a0a72e4b0384a72ac136bf8b35c217c5eb93da7a19c81f6b77877d171090996b

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7464e60bec88f0001b03f0901c2bc84_JaffaCakes118.html
Size

3KB
MD5

a7464e60bec88f0001b03f0901c2bc84
SHA1

a46f9c841887ac2e6133d156aeb66d3cf8cf930d
SHA256

a0a72e4b0384a72ac136bf8b35c217c5eb93da7a19c81f6b77877d171090996b
SHA512

939c7186c87eb5089c32e988c66b37c4216f79e1519d69be138b6ec24b7574847a55920fd7bc8b5d44d1ae5b9a315eef25edfc25cb852509ed5daf947fad942c

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09C40001-5D7A-11EF-B5D6-4625F4E6DDF6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000002bfc969fbb60ba112e72a6d74d525b1685a997ac5d2684c902f835238d62cd48000000000e800000000200002000000098764246f2a08f593fa770ee8a131d7b07cfe6dfd3d7248dd9dab5b378ec1ead200000005ff4450e4f52f7501e33dfca22310f0db97e0cbef2bc0c9d5b983ed8568d6adf400000008603c6a371cc9bb95d78945d1ee079988769be46fc6f00b812d4249a36ee0879ee3f999e03f7db9be9db1397b2dfee3af631394d70382c90ab363050455476f5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000044f88ff0d36d9f50c84487ed491dfb6b98559f792f6f1699421b8bdad4562a22000000000e80000000020000200000008e84eb36f07aef17cfd24ad8100608ac0763a185a24da96bb5686045034b55e390000000892715cbffed4439f24d864daaeb0a090de980aa86cdd73ac76cbe0634d31e5b987f8befd77c30118f2aab430c3b4abfcc4f055a10d69a0ac199f23b3a5194ca29f5f18d2a2e208f5d433a4ee0b5aee3b0c918a06328831e317ddaee271dbcbdd62ae3f23327d6705dbc6958cc426f6f0003892440152949a3bbc9ec89fd6690a962c4947f31ae6a5045d43a3d4cf56c4000000013b7e0ed7cda6e7f220fe69dd5d6e0b7cb35e0127d60b3ed334bd8211250752f0fccf2a2e4436a5bc8abf27fe146cae87bf3513330ee5bd3c6e884c0fb2a1bdb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04f1de086f1da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430158288"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1716	iexplore.exe
1716	iexplore.exe
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2432	1716	iexplore.exe	28
PID 1716 wrote to memory of 2432	1716	iexplore.exe	28
PID 1716 wrote to memory of 2432	1716	iexplore.exe	28
PID 1716 wrote to memory of 2432	1716	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a7464e60bec88f0001b03f0901c2bc84_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00b24f947119c35e4266fa4fd2b1a7b1

SHA1
390288fd81eab9aebc5eaabace4bf8af359c9a25

SHA256
654d78b2df56cd15706d61ccb9f08756cf6db5bd5b85bdce0390f6bc8479f1fc

SHA512
f844483f9a0d6ae8f1fa610c4c99ca3b8d4a12ab86b3518e8dd5f24bfe61b1a319911354c8e5a65977e78d8e9c8a42f254825da8fd87ce3b7c31163310d81f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6287d797732a736d3612b2df27e0f2c1

SHA1
5b34cea3714e4bd2f9bb7083b754c26e041d883b

SHA256
e211d10876d038fda192686b7d01f73b35dd16507c8d19d6e370f6f5d3b8823f

SHA512
f946b22d9f133019b4b985756025e5317d9e34ed6aec8a4e0519f5e581b90ae3991a56bdef53781a9e9dd877804f0fb3b21b7c18c797f278ec8b0f0e19858c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e78480d7a0067f0133ded156a91078a

SHA1
17fde9d97ebc65f3a9b6d5f9692a600088330fd8

SHA256
97bb13f922d39c16a46aeee0916915d6359839b34e80e5b6d1e07a22906239bb

SHA512
1c71f372f20cd772a848709ebb97cb691a569ea9163c500161e48bf45a219542c95dbd003e018724f547b5d1d3efde758f799282a3c99f881eaef75794e95ae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c46294409d1687e47c9f4ef49e8d1e85

SHA1
06d94c622751a5dbdbbf30c8d3b964730523045c

SHA256
9dee121ab70ed22f797903717801b0db27fbc33df91176d333aa59e286ff9a4c

SHA512
8cad9bb2eec9cc71f8ecb3d393d218cd47b36d3617215568fc7a916c7b17fd417b88c829d28ad885fa159a07dddd408f940fd3dce832d7010541826c5fca7ba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83422f04423e683cba10582fa021df76

SHA1
cd9945a81c146684705a92b8d6193610ef398f60

SHA256
f5e8adff055e5e06aca03ff8b7be000d910ce9b289dae99d7de8ac0d7d51c758

SHA512
7b4e665d7cbb7e4a2c53be0ae1ac9b7c3be4365f37bda13cb46bd5ee8180ff7c4d606c5c59664ea228443b6d38709b2311a200e7e97f4f71c5d793f71d949b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
011d71d24cbe7562eeb9fb82dbb19c94

SHA1
86f86170d1dcac14e1c7ff9de6693664b9a2128e

SHA256
4dd43fc738048c32ac0ecab767dd7adf39f9b45f918bf969b2f1dfa78f368a53

SHA512
50a70906c6bf310b1f42480debc9188af063260807ef2ca242f26921ff25d6b0cfea7b2ba7b741927d9defc912553bd1552fc29804e459af6b8496e7a04ecddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bc6727cf931fc28d84e929da5ac1f13

SHA1
4ff79eddf815b13dc2e0f4e80fe58447dc447632

SHA256
deada4dd323e87b1857ff897db3b7f8ed0811b46329ded2e25b1fd154426fb13

SHA512
599d36a0f82479f7df9f306c3db4643efd81836026fcdb07ca33af718e60fa1417a7efc506ee5ab6c27bf8653e29768832a61381896248676530b405d34382ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
017ded82b100cd3d6447a5b09368cddc

SHA1
b959e67357f3cc109c9e2c6cd3ef1e8e0e5d314b

SHA256
a94b64b6050c126f2d3f2fec6b480f708c7a393c520ce41c18bdedf67b89b219

SHA512
d9a9ce46f8fe0d31edddbfbe5e3c1e1f8d3e5559074ea0bb9177183a9e91de1dbafaa9bf99f9bf19175a2ac823025be3aaf8e20335ea2530e9676e7fbd5babb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b89a39ecdb6d24696afd04b0f1b6d97

SHA1
51a1253f036030bc492635e474323636250ce136

SHA256
eca6c16cd66ac2daa5b292dfc14f75571534e971786f9bdce44e798bccf1dc25

SHA512
d6dd91e5c81109979c4577b5cf26af076ffd7cebd7cd0b0b65235059176ff5495e5bf83ae0711cef8c598b002db7b38349c6ff8b367fd8ffc32726784d8cfc74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdaefd50b41356a75c57c651c5f68412

SHA1
ba21cff6e89e643944f4b8aedc48f22360ce6202

SHA256
e8c1ff1a5c90d235178f48480c51e6141dd14f7e3b33af9f05cfbefcf7a77d1b

SHA512
dfc2308d343bf5faee33b987c5827aa7ee312071979844e0e455991903ddc4e97b0f98906daf5eee0745125a86294b171ef697575b4cd3df555dc075f80589c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2ab7bf1acfe942897c0f5a6bbbbc171

SHA1
3c14b78109e215cceb89e3f84a88ce283cdff48b

SHA256
63eaa9e6d5910636777efdf0a30d742124bd9085138b18cc3cb46d425fbe3a92

SHA512
4969c4b38622f45a99581c918ca6d12d3392bd02bbca5acf86ecb6152dec9fba7d42da6975773a8eb9dbd2c01a090840105b53b863ede0a8d54bff3f5d87ccea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45353862aa982fa87e7913ef66ace17e

SHA1
47bb3e8e793759ab55c19758b676996669f67c6a

SHA256
fdc67e693473bbf161815da37b02fb483225249be617a924be5e8363b9ae8561

SHA512
2561d2815ae32272b61df6830d076436596f338bc490538d18bc3b374389ef22d3f5709d54a50539b1baf7e775911a7b3bec3fe4d7c9c59128df935d8ab7b994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f92f3b3e473856cce360ccf53cd04a3

SHA1
0591ea702c6986e0b2b01469097225d8cb752282

SHA256
a0bcc5dc1a87fb4226dee1b3695583de3338d8c5a649a44a814f9a55f26cdcc3

SHA512
34fe5f36a3e2fa9eeb5c9eb6de7dcac09f011d5f2642ac76b5b5f3829b2988097c63af4902f704aada6ab8f0b69fce33e35d1040690748c07664513973bd03ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cf4379a927472d40165e9f85b981a66

SHA1
93bda81eb62ff64925857eb95e5ca516411e480f

SHA256
948780e03d8a1e008fc21b06f5e44ca3340167fcd36f8077c06e9a315d097b75

SHA512
c26084a1ad0cc542923f062cb37243d1a0123bde46504303f0d5892e0c1a8a05f3144700cace0fe1da617bfba1c9c978b0feb4fa22f9e0d1a1e1b35ab4f7d9ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f6492a44443a5e156cfbf3b85102b49

SHA1
46c6b41a3c5d351fcb1c96e7e927033b528059ed

SHA256
a25f691d69f20c1b0560b978a88c9400641a90b24e465a4d4dfeefb105f94440

SHA512
9c9025aa602a21eb0ccebaee30f4664a469617381c19dc25623e4eae5a967ee2b0d838e8dad4517fe2e2bc94b05ae11b920abffdf7e6ee3a920a6c76dd0531d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07ad7078b87ab3bcc30d87df759ce4c8

SHA1
c70b82da55150988f11fe37af3187784d37f9152

SHA256
c020119eb3712d1130b762563a6d641e2d3c28019ec784c39aad25be0c66ee3a

SHA512
49aebf2d073a87d1896e3640bf32fae3372300c1ec9f2eee64c50b6194d3b4b2b77b74e030fdd784cd8c34007248e5c803eb29d02feeaf26eab25d5f4d226129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f1689c9302985fd8548a19bdbb7d98e

SHA1
7daf198f858100a98ac503f58c3bdcf118e954b7

SHA256
61569a027bc639b0d20490bc0f23357680d9d87bd284f75bd0fb2d793db0df58

SHA512
63378927e4dd401205a91a2d8e73c32290a76808bac413b788073d182ca597c70da8c567ccf392e241855465c21bdc8c0753f70815b426fdba4b58b1d428e29d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA6DC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA78B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit