC1B0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit