4be0c561079a8381ca41456f41d48297917f2f7243ce40cbb4297a0b05bd0c78

Analysis

max time kernel
70s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9603e97f6832625ef6839f53993a673f_JaffaCakes118.html
Size

223KB
MD5

9603e97f6832625ef6839f53993a673f
SHA1

6b1c6353a473a201c3128e280cb58aa20a6a5d65
SHA256

4be0c561079a8381ca41456f41d48297917f2f7243ce40cbb4297a0b05bd0c78
SHA512

1a9dfb8173a94315eddaa893ea3738d04d9fa9bfbd382e4af9a442ea200df06d289a79f4508307a9ac0937886e84f827d665356aafbff3467663e93a63237e4a
SSDEEP

6144:zyj4QN83G7WdLo0kEz9VxLY7iAVLTBQJlH:lQ+9nLYWAVZQD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4043728a41eeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429798661"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000d4c751d0719972a765b0e71eb0c6a4f33c3de2ca328630a61110ecb7a2f5f4e7000000000e800000000200002000000007d492157fba3bbc2c24b4548de782a448722973baed630c6ce1f4b4d6a0489d200000004e35862c98869cf7c0caceab2fed0bb2483739b1a83f86cdec911e077e60a741400000007c58798d9d36a1ef47260a2ed01593f1d0a8064faf4d29602f33c9f69f4b3b3bdee22ae68f9fe9e403441d6b30a743327c3039d0a2523521a34d8d398ee94268	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000b7df7966ebcf0341e6b34bd81074efff710b4bd528d807d851b1d27f4c9a64ce000000000e8000000002000020000000e4a5c3686ee88e3d012700fb24713ebbc9d04b6c55ca6808f604d40b846416ab90000000a37083d0564eefaa5f5ca6a32ae8b32e14324ef7c9384b6d2ea25be3032429b268ebf4fec3af6e556b0c869b876431ad0ab24a7d38c5e10b07b7b89177768b72f2636a1f6a6388d4ccf3db83ffbb11a0b433960c0ddb1b01f0f0666eb9249f7451e52b1b4befb84918355ae109b7102cc09682eb9653aea32feccd06ee5e010cce721564fb05c0ea25166d5ee0a056e840000000a30cfca06814283ea2bd78094998f65d0a273154fac6fd45b18f130b407eb01615bd31814872b2abebc239a9a3d29028b5b28d51608d8cff30842ecf0cc566ee	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5974661-5A34-11EF-A839-E6BAD4272658} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3060	iexplore.exe
3060	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2448	3060	iexplore.exe	30
PID 3060 wrote to memory of 2448	3060	iexplore.exe	30
PID 3060 wrote to memory of 2448	3060	iexplore.exe	30
PID 3060 wrote to memory of 2448	3060	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9603e97f6832625ef6839f53993a673f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e1ce9154a93f6da2be595cab22acf55

SHA1
7ba44ae72a457636dc0b98c7edf484627c72313f

SHA256
cd12c4d16b4359f4744d77f58bbe0876c5d778049f401798eec585f5b099f18e

SHA512
405cc6372308b29ba88893d5477d8703f4a1e30b849129248df81943b788d3bc1ae6e4120e711a7fa652418cba5cdfd20feddec216266827eb631b34698e8edc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2df8610e244c92e1471d8af11afd0028

SHA1
a2e9b898c5ff80d4e74345f13a977ac7b046fdbd

SHA256
21f21648c5987158e17a9849d1facdd72fdc7d36d3fb1c7bfa498f37ae5578f5

SHA512
60a552f282d4c4151479a2558a4f01aac0abc65e03b2293556d9f8abd7a5c31d3161004d384151c227b318696d9b4e61bad4c700b1c77f028c86d6be84006cc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09dc063f7d3091d3d750c99ea57e029b

SHA1
440c2d28593d97947a791a23d455ecd91780989a

SHA256
41c421f430905fbba29fa9181cd59985b295264b31b13895335ae2ea95a24498

SHA512
d1f09a25f1582690dc98df78fd80b5107c676d11e37788ea0fc6ad91f059b54db4ddb22e2aed0676f875f406ee7071f8e6caed50d3271033b7199581970c3f40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f3de2babfbe17ee8fe933135d110d21

SHA1
701bdc7a2ac210eccc8e0eb9613aa2df771239ba

SHA256
56e66e7a31375e6735cd113ae7c65e0736f4c1fe2d1ddea8d0bee2cfddce848b

SHA512
55072af0cdbb66861028f8e26b76c7c6d19b5c1f5f886e3780c3b15c2c15cc481f90d204f842d18ccb999ab8067f21a8d4866b53aa43bf026c2d502c6a7db28d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ca6962b2390c9b7113112ee47050280

SHA1
9df73568fb0ed27879c35d570e58b16d7246f9a3

SHA256
4c6d4eeb35e6e4bbca391a23f1037f3c70dac324bcbfdca57bbe97efe63da470

SHA512
b33914948d056cd6423025f860eb11adf0a3a799afdd38c835564eb88a3dd2ee06df50c81f82be5d79a237ff66ecae8680179534e238756f22e1513bdafd721c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7514a5e372ef5c7e4b0d5d6cd5fb070

SHA1
29bb5d4dfd5b7e9fd5deccc265f84698a18b15c3

SHA256
e65c683cb7d1569ee712f43e5c36e2721225f5ae3d60095b13de564e37b6c013

SHA512
c6a3f8bb5a7ede547bb6057ede28fc8950599572e2b9144cd259ce97e37dacc4e6403c157075d8883fdf9ccbcba6106f8f022cf0c557deb08a37b22019414212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4dd2ad1d77e9a947e9c32e8ee824048

SHA1
edd9af1aeda9041fc46c08a080792e7b998779e1

SHA256
f9bc9c5ae73cce922802dbdab388951f9e27c847b9dd390aeeb791571c987e1b

SHA512
15545fbb67daaf3e532427a3051a89e09e27472b34b2dedbf90b9cabd51d638b79c1ac675b7d40e68c9e60d2be80cb179671ef392d3f6a3adb5d390e1fd46c9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9a48a71cec58be65e4af83db8f0549c

SHA1
3c8db4f7487d873df5f152dfc8f319a504d9c188

SHA256
c1638b51dd46e896bfc373e4e2acaaf31c435c53c85c652908b858dad8729b24

SHA512
356939e6f31f275fc08ef785185186ed83e4e239a3ee17ec2b1a88e6c6b1b5be712ba9bc2dfca876a5abd48806a8426630c98ba2c2f66747fc08259a03662465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94a982a8b3bc7ac3959999a8df9c96ee

SHA1
fbae63563306dc005eab67aebbac55c67c6a0966

SHA256
e119d11f45645ad4d27081f3dc844a040c46de72452a8ca3cdcfc20954713b62

SHA512
c62e78700147e58b8930528fb03ca2662a6b9a592941d76d2a55259c513a5f65dbbfa205d8babf1ca316ee3c563c0ee54f9a405a527dcbc8c2555742a7e24a69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b788f045b842701b32d3cfe3e94fb30

SHA1
2e2f2f1a7075e2a07b12e865fa218375b34fda5c

SHA256
0255a399e3032762575b8dd79b6b6e6d2e596f01ddb0c986ad310493fff3a908

SHA512
21ec790a44b6a6c20e1163d3587d13eb31608984326d127c2d18ad55445c7e3325aa6c9a86d7483bc408aaa60678345239229ff642e7055207f0f262964291d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f83131f8cc9d761be1c053ab9db4b05b

SHA1
2b5f20ec9db9b9a9938683a68a546cf5b2d9164b

SHA256
a0efe35b44ad551485daecad387ef5f3ebfdfd112ea0676b62344defbe33f23a

SHA512
df387d31bfe0b5327a8b5047858808a7b4f809fa1c3451828853f11869c7fec1dfcf624d34002ec1c3ca7b40989823d9a97049d632b949f5197526cefc450f01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93f054c78f91a05082caa34cf57a2290

SHA1
0713991d8285cff0a8d4ad85a7812605a725bea6

SHA256
a73e83ea80d3fa3b5a3d57a64f4c6b8240be97103a785cdc8b1f0a7b36f38837

SHA512
8237aa2aeccece743b596f346687b340ee5e7812375042043d7159611bd2b2f82aac3ed7821fbe422a18b0174d3fc59eaff553e3295f838d835fbb9c33c4d096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4e1c18805d6a8ceab33bfd28e031ff6

SHA1
5aa774e1ae1a60cd64ac0b0827b1f6f6e056b3cc

SHA256
f498b7b0977f5929a24663de9098cf50927dbf6ec14a434760d92e8ec2fd69c7

SHA512
3c6082701a944e9d4c934a9424e812866f2527908b0c3b8e63ebf4a4dca3439ea4dae483099a5521a48faab5c0caccb5a7855a3c549721c077e6006513eedb16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
561ff2ea8b0e06d86fdb36fde19fbf82

SHA1
569e84c37f911c57d1690fe1ca2e3953e087cf4b

SHA256
a16618c621cb34793594b43eb8c0c35e3f25912728d7d4159ca7d410250d5a26

SHA512
c59d9b168cfac1f9cf807284c58c2e876818b1554935c35dfe7d035caf31a30d3d6ab3bb33445880d127f4cf64d91db9e573af49639268dd8bc40fe6612fc5f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3436e85787bb59f954d435f81b0bb3a

SHA1
75536a59769f1cf9602ad524f52e63a5566b7c6d

SHA256
5c956bfadf5971998b1d09523e32ca998d1c1769a6cbc85a1e13c858dcecfd9a

SHA512
ac5ebfa6e39fa27b3a0270680aa66471e945cd4b63bf9209c142891e6fec78e8f0fc71a533c70466749bd910a52b41b33716c68b919fc604b6d5f1351d796135

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5a497c38d3c7e58ec41e6f61eeabbda

SHA1
a6ad453853b486a86e130888d207026c800fe37b

SHA256
dce83ac6fdc128a26c24d727a3a611233d8cc4669264e9b9b180d5f518e696f4

SHA512
14a1ae53aee10ec85a5c94f48ea291fd33cf794e7128af810258bf2fd9f9712decc0274e4296d07e304f493d5ac6b0fb3462005c977e55110882d57ad92f10d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
181348450068aaed16b2c4a26051ab12

SHA1
b13a16c9442627fdeda256c6ebfaba2ca2a75673

SHA256
7004caefa41cde27b527dba63a98e59b79fd662c11772b2eed3015c91f3a5821

SHA512
6829caf1c213d851ba77c235869d1622faed8b336fe30cc3b32da7c66d78a53f2955196ad156974bbcb43e5192b09d4717a9223a6cd9cc470198474a9ecf0f10

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC056.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC0F5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit