909794caa3ac547a507531b6e4d503f7e6c8b7c862f1ec8379c7cc3e454a45d1

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce26368ae1f93c58a6d19a4ee0c8e941_JaffaCakes118.html
Size

37KB
MD5

ce26368ae1f93c58a6d19a4ee0c8e941
SHA1

3b815d887d8b072a803e8ca06963bbb0e3f1a4af
SHA256

909794caa3ac547a507531b6e4d503f7e6c8b7c862f1ec8379c7cc3e454a45d1
SHA512

749f60f951f25f64cf88c910c1d4e568d9fbef7ca77aad1d1bd57928f6ef9566d44e8a02ecaecde7e7ba2c48325b383d1d59bc051460143e389d8d478a42e41c
SSDEEP

768:B/bVoRTW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34api6781DdRA4vEOjq6h8at:IRTW81D4RA+vEOjz6raA7IaMC81DdRAW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8FF0841-6BDE-11EF-85C5-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000c7bf4c1c9c995eee615b046c8ad8aea2fbce8d79a0451d1ff32f5a164c59cd8f000000000e80000000020000200000002fa0a6e970dabf010c30b31647cbc7ab5a6348b1c4773cc82620f64751a2d2e690000000d3bbbf93e508b1d4e4b0d1a5b6b5e2763686dd29aea1fd47661d36c3255d6a514cbeaaa1b798c8d1928a9ae82b1b713e8bd6761721d7211d30e9016ad473d1707270fe11019300ff080be6981135e42da9f1b62b8d251f7717d53e64977c9a99f8bb776e49deddcf8d933a215f136e866066bf420fc1503f115f0bbb1c05f91aa0b32422a766e415197d1ab0ffa8eacc4000000053479ed5a2ab4a0a8586fff4905e9cc5dd877e371ea38e44066d6d482d602177c5a97baf84c511ec9b7d2af569786544023e2ca128adc5a77dabe4dd5b3a1afc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431740848"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000030a34e04b0cf44ac1d5e620bbe2228bba4deb3110a87961bef47811f8b788410000000000e800000000200002000000099ffd6ab2cf7cfdc614c0815f9c095b8e66ea65f8842d225ad3e465f45686e6e20000000e5c79b85d149c62f4212075a17574b83e792f02fb361ca5ee65074cde7dbccfb400000002c3a1f429f910e90b8eebf63cea08bd2eb5e95f161df8e6c754137c5e5f570194346238f02e37f83f1fd1547b8a57ca9c3453a4f82b60788f9b2b4c83cd61082	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bab29bebffda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2532	iexplore.exe
2532	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2704	2532	iexplore.exe	31
PID 2532 wrote to memory of 2704	2532	iexplore.exe	31
PID 2532 wrote to memory of 2704	2532	iexplore.exe	31
PID 2532 wrote to memory of 2704	2532	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ce26368ae1f93c58a6d19a4ee0c8e941_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68b36dc8f7a29a1bcef594f4bd5bd163

SHA1
5d4d30586358399a86c32952619c96eb20fd14d4

SHA256
3453abc79232b0376a1b9d66d92ea432e37ad4854224885bdf1569f6c9668cdc

SHA512
f808fc433e4b697748f92f23aa41ef48532b539e80624f48776c7eebfc47c8b8de0e4323001df0db7152c79492b6013b7faebb39324d60323bc074ab4be96038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83430197407b6c2e83bb94701fb3e62b

SHA1
77bf588d48469017c1bb463bbc0b0304f535a1dd

SHA256
c408e04ac5e88259ac53d7cf14e2760bbc12816670614783e81eb109d2f64645

SHA512
f98532c5fe902585b587c57f3fb9f3bb2bea56c5876435748b5a5c5f54b23d2ee1a453120a558b645969f4e65b5a7531b088cd926d4844a2bb37836c118b47b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36e073736543d09c7bb5044225dee43a

SHA1
e99a3a0fd6ea1f25620910f2a114ae072b0fe661

SHA256
31fb779d5f76de38b76636a16aef886e2f81f8c4503f70024f37a226bd7f9b68

SHA512
2970fd8def945da2c822b0fba0550dd3d9db20a9a730bdf376193ea17615986eb0566c26d1ec66027b98129f25d1b4f268dce67abed499fcd70ba42f781d1fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9ff77a9d6c05bdcb4a59dccec180121

SHA1
7d05225e0720c46091be20f90fca3d2293f042b7

SHA256
8e83467711f769618f39411c297b7449dd838aa2c7015426f082a33c685156a7

SHA512
ec47828344585ba1a2973ce151ecff3c11c8f9c464d8fbbe80b5cb8b8fb00c746ca8e2b3058d3825704dab8fd38d6dbcd87e9172a15b65035e4042556b124806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be748175e7c28401f4ea010a49f89a31

SHA1
06b406e4f8eb47bc9ca84373324b425f042d0124

SHA256
950905201a4e69dcb55a2a688ca9d1cf9d32d376a801cb69910bff242c6bdbee

SHA512
9ac21d8316d1204cd52acc5e91880749171f69bafe60ef4c1b9ae5afe0e1b0dc6c1751d5bf3b0de9038de50f801ae317ff013fc2be5b8d77f83c7563a954cdb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bdc4fdf2dde568773640d7ed7af3e65

SHA1
e6b6d6077a9cb49ce5ce90201bbcc3d9854d49eb

SHA256
e8e79bf76be36bf8daeae87c781ed6c4421ba4ce924292b15d955421262f21c4

SHA512
448312f28920d00c87979bd4afa686406bec0ac5a2f29de45b98a529e777a81ab5ad5c44a18028c7bd11f4fdda983721f07e7b14a93cc3dc8c38a136f867be5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1830c455605f0700aa933724594527d5

SHA1
7f6ada84e35d7c3f63fe769e70fafffa1fd6187d

SHA256
0e5c3411810fc1d8a1fb815c57afb8d591a95f2258cf6e285b129c07a49992c3

SHA512
88cc3a76a0e098c4bd5661eefe7f301c8f94143ed81713da26ff71d14f748f826d9bc1305b8a6a242faebc1414a16ac7659ad72a110ff072b7ea2e2d24bb9308

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
890e79d607f1ae4fce0d0f64e7cc6334

SHA1
f60c27e999cf0c3dd9e3fb722e53f38b5fce04ff

SHA256
7808ba5b091e2700ff7b874cb984c8d919e5101230cacca2f58687a91a5d753f

SHA512
e6486df7c8736fd73bd3952e58eb8e4518b74b57d571a510640e4d95e174756220bf788b160f13779e3dd27c927b07a0230663820b51ca8479eb095e61222391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ec6008971c194ec43d8130b9eded311

SHA1
fb86d5952f4a6f8283318a3894358230bbf716e7

SHA256
bd2102b186d4a5d151c2191683f6b95966756a493fede6324e613c3f701139ad

SHA512
0fd020378f37751cd74349e5b6796a9d9d951aa7253c14387e5690408b2974322810a1fbf2252741a3a247d7c924a6395c9bc67cf183526018118ec9212f76b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a66404c5303cfa48babef35cbbd87cda

SHA1
aedcb7df98eb5ede3cdaaa2dbd9ee00a327c3867

SHA256
49ed2776de4cbf13190817fed10cd512582970cf919817911de3ee89818fc8fa

SHA512
bc6a5ffbbcfee18efa6f25beb7c67681dc826adb57dc360920a8a47ae4f4dedd3fb7f1556a9c2fafb7d0ee52b9389210a3fa1ad086f27ce076e3e804eed8709c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41c30f1ed9c670b19bd633df29cdbcac

SHA1
a9f18a914a01b19a7b7f6ab9b8af7f8b480afd04

SHA256
fd66a50a21734a645526e06eab8683799ebda87625f8754ba45e13a0825a0db1

SHA512
fafd4dc7140a1267bdbec0031019e080214f950c246fd8995add5817b338ce7787898d254fa09de8580e2406acd10a1054b1c1f45d7833c7addd9f981e41b549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04faebede46d899eaf25f6fe8e49553a

SHA1
3ba450573913bbb5a478a47ad7845736c03be22f

SHA256
e0f716603d4229a472d7531425d56f0f801dce7dc31a4bc28e9d60ab95fe087e

SHA512
835bf0776a3b13f764ecc4ffcaf05ad4d92302abbf8dc2c22c03d03fa43a5c5e5a7375d81841557fec01c960bcb9d55ffc794caeddde7bbe9d331637e16b83da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89ced28960559de8295a26ccff2d8353

SHA1
8053ff9082dc6cc5a33a66f54b550f84b3472aa2

SHA256
9f74b85470a12df075888f910fb55c2a9806815d2f23cb35e195a2579a71c239

SHA512
b39976c0788129b9def74ec9c57d99138bb569226c0f547acf9a9c616eb362cc317c3b270c84b3f33d6210d438f5eea6479357e27450d00ba740893b873c5798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50671d7616248c7c6efdca7184bf5165

SHA1
3b5ad01861c37ee5a3df9777fb8f68980dc9d943

SHA256
8e56d8c96fe5761ede775305bfef818d229dcfa0d76c277c0a220878979d9bb4

SHA512
aa02ca9b6bfacf9df41dddcd07dd5015d24c4efad8b11cffae5d913c83f653f8d79e5335f0b781b699ecdda32e5e41eb0989a884307111c8b84455910d23c09f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2844e3da8d10777a842d01e50b39fda

SHA1
0e8d72e684b06db3bec6dcc78fc15e70c40f2b26

SHA256
6b0853ce22f6ea0c8ff9ff343b8efa8a8d3eabd8b4a063d0d82f578e64f6d90d

SHA512
500464a7a61a3cb1bf3582816c6d2d7cbc70ee6a291b3ae2ff8a5fda93617618b843f19723773dec3dd2267868c05b7eb3e8911185bb83ed4f20e628d4e0c21a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb31b3350de4511f5914145f623c98b5

SHA1
e4fc4e472667bf44d13a9ef6e830532d06b07c5f

SHA256
b7f860d600b2c3b6b317873d3d7b71db4cde3aeb4a89a5f979c55d4fa2e880e8

SHA512
9afa6425639f51f33a4df834c2804a8be90c12401d54b017c69d260bea3c23a371cc00a4f968c430a46a22bb27781bef15fbb6fd9d446e64fb64f74b1301d33a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82f05af42f50bf64ecdd36d487fe8bd3

SHA1
670beb52d2698eef83d49946f580c32841094b93

SHA256
74e9224809656ad59ae74d9201407ee7a85e790a2a75d0a121cb444e521b98d0

SHA512
df2afa9823f2d82579b3cfe96ec9f5c0db7ae1649f4aa7bbb54beefe047d871c1ed0a374318b8aa61e30b1af68569bba92e2c50f89c232793bb833a864a9d705

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19F8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A60.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit