8eb20fffd6aeb0bbebcf88af8ba46f230cf4f14452b8245927ec3ec750d0bb9f

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c20da46e98422b8db297bb048879607f_JaffaCakes118.html
Size

74KB
MD5

c20da46e98422b8db297bb048879607f
SHA1

634bcca074879ad37bdb345ffe422412ab5eda16
SHA256

8eb20fffd6aeb0bbebcf88af8ba46f230cf4f14452b8245927ec3ec750d0bb9f
SHA512

6464fab8ca6b5deca26a207a8ccac2e675140bb17bab8ccb9e3680cb7f7479ba79dc0442524943136357b3fab51fcf904b6d391dcd68a525a5fda013afbebb08
SSDEEP

1536:uBL8EMMt9geWGo49gtnfXPcwjbryMfQtN76c3iQuO2en:uBWM85tnvi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008ba3f1c1ee00ba9c8780910443206522709358b77df88ecf9d1005e0208f0892000000000e8000000002000020000000710b559d231d97295e05b379c05cc8b051a1253bfcd30d9c2556ccf7c7145109900000001eef1c8e5ea1dbe8e9ceb7f5ba466cdc21bceaac49d3797c9923d1a4201eb7df379f33c77923a3bee2db573d8e3df1f24528ff34b1306e37a75118e20a66e5ad7bdde69acfbccf69e2942bea9f71f0d4ba6e2b7f638abb1d4ee553686081cdeaf2e5cf01904954ac5e77a393d4e14f8edfed291bc4989488c4b820f79cd6ca463e4fdf0c1eb176eb81be713bb9447fa04000000055aea3349f73a9f0708a2a2231e1fa10cc4a45f9b24b1c48a50fc43e67b83f8230f5d806f4695485f21d0a2a5637f0fa434e4b98038ec4153c119b6b63eebf6d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{477B6211-634E-11EF-BD32-F6C828CC4EA3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000013ad0a8ab6060d3ff7939140ffefc982c4da2bf5269d05f98e7f74e0972ff4bd000000000e8000000002000020000000653703a4ee47f05a0e81ee891e0a88c3a213e7086ec2f5febcce10ccb95ee2f420000000fe72ff278b09663860d5005a845594bde468678872d32f65950926a467a962d3400000000206810ed21e10e9a7fe373d8bdc51cd6058a572673d5e9d4d17a7693a6a938d0719dcf64b87b002f01e85936aa1d5cec1eb250cd81ab7169993c53e8949fef2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430799205"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409d751e5bf7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2864	iexplore.exe
2864	iexplore.exe
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 1992	2864	iexplore.exe	30
PID 2864 wrote to memory of 1992	2864	iexplore.exe	30
PID 2864 wrote to memory of 1992	2864	iexplore.exe	30
PID 2864 wrote to memory of 1992	2864	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c20da46e98422b8db297bb048879607f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
bc59e200e664e88f82dd70bb1441ce07

SHA1
fc12c73dde0b730cc48b229ab70b02b21a3e67fd

SHA256
e5122d5960256b4d142e766cc044febbfc6c9cd5f33bad0924a691147913f58e

SHA512
de8a00cf090dfbc784618263ad8aed134d7ea93a207b4187802d8192cd5d2c92ee90d1139df5577aebd0629236d5cf01c5191c9c2d6c2d4b4e2dea1667472fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8e3ffa56805dde57b50da8014688573

SHA1
d04f3219287393e9b8bf62062da00ba96ce73144

SHA256
fbc75c90052984bc6607f220c93afbbcd043905fc02b7b5211fa68823bf42022

SHA512
6ec6553197616c8783fc4a9d03a103be7e1f219864f0e7ae77f3cf79bc27e5b75986a759d673dd96eb0610939ddfef1f85ede788a6b5822b73966cf0f00630fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05989a47d353f8f6fd0480074c2d9cfd

SHA1
739d917a2b2e78bd6aa638b55f3c0fa670ccde4d

SHA256
4d54fa222165dca14a50ff145adf4964e2d9d244884fa66da30dfc7a8c8a89e5

SHA512
e3cfec89975f0a63a6d0f4f8fecf52a2186c0dc2126081bf2b08aac809afed7d0177efc4a93a4a64ff5bea6de6c6d0433949c521184ef7da3ac8be446906a776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c34e7e7ba7e9712a190262b00828542

SHA1
fb3d8988601932e1d17a84e2579ea22e7ef21191

SHA256
9e2ce456bb56e029f4e57f4000ad9db3e1954fad594d057b247f1941d7a4c503

SHA512
cfc93ba3fb25e5d7615a9e81785216a23896891c14f0895cdfa20d211795c9c1d583881bc960d5cfd04371b5e53751baeed2b6595bd5ef287a057fa4b06d5adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9711ff4c1d1bbf026164c6e1c02298d1

SHA1
077c26d84c2ff42c9b2a66faec38bb9c66f46a1c

SHA256
49f19a22e1b04c9d17c2d5a09fba489381821491a3c160d341d6973ee09db84c

SHA512
4da68fb19ec52c7a0ef40286d97e5c151f46849239dfc422fb64b855cc4195e05de019204630c11950d9edee3bd8b923a8f18b0606163b374e92445ccd5b552c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
242d63ae6945c88f03e087a08c598185

SHA1
6cd9eb056e6c3021ed16bf8b86842679848e2955

SHA256
14ba5981bd1056ac5b176224d1aa4d75532ae046052ef473998937dbd6785c12

SHA512
5c6acfb845d0a8c88c02b12cb3a7e23ca5bb9e2cadbe6c5e8fd30f9322ae512dfb0eafebfb74d68a6e0430c6946605f7bb8733895368c9bdf6c50f258863b11f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
095840d907f8762fe38b5ff0db40eaa2

SHA1
cea6ac96354ce5d256765abf4d1775d0a677b8a3

SHA256
53f4ae1fb63ba30be0766b3cf0272e8e723f6caff36677cd69eaa2ae28d749af

SHA512
8e993ad209da1691b534865bacc5862d30c91fc4c2e833e49656507d7f688ba1dda0f0408c0f498a70731a8ecfd79f9494cd17369c665744744c5620eda8d230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
669a74eb6d32549b9de77d2ef1c27fed

SHA1
288505327cb00c73ba5221b51f7943ca4fc297de

SHA256
4165c8059f222e52246b83d0ac11fe8f2924c15bedb9c7032793d7d4b60e0250

SHA512
fe18e08ca83f7cbdd358c45035d3c95a1933cdbe5854b2a38ef9b0f6b309d39918bbc75a3aec6f976cd8bc40c5e9211e0ff7b53e1230e1870e0f7fc9a1d8af2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7bfa53f33e16554ba49adf7cfbb985e

SHA1
83594a0d9f5df25dbf36ca7cfe4b7055779c9827

SHA256
554b43cfd9d52888dc2e01750f69a1b7581761fa2e0e73926cf237c2211a9886

SHA512
770cc15dbeb33f28918db030c677b62475d4b68f6cb39bd13881d9a09d48b2f902f011264704da073daf1b4de62a791f00094b0a0397d2053e059a75fde2d5fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
743f06d762fd97152df667410778b163

SHA1
67983b0ee7723c81d20d12687e0264ea0b48f6dc

SHA256
5a6cf26a7dea4ba6bc37464d0426aa4dd7bf7fa6d3780d79337349cf9c18f984

SHA512
01e2bd1d9089e8555e92d4f31e0c1675811cb6b496e640a7e39137e7cc8ff3aec329fb84987b92bf3363b8a253585cef771bb88810021edaef33aed28dd41fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c623d7e55d9de480bdb1fa5e59a2a5d5

SHA1
95e761b7a345fad02935918873457a55c5d9b3c9

SHA256
dc0d212d562f08251e959a58aacd6f7e43c0eb7763e35c4cde5b067f5c81c4d2

SHA512
f4dad80b74b392c7808f823d339e63ebb856a8b0e4c5f1f51f917f38a4333a3aec9a10aff0727327ed40a6a0fb74b78628799d63252a6c6c091d64519b928973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8392159af4a0a37a446f8701da8fe776

SHA1
f5e50718fa9889d5a47317a8e6d7f51c64b7a172

SHA256
003ba6d582bc41dbae19b44203026a1c327a384db49107926b6948dd8b5b166b

SHA512
f8ed712862eb18a065b026fce0bdcb95f7e26a536b4bbad12dad9fa4f2915d8933358c363a86beb38a894b0ef8344807940ef230bd6c0da6e1d33f0502aab5e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
92d1bbc7a0869a764b682eb0ac2007c9

SHA1
91ab919f414c5f7b94f4aa63f3d7ccea99c84ab6

SHA256
aa28962caf6fda5589ccf588a245c3593d81f81c58fdb1ec7bd66a014ca70aaa

SHA512
c370ea15150b4539a20093e6e08da78a77ca0ece16d23f09a5597aaa3ec6b0c2332468bbf2ee44754176a2a4c96f9f29685bcf584ff589e30c47802208bd6698

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC61E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC6EB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit