46c39d04c4da1e2d50b71200a7d0fefccc788deb558be139cf7de901e4c72873

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 15:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

93afab5df0e548768731f5c9b261f8da_JaffaCakes118.html
Size

53KB
MD5

93afab5df0e548768731f5c9b261f8da
SHA1

4e1bcf8da5ffbcd0d218e34354cc7e387b810e2a
SHA256

46c39d04c4da1e2d50b71200a7d0fefccc788deb558be139cf7de901e4c72873
SHA512

3b9caabbc87fcf213a860e838621156aed01c1d0d3f6a0d74834d89b5337a92a52b4d7d2923f80de5261b8db84eca3186212036de10227db8dbd54bc2028e42d
SSDEEP

1536:CkgUiIakTqGivi+PyUCrunlYl63Nj+q5VyvR0w2AzTICbbqoq/t9M/dNwIUTDmDh:CkgUiIakTqGivi+PyUCrunlYl63Nj+qm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e74b6296edda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000ec9dced003e8ee5a899c168c77a29f0a88f12f2c907207777bfba42114b9d76f000000000e800000000200002000000069eb318fbde7aca6f24d6763d534cf633342d2f9b26750e8c0eabbe127e61b32200000006410f655596e63a9f7da5c04fc718ea40e6a6bce0e056af6e51e21ee7f7658984000000077d73857ed248a430640369d7e2c8d5fdbd2bc17641018512b324e00b358364c2ee61bffa971cd444b96963e542bf8c093d1c1acca8cf285dba6127cbaddcee2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000901d1a96c7001eab81372bffbb69d3b2464018d4fdaf0c32e0d991c44814bce9000000000e80000000020000200000006a69d5fa5611b04822ccb5135f5524051f1a05e55859b41ab3e11b61b1f43c729000000032c41759a2746dee1132698f936db6b47fa5989eeed29a950cc955883af676e2a2d6d7453c3ee479c31d8cfd46643e686ac2d1f010727f63061485b7063a518b4724a6154ca438cccab1fd468375add27c344fcde05253508df9ea3aead71222c541de51f97435cdc8a702a01ee7c3bb9bff706cbdbb78970b25568984f5fcf7bd0e42ec6b79744d8529b2992e5afc784000000086a91d0551adbceb3ebebe14f8e763c4ce4fbcf18bd06bae221893741525522ff9880a88c2aca250df706971d30d5163d2323f589f3dc1d83077d740e1bfb1e1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{896ED361-5989-11EF-AB23-E297BF49BD91} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429725140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1752	3012	iexplore.exe	30
PID 3012 wrote to memory of 1752	3012	iexplore.exe	30
PID 3012 wrote to memory of 1752	3012	iexplore.exe	30
PID 3012 wrote to memory of 1752	3012	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93afab5df0e548768731f5c9b261f8da_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c39ddfdf33aa094c55298f4223c9d11

SHA1
69b31ef7af0c69c9243ea4edc3df70d65dd2c66d

SHA256
54b579cc15e0814e3fab12111398753f9282d2439d26b602ffebf2fcdc547242

SHA512
887d8b24f2f379d8a851868a5cb2eb1292a1058dc6f23b0f5e40b759ab1efe8cc0fd1a95bb57b3f0053ed67490e870e74ac4d034168c39cf140111e0409c880a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcab6e887363bbc68a74c5a8033840ba

SHA1
598a6f690aa9c58e05e283f991532543721f5c8b

SHA256
7fdede26c9e597c3b61ab2e6ebb4b58c254c7d4572800ba8be3bb5387aa9ef06

SHA512
97f509ecf46e7b8b1d22581eea311208aa02bcf55d7a41ee1b55966272cb2e077e908ffd78597deafd6fad7f71ecbe0826131e29a1a819c8077bebcfc4808cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a2ccf2a3a887325f6a7dd154f1b2f5f

SHA1
a4bf076344e60bc1ede54b8f172665d97240cabd

SHA256
c0f293b641c6f733e0315940cf4eeecbc6dd34260d1f869f661181cd447a7afd

SHA512
b702547b5d90a78abe942eb8d21f7b7fe363392e516ecdd5eed032d3d684e022819bf700c53f895bc84b595d60f3a1d1659c3b8e867760853a8c56fc5f5fb763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45932b55405907b1ba1cd63211213292

SHA1
ded39d119f3b728cedbdfbaac26b504c7898b617

SHA256
7de986bdc9a4637040a05c5b761c8801edf017d8e413f7db10f9a49c3cc793a7

SHA512
76310ab9879955e66e300a4069710ead9a29eddc26b38228091b983bb1acfaabf07a2fa740cbd098c3396ff566eb650c126a8497d8f7a2477a8fdc843efb4097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec6d3f246599571b975e3da169379764

SHA1
25272d19336f0d650791645a66744bf47672fb50

SHA256
0d2a4b7b852a93654098304fefd412a811e17b99e01a23c61880a9a757ab05e0

SHA512
6c3df8305a78a438f7783302e9c13b486fd97633a4fcc91aa417eca6682878b8a4bcc4c671ac6914b759dfd258d7de78062c4ba04dc024048598c3b8ecf7afcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdd6365bf3a7654d3e5fe8c8d9bab3a7

SHA1
919953e21bd6618fa189fe261183763e2f022978

SHA256
4c4243223066943cbb0d49c79d6c44f695ef8345dcec32303f90dcbbb0c5ab38

SHA512
088c4b0ea1291fc5580f53b42531a1375defc122fcfb5e369b7bbe7807a93a8086392aa06b57056037bffd9b54e6b6a77d1c480a1918a84ac9003a648092d965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a60c0cb508dcb149b00ae94be1e00264

SHA1
552636fb4b880b8893f419ad425b220be456dbe0

SHA256
086463a8a81310014d8f188063b6fea7dd222546900d7dbf2abbcc2f8dacd1d6

SHA512
e55ac2f93e9440d2d0558dd8378c44443ed08ed8b67a2c8fd8d7bfe85d6513677a7d81c8231f1d5dee6f1d92384a88193363d968be4dd1fffad814443ee82770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c53ed7890a5a9e15e506b621ff7114be

SHA1
c01a3619a6c091ee8e9fedcff439cc42ed7d71a5

SHA256
f1ce9147d70408d0d0dc72424a2eddcdca1919195be4ccaa3c99bd8dcc69e29d

SHA512
10c2580e90b4b00f7cf19057fa9d6c73b821126ac6fee62a8a83c29a72e2a77184c47acac0843edeabede17ff50628d0a5fa1786557afd0c57123de73b438dfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3740c43978e61e4a02c75a4f1a29fb7

SHA1
adc2cbd9c798ba431590cbd820bd1306acc8a2dc

SHA256
dcb22b41f04f5875c2cc4ca7dedd2c8353897686d7254afcf08f5b944d7ab142

SHA512
bda3854c88033ac36e6aaf06df4f8140c6e130627f7a5a64c41d0b1f472f7c99eced1a27c94968b772f772e1d621d0b094c1608f8e3ec57d114806e65a82c849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8dce1b10917272c3a9d7a35e40f55c3

SHA1
55798a61f8766b46afbf9700177a21e808187587

SHA256
4504d6cb1be56204c6029c6c179718bf7246dcf499628f68f5976c9d66c8edb7

SHA512
7d106518ccc6262579376a0ff89bfaefa2d7173b657eeb33abf1cd8837a36309bcdb4f765773e3f83f05cd3933f1e86ba15d7f3f42f4e3d972f114ef0a3b63a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c6966d4f89ff63f622a7e177150f418

SHA1
985fd0e7f9b6ec1a0d60191c5aec9701b34fa96c

SHA256
407948467d8be44bccd2fad32244f3853c77ae37002b7fd8cbc5a87b58208b48

SHA512
26f378075cd218c132a8e51c170a56fad96e784998446c725bf419d5faf7027fd7c534be69821b75ac02f8b1d8cb062d22bdc0be087fa474dc6e817cdede79d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
914d4db635cc8008ed52445f0dcd775f

SHA1
8daa614f30be2719e5d9a109f26ced905b153dcb

SHA256
2d7703119286b45d4bd937816ca7e1626bec6ca5a45ae2bcbf71144dfee26ff3

SHA512
3b9552d65152a3ee4012f15081aa779732acf383c6303297e2677006b1397ef4f8187d89c1ec01e8b2b82f4fe328098d0ffb7b9910be43c06eeed356ebed31e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f030121a5fc843bc49b7f9bd9fe8a93

SHA1
39916e15e4af558f647c47ba8fddd67f6dcc8f39

SHA256
35a797b6707ec125479f0f6cb5c4fccb97326f0950554f1cc9d28e7be36939ed

SHA512
dc0af801820bc5ca95abed2782d626e68e85c50c3426341717343f7a9207c17ef8618c702e178d2812bb4470a57d0b7c9f523bd2d21f689287d365447f7414e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e2551792fe9e5a474f3183cf9b7df80

SHA1
d1f4e1fce08dfe4b30ba011f5d086f7b18d56b2e

SHA256
4e13c6a2a7aa46ac2b0e2024a9e5cdcbfab0535887a82374878928722af531bf

SHA512
fba83b3ef0604261c8ec5b584d07458d50cb884fa3507fec9aaf0263c02c99a4e46d73d517df9cd3c0a24b73d49dffc93616faffb7c20a691a37057fa8a02f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30b5bea5330e822b2fb3505df2d0cd31

SHA1
412560c63bb3ad9ed39fe74c3444f13607609612

SHA256
db7bc4e3b9714d457200a51c5e4281fae542bf435c28177caa969dc4eaec9ceb

SHA512
9a28b070f36b6fff0409df0f612157c248b66f741d815e6ce80ee7ddf507dd9e434b653f5ab86a74adcd58938f5150b11a12eb1f18b60430dea8290e8ee2857b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0971e9bfba771e60630b6e762a0336c

SHA1
a438371c8d09a201d22f7fb0c1a4667b8ac7970e

SHA256
cc9d63730e0b5266feb49e2816f7d6f138e90cb954f0c5738dabf156750da8a5

SHA512
de2e75ffb7f56e714db36524ebe6f1a12ac9f220debd1cc65191d8c8e479019d424947785d7f7bdea5e0a79ea43383f0a4d2fcc4fcc80f7d8990c75906affb14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8I3CVQY\upshrink[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B47.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C25.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit