2a480a5d06d915492cb0874c2b3ec95284c0796cfe0188a75dedb9413a8e30e6

Analysis

max time kernel
135s
max time network
132s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dee5cf3b456eefd8a3cee1a4b7286d4_JaffaCakes118.html
Size

18KB
MD5

8dee5cf3b456eefd8a3cee1a4b7286d4
SHA1

0bfb48c58790714c6ebe518de2daea124e85a20a
SHA256

2a480a5d06d915492cb0874c2b3ec95284c0796cfe0188a75dedb9413a8e30e6
SHA512

f1eea60ce1d35ecfb49c2eac1d45aa90030c98385f9575f8bc221a21e2deed9ceda3021300aeeaa0e14fa641cda06ac95b5a61abb1d85d3f478fd6a3ee443580
SSDEEP

384:UvIHJaJoKJqFsOPxugqlJJsOqN5qLrOLohEnynkjYi7K:UkkT4WOPxYXiOqNk3uYie

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000005873188407888453cd746b658d1ec859b1629d2d8e16e09315779658c0d9e807000000000e800000000200002000000059b2685b85a9c20d971c2f9a781a5bbc051aeb4ee9b246eba37a3316bb51ae6620000000f0e74987d0750d74d83d630545282fc4844013099c0c274c887ff17d0322db7640000000d648c6506c1a7d96a99892bbce885c7d35521454ae57840e23264c78cddd2c85b65851191abdff11e7eff43530eae3c9a05fb1329a115c4dc4c9c6e1fa01c969	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45E27571-5880-11EF-BA79-7699BFC84B14} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429611215"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ade3268decda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000000af482f3369f46edaf7d7fe9dd9fa7252dea89cc63864767b6488fee29dc0a88000000000e80000000020000200000004da2682c519cfbce8495455115a13819acb1c0efd63854598b0b78246738213290000000eae4924f800a6ce937fc85caf5275563b59d07ec1eed973cca7ac605a912b508e51c4014f0b7cf5d34ffc91fe26dfdb46bc061358671ebdcd3974a70f7b703dae1e3171dd2c3cdf86086dcaa6d2541c83dc98cedaea0192889a5aa83a51557c7f39fed6b982eeaac26a6dd9715421f362cefc35407398c96c52d8a98c7fb9ce6c32b72791702e00edb853868233eb4fd4000000099b4601634551b0d92f960ae5d238ed2e32d4d0a606c9f8c75b4e9d9841720b64e89c6230401ea707ad8ea4bc4f5cfef10cb9b0ea940fb0156615239e8a493da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1316	iexplore.exe
1316	iexplore.exe
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2952	1316	iexplore.exe	31
PID 1316 wrote to memory of 2952	1316	iexplore.exe	31
PID 1316 wrote to memory of 2952	1316	iexplore.exe	31
PID 1316 wrote to memory of 2952	1316	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8dee5cf3b456eefd8a3cee1a4b7286d4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1316 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
416257eee7eb22dd52c96b5de83fecf6

SHA1
629ab1656291a46cbdb2efa3c298ae6d1b4cbf93

SHA256
251846d572c2169cc396e09dc837f184cc5b2aa33df03a852be7d62cdb6c7c2d

SHA512
13ae3644c2cba442d3620ec0b45475c772e648b805481df89fd7fb13731bd9ada9b7fffbace56c3079f8775877e0a349792c156b3ea06654e473a342e55cf0bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9a161d35e5dc9e186a129c320b98790a

SHA1
d52cead016147572ddf2201f82a681c4ccd1093b

SHA256
d1ef3aa32daf189ba916d9df1bee82d6058e379175677eb7fd17b02e765fa308

SHA512
cf64387ff871289eac1688ad8dbd68dcb3f2c85f8db66e2d2dbadb95519226d9281dae891006416aec94d48106c6e4f215702788565d7cf396d553f1cebd9e88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1d5dc26c8334a4b8a117fca5738f5207

SHA1
1d4aafef1291f8f7a34e6d5bb3dea5c6cc6ece5b

SHA256
525d29c6bb565adf12e67005ec36f96b6355c1da169201c4e15311273a91454e

SHA512
dffa77eed7942804b8e8316f440c99149c7b28ea4b3c2798f0be1a056faac0a6549aee006952cbfe6db068e8f27ca333159ff855e3570fc71898be2b3761e7f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6217b2961f729821fc4f64012887cb28

SHA1
e53985a3fca02b2254f7596a7683f2b9032f6849

SHA256
204a14059cd4aebe5479d46f54808fd9baa9520a995d8c375899a4bb78503d39

SHA512
c064d9445eb932011f7d35cb7610182abe8238ee450e13ff6a14837a69f6b8ea763e9cbbbf055c12fca8d64e18247488f87b7b7b8242628d63ce96f16526081e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c3b8423b858e8146249008382c637c81

SHA1
c1a77bf579570192411d7d43261878be5b2c2b16

SHA256
994b417ba7ca5cac0114ad4b83eacf123a57f1b24749425224751a83a5546a5f

SHA512
3c6b406fa82dbefc5ff979ca0524aaf29ba51869cb34e8fd602dce77abb31360a0dc6a7dbef6932e3a9ad789ee8bed8bfb81179091826e9a891da31e01ddfb48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a0e3755f19516ccfcf826904799b3133

SHA1
95586c9bce0f135ad498acf8883d20843b26f6c7

SHA256
cc5b8587c4a00aa5278849e63dc159df16215caf5bab814c3f66a762995e41a3

SHA512
b09a083d513d84d7611cfd95db9f518110521417e4d65d7e6decc39aacc58980bd624a605c6868e98f643d1b8027368d7242079b093592a387c96758d87d21d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
de04604517770df3d64823d939270e84

SHA1
9c1816f029d6c34571683a7389462662c4f6b2fc

SHA256
2b429d460b45a67cbe116843f8ff18b343da45aa606f9fe8d8f0d501066600a7

SHA512
4ce227bc7762bcfdb4fc8604bebbd6950ff488b6a0dc0a3ca8ecc54e200d24b3cf5b49a65cf2bc86d81b8890be87e7791a1d370a57e14e19efd88a7e464a3f06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
afa00ba496470e4b0dae3290b5776ebe

SHA1
ee87d68c5eed391ac7ad5f23df6630d89986089b

SHA256
573abe74da8f349939eb35f651abb243d3a28b98f503f13e88999dd72d497559

SHA512
f0bfee06d107b2ed03fe4b6e6a2942ee549c72c3b661b1ce5f61774e40014b2ef2281355f68624a87e66824b357deec53a8abf801c563b79f18913c729805f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b6c1f7d3923fa30347d84a43c45639f5

SHA1
b81213c155e73841968916471939b5bfcc6b8dd3

SHA256
c9676afcc0b67f09a7ea9d28e1faf75c70e8a0d0aedc1e14117b0dc288f03ae3

SHA512
631e39ad400c42b2fb3f12a1eeea63283d0ab38212e7fab0c3fca5dbb65ba40ae5277ad0954f1907a3f508f0fab7c1cc486d6601daf0f0aa357e6412a3d16207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d0c2e384da1920a6f660e3fc1dd44b17

SHA1
37ea60012216d2c7ac7e26dcc4bafcbc4406a410

SHA256
212ba17b8ffe7fb679e6ce3feb2e2eb51561b420d506375e70bd9025ee0e1435

SHA512
ad6b2f6aed19e569edb75e13650be6184719c014aee3aed4dca0bf4563264575d0655f555715ebe52dda34eeff8649f05f6a658da4f2e175ac6b5214829fec2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fb8ab05eac93eb6a6e3756175ebfdfc5

SHA1
2133e9bea13b1dc3e8bd60b282295f6be9e4354d

SHA256
a160fe84a0e48522e78cb94aa4168b5506c192c6b829be7d898e00330e364d7a

SHA512
c5ffed88bd5e3f66a6cef7f1591da81d49b435e276eb947f475ee4dafb090d49229a48433fa243cb3d08ca22dfced21179e008a1857ae41fc59cbebe409c6f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3a3b5f08dde9d8270d912b2f83c60243

SHA1
72e00d3cb4305bc1625c5671d81b845da39c761d

SHA256
25f49dc4694ce0ac6d617914f0a3676faf4193e146ed41d3bc05e049bd947200

SHA512
e072c54cdad73148aadc3d984afa545c4265be1e2fb5d5c44151a3560682d8dbbcfe0cd00e6b74305c58c0817c5712794d6974253de24140cf694598c255d99c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
77e6a4f4cd34d1b935308f72b4a6a0c8

SHA1
4692229aef9c4bfe999e1e75b0647f5284997fe1

SHA256
d1c0749e6a5b716dca6bce99324c3d5b81b2e486953dc80d6de5ec941dbeb074

SHA512
2674c57d3600d9c8e499a9db10355679d4f4d8ae21cb902a933bbe4bf9afcf5b74d23a3b2e3f6c656d3acf221fd608f4525fe7f95bb5a7076bd6acb105860ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
162356d8ebec844e6ffebf06a3cec3a2

SHA1
0a91880edd4afd8a1861b94d703f3885ff5db900

SHA256
366f5be7b518bd77900c241ce3a18750a83dc9f36693cd002990bdf2034db27f

SHA512
addae1aa8948b5e7e10f97553d7e70651d6f96a10f061fa98689cd954d2c92f3f41348b7cc455a68717611b457284b7b4e1f9ffe4232991235f69ecd78d2fcd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7979e1fb35adcfdccf64d261dbe6f04d

SHA1
3193010957c01e23af338baa16b1a945e2290556

SHA256
bd1f43d819fbc69318a87c27f37f3a689040666d4704ec00a3ff84528ad759ba

SHA512
73e89e888b61d93e136c9916a1471008a47507f5e3565e36a929479fd64a43b6ee83b93196e3a72ae917fb23be5bb0f218ee5d9f1db90f159d641dc12be5fe14

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF595.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF684.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit