2f4de583db00709b91a3059d22640d8f0c4ef1928b5b3d8e1662972494c2d608

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c928c112c301a0af153ecd9d9d250a38_JaffaCakes118.html
Size

86KB
MD5

c928c112c301a0af153ecd9d9d250a38
SHA1

c7018b738356c892a5a8755229a118921b794ca9
SHA256

2f4de583db00709b91a3059d22640d8f0c4ef1928b5b3d8e1662972494c2d608
SHA512

982e7843486de5b7f65e609d05c6f556e9775cf9421e899965aaf8cb9d3276a21b66413a0f8f413b4d8011c47521ad1c6bc85fbd5d49cd3916374ebe9c4f8a03
SSDEEP

1536:t3bqkxWXwFBKK+P2waE4cllrlwDWn17yGkFVl:JbqEWX6BB+P2waE4St+DWnTkFVl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{305AD5E1-6621-11EF-97BF-72D30ED4C808} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90c988092efada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431109689"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000003d03ee246ee22f3d3fc2956e6e46563174e374e42e87934131c6327eb71843d6000000000e80000000020000200000006b60fc4bd923bc7a9982712dc023fda93cfaa3625e42d46edefae76976eebb9e90000000c3285cf1e5a020ee568e4b792a37550b7fd228ab7a64988a3b6fe7fd75fdc26c98d89d1a0a82ec728c79fde0e8ed10ead7284b77054fcf8eed5f9bc167694df4fe5d7c8f079f7bc9a116f833574b1ea4c2cd1570c9af2e60deb4dd0b920465a4bfc2045abfe9f403773ca1e8e47f61fb6341f9dbcbcb479261aaaeb40bdd06a2dbe049fc2a7db2e45711862845adabaa40000000a6d3981f40666819404f62aa4d184ae436068fb9a4ba33ecc97263e0022557aea76bfc9939bef683a5edc8f60c7c1db7f409151f290c6a6b270a7d071f66e11f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000007904a859dca5ec8ecb5cbccbeab9adcd56200aa4ecde69cf08a38d33ee4009be000000000e80000000020000200000007de1b0ec1737b3a0016feca552269d699864bc66784b2690f298ad7012c6300a20000000674a53ac86e997e4ed630506e0b45e2df195c4d51d6eeff22b0221a16cd8f5f54000000078558583f874f4821120993e0e39344b8445b9b5d0231b473e7010b30eb0dcd7762acb5ee73c7f53e660aa3f0641535fe69e5aeba2ad36f63fc4ecbd0753b944	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2876	iexplore.exe
2876	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2892	2876	iexplore.exe	30
PID 2876 wrote to memory of 2892	2876	iexplore.exe	30
PID 2876 wrote to memory of 2892	2876	iexplore.exe	30
PID 2876 wrote to memory of 2892	2876	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c928c112c301a0af153ecd9d9d250a38_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7AD1F15B0B39B767396E6AEEF88882DE

Filesize
504B

MD5
e9f22668c1f08151c8039bb284e81179

SHA1
a6e94fc3cc8ab00b055fe2cfeb64572fa59d4bf3

SHA256
624e50fde6bb228717993b3d22247aa15f4fc231c2f9a03f2f0d86af44c2c91f

SHA512
1ad8969170eada2fefc6d625881c804169970efca351e78884198081065fb500e13c91da4044f8d6510a978c5f4a3daf5c94fd26d2257952b6ea5d7b115c2aae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4cdfb736529591e8fdd0401b8bcbb632

SHA1
b4a779d705102cf521f64b9aed16cbd02bd30b61

SHA256
cead15248832a0b9f735c942588042f15380163cf26aeff9382a64c9a1dbedc7

SHA512
8298a2e2360aa068fe96dbe7a04a1e9af27b463b1786245f7e5deecb99d7bef03353288b71375b81a9198a67b37430dfdb1b67e2d05dc0e5568ea8f65060ba7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccff410e66d62e9c4974b62371b03040

SHA1
d3142d66b78664241f93fc391dbec301d6fd870b

SHA256
908b967ecc830ab13d2c76230fc5924730c5eb938a36236534676a60e9758924

SHA512
b306e9bdfb8fa8d551e64e6b2ac21370c0c126fcdb8ecd17d36b35482b7a3eed60175aa8ac4deac02f2e3ee6e7c1e2aa3aac7b36543738ed28da9c247188db39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
445d11b16f98aa77ae151322d1599a6a

SHA1
72dcfb3cee0fa50f7e39481ba7b432a88d09b7cb

SHA256
67186359f2af770e5e3366f09154f689b9c05aec5569d7ae567ab541ccb7cd4d

SHA512
6d861933e77fcac913f200f1f51e3b2e6db48dda6f327080ec510124ef49efc320b4312d0b89a50c3480da1af9ee99e160d67bcdf01fd9f12df23be9929f4860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d77f7e22a4690a5e2d10450d2f0a35cf

SHA1
09e6871f10f17afe9961cae839643c30e3b1d485

SHA256
a961c371f2b5682ade3893ed7f44c10eacce6a61d7ac21a12bb000f707ce9865

SHA512
2d8b1828d85dacd1d9f88c19b2f621686b9e2633931a413f3f5a887692bd883f2c7afe336fdfb181018f1c9dff9457edef61c7afa1dd98f39d2fc64871e6e267

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52d987575c210593139da60ef84da04f

SHA1
09e3c6598c6dd04b1bb78dce2092a6bfc05ba1c1

SHA256
5192e20c24cf4544b08028f6f80c32eaa7958ba9305b001a87a0e8531afa61ec

SHA512
172e6bb6c57e4eede373a1f4c24edd9670756fb11e73b6657cac60d833e5c352998d12f984d32ce5284a312ecf5139fb7427c0accdee54a4d89062e9f24c78f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f54e6596f91391371d0f05f276dbc37

SHA1
9ea0111e3af4fa42fb2ba3347cf0e7133322d4d2

SHA256
1b95f93450550244cc3bc88770f4841cc8d25f3ed8e417b5692f13203d27e185

SHA512
7bf903e9349cbebd006651e25562e2a8726d1a4fe24738aa117f42069e65f20891898255ba563248481d1afb94ca80e65c69d48db4bf17d47e51f92057145eeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
836359632684bbcf271a2c23581ff0a4

SHA1
dca3efa90534d7811a64821bd72b2fed992a9329

SHA256
fa493062b4913f39c106520812c9a7fd17c0bbb2d9e51e64f7b50d4bee9669ec

SHA512
2371603751d199148a68dfc92763cd535bb3da536c896b7332dc0e0a7363ad91d699fefc41710beaeffe553799238f75521e58faa982583355bb326bfbfe80ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
556cf7d6cbbdc928a34f7d1c5eaee64d

SHA1
de094f4518ed201dcc2eed38cb9c67f1af14012a

SHA256
0b9e119256e111177fa64fecf82d16284e7b24f076cd1393e0ec5e27722bc52d

SHA512
b26533edde17c6ad46e2b4f131708c1994b239e39fea2317bf5e6a989b5928c41b73950c7da21c5e4beb57ce79a74416ae6a59452a383b404761da31db3635d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9954c559d540eed9528ecbed72c10d3

SHA1
8bf972a56952f509be5ec910745daceb911b3484

SHA256
d57e36b4d9e3dc568e80203aafb8c81643cc59ee41ecc6592f3ef7d746a06c41

SHA512
3b5c54ee358219819d7b3392d4903aa8e65c31839158908f5f59492808e4c77c7d59fb6be69812962955720f1a21476f96f1b7beddbf0100599eb98d1e308f3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b0aeec27134c21b94e0d5a66584784d

SHA1
3ddf1e1f89046a3bbb7040c8faa5745588c0a8d5

SHA256
33118dfc5b3d8948f96b629fd2914d9f64a417305961528d0d379eca6240a3fb

SHA512
00f338a915a81b95f5089391d9728927bcfca4ea58eddb67e8d761fa01ff5861338e41c2f13d4a1bcb4484ded6087f1605c9eaea661368342b2ef9ac4893eb24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c97305515b92be74689c73f7ef4bb77

SHA1
8f19e8a9919b9b29ba6431de72f93b10175c49f1

SHA256
be339838168766b169bd34efee05ad8c49987d87e0cece0725c35f570877946a

SHA512
8bff917c0a6b8702eb9d4d7953cf9107bf67a342f693b4396c2809f927f48e815aa020ff1e8972a983b6cefcb1fc1817ac3bf43529b577c9e93ce575350f3778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2987bf09ff4f510a1078549093ed15b0

SHA1
1594d3db00c48b0b49abf102e98a639cf780094c

SHA256
500d3392716e0519082e7f17281cdfd51e357b4ad75e473e32b099489b3699e1

SHA512
f530449d27d4ea64ed21f085942d9ef3fafeda851685ac6d547b80344d7e55a9217eaf061496bb69ecaa07476336992f9a9e898aa458d7bbe4e8e92b45b925f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
03db22404b39c642e84d485ef2b22b33

SHA1
db5783e04a9a5873480710c56d3f1ae96dfeb532

SHA256
f52061183f9c363d48f0a0c4518279c30e3bb4b693e6ea88ebf099407cd74a72

SHA512
bf738a31344ba5077af1c31b395f7d9a399456ab556d19f4fca4282b1d3edd86f5413aeed2f9194429481f645170b54cc2414d1fc4f160b66bd70fba39757a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6A2A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6B08.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit