5a6c550241de990b2674fe47677d3380722bfd5dc149f3f227a739172c395f38

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dca0ba9bcc5c2ed0fad80764f3d852d5_JaffaCakes118.html
Size

65KB
MD5

dca0ba9bcc5c2ed0fad80764f3d852d5
SHA1

c7b2349ae8e1c0a525932a10c3566b2e0e8bcc1d
SHA256

5a6c550241de990b2674fe47677d3380722bfd5dc149f3f227a739172c395f38
SHA512

78a265a909e17edda068b33cb7652c991440f0c219a09cf49815e44861ae41bce7ab16c7200f3f9d018ae02b3a0bac7d65c0a66b9dd71c4ef75b3a835c73b537
SSDEEP

768:JiPgcM0St8tN99OIsnjHAP15hoTyrhCZkoTnMdtbBnfBgN8/oycc8QFVG8sP/Ijh:J9+Q6r2Tugec0tbrgaCcFNnzAC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB48F2A1-7125-11EF-82CE-E62D5E492327} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09285813205db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432321075"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000795a9532d5570c0a3e54689fd054ce26d7adf6c497bfe89f3e98c117f5cc0001000000000e8000000002000020000000f883ec63843dac0cb1007e91e068aa0880009b254cd619f1c7bc3182f4b8e5492000000030870a937872c6e74cbf88d5fcf64c8305554f4963aed098f052b3fe91f0bffc40000000cddeb608a31730db1d63450390685c3cbe060c6a28a72ad1158832174220c991dce8f970bbd48c0e9f54123035d921b4b983e08f361a10634924d676092f6f84	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000dd98a0b4d5d2bb62a2e320840035cf8722ef1df0b7e0c193ec633af5d627ec7d000000000e8000000002000020000000426af7c14eed439e2fcc1fd631a1651c5734cc7be48991165746bbbd4b94784490000000f7e4ec7fef5498c34561faeac4d145542b56b387d97a024907f6899fc153b499f2667e5ddad1c58956bf2dd05b6086e9cc2a217a3a5bf2e308c057f3143ef44123d137c1708c0f4a937a7b6b64e098240c0b5a92392119efa25b694359b1686023d1b556c3d00c52ea86f007e12556dc842b0ed8ba3bb59e30d7a80efb35d1a9aaa475b800de11ff77c2dbbf4fc0451840000000369f72cbe4bf7d7c4c6b36e724d962ca82847547c0901da1858b7263cca495f026a7b590337d5119e5813589c8c4ec6af0c93f284eae656b4048eb7bd6a88cd0	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2992	2988	iexplore.exe	30
PID 2988 wrote to memory of 2992	2988	iexplore.exe	30
PID 2988 wrote to memory of 2992	2988	iexplore.exe	30
PID 2988 wrote to memory of 2992	2988	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dca0ba9bcc5c2ed0fad80764f3d852d5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfaf1dd803a1ab5d753680bdb5cf0608

SHA1
d31a4786ec8dc6a33c2289af8e676232bfcd21f5

SHA256
d5379574b1abf2f4496f40ca5ab070dc15dd4dd4908efe463fe69f89da156157

SHA512
70c110b6c9deb81bd93b6ac05919f1144f20724fab0162c1ee3253dc527cfc0841b0ede4a7993d8c2592164fae2c4a941f64b1014f8d70c4510de48924e45689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
628de8a4b99a4425997612be10992f1a

SHA1
25d77835ff6f4635f921c8d523f829b647589aed

SHA256
040fc873da3368159c2709fea9a4592146828bba59e973bbde4ce759b866cd86

SHA512
cd314d4d26321a00a9139902a169bbff7187bcc9f4322490f616e8a0cf56afd0b81f569a3c714acf8cc861e653522eadd42a7900077003c98d30f794fca2d3b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
424cddd9bb4a96d1ddb1cb61ab0d38db

SHA1
f4a4606a71594667ab0c8a231101a1ce9448bc0b

SHA256
bd858ad1767deed5dd2ae59af1a11ab4f9f06fa0ea09eefdeb92f9e954877ea6

SHA512
2eba76c0361266d759f6d6308a3b58c2fb80f867fbf3fd98f9ebe005ca89ffb7543c628b7e2c4d18cc6c8503976e3044bc905f46819847ec80a93d28676ac95f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
218405f20dec4a6eb911e8dcaad9217f

SHA1
791e1f4e96c33a971438fd8e376215ad3ae2a51c

SHA256
0ba138d0d598ec1de111491fef0565f6ea45df6b33868d76c04d9f9be7bab021

SHA512
db584002c4ab95d245e65f9cb6d00eae5141c221b57a98001c4e44d64aed06fedb790a5b092ae5264fc8d1730be0640c71f29f98279801cc2e2101864d4ffccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e96d73e6c230c8fa131c1b117dd883e4

SHA1
2fbbc90a240e583e68adfcc2b06e4b5653874b15

SHA256
971398bf833a70a99db77369a3fba9d020f60e0e4b673767ec10ea0d56df486c

SHA512
d7f0425547388a37cbbe279081f9a4a944e24f406ace98b958b1cc66da028770119d45f4b4e6a2a47f6b43e5834964c0a14e0d264bb1920d1f494be275d63650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0fc6aa3123f3e046b0400c5d7d6433a

SHA1
c1687a8892f05a42ec9b27d2c305a2a4d547541e

SHA256
842096d608c6eab644103b5299916c1ddc19489207805b7730de8546cc00a4ee

SHA512
5ef7c5ea2ade768988d1920c517c8a0809420717a5c581d52410798d940b7c86aaeade687ddb2822baa85db9f0b3138725c03a836f1e6ce945a20b32206c1b8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67fb379efa5e715c4abc94667b4db6a9

SHA1
05804cbd91fa3300f55adf38776b6702ad39dddb

SHA256
21bc0b9b113e1d0d1daba1251ab995dbb0e9199ce8a44dc36b5753a0f7a771d7

SHA512
3351230acbe1c4a25885d0d37e2336159eee7c256726f4e8fc83805b17cd3903ed49ac3ab6bae3de4c9c1b1f88263a3709d7770cd80d157fbe8829c6a7ae855a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1702e769d53a025583e1b725ad346c69

SHA1
92bec6907b475170145a4f169a0481cb45cf13a7

SHA256
5dc903004aca47f1c2955a72a90cba49438b912bcf973b6c6d22da9a09e3c77d

SHA512
b03a89ff29753fcffcc33c43aa207cd4d2fd5de0150b92d5f2823c87e1ddccf3102cdb24998044cbefb37e3b8d17a4a7994cbf3d324c32efac0e253916489837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b8c1f3a9556234397cb4205c508df33

SHA1
ca3e8264d99673c23c7ab5252669a38889576c38

SHA256
66e0386df81cb47e55814e201797d85ace684254df8611d831de165b3322fe7c

SHA512
114bda424dfef488ac5428fc16edda71c7f5413f810f4f09b260c9c9d1aded97080ac13bcafcb64d4a3346a8d260da087d1d8e5b4fd5d9ecb72e9bdb46dff4d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b2cca2a0ab80a880e9af6af4755120c

SHA1
49ae4cbb354ef62a8a2b974036f8e99bfc5af919

SHA256
dc4dc4a53fef06fb29c71e9f30615e74a0f84bf7a85ffaf14677b5d49185a08d

SHA512
ea3dd41f6da6cf47b71bda5a3efc214f982c0d2c837dcbcd797e43598e284246d0d3c60e3a87b67a60eadb5960d5efc607cddf03afee95c528e5dd6f59cf06b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
753582f392f46eea5febce100cac8d61

SHA1
65fa51723bf16cb5e67a7a9280a63c38ca8f2242

SHA256
5d672ea23d2554d604c7f473e9500207a1699cd5660925aa4283a6a848bc02ea

SHA512
8d304444446d326002c97c5f796ad26e9bf049f84d75a66470f061af29c5c4d23ef5cc3bbc3f9b5e086c8fefe7baa6854fde0ef6469dd91c3b7575d6151b9af1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2e172effe001fa65f0721b7e84cf173

SHA1
ec828e83903bb5c47d4a37e5fbc4c5bea4c4ab02

SHA256
100cfd57204a4aa8f789e4f4e8bec1b461ea48a05e5182412c5e1ff7912bb84b

SHA512
305b5e67ecdefae86bbb75ddb7e65b413b952951181b9cf8bb704463c2e6f53f9e79da4c690ac2533406c5d89ba82790b65bcdabeb31b154d593f62409147a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05b4959cf587632cdb9622c2ff0b96ea

SHA1
071d42ade50166f03647608c900bef9a3a83c3e6

SHA256
2abc2f785fb7fe5131ff3ba47aa2fa5ed2143c16b31245fb59521f50824e276f

SHA512
1a2fbba7b926231ec4fa759b62e7f3c6201792378f63393928750c2059d2ba911f243a552d839ea245189665c8fa5dadfe824d18d1888884ef5b094a68bdc7da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71ca5dfd3f9e7e0bde0a1e4852f7f7d7

SHA1
432e166ef7b959328ebe91df59ce909383eeb8b5

SHA256
068cc4220bb67afa35968f5041cfb3ed09c7fc58e0fb7b1274798a6a4b485140

SHA512
7b118b2755045ce875dfc312a7cd2772e7def584fbe49ed5504c64aa1bbe442733fc3b4052b5d2995f7e8c90260b1cc6bd789730d3d1725530c76e8261979df6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96c841b0300f26786c6413eb68f9a64e

SHA1
344332da552e0375553c4e9324488f7ba2069d31

SHA256
d251b0a8cbf2787e6d710a6c273853b7b6cfc69438b14d3b5bfc1d187ca64154

SHA512
761e6c91a65205b57bbd8f0067b3764d31ca1d103cb097035bf9177f93893e6951533c2810134aaf0def48c787badefe0e8bc41ee87261b6e6798dc509f13f38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02571fd08aecb75e8e3d479fb6e9ffb4

SHA1
6b7ed566e5bb2ede8ae400a75f79a777cf1babf5

SHA256
7d5f5cf80ec55a44dd796ec6a81ced9f76e6172c1f423147d12c388a78f88a3a

SHA512
321fa6fb13966f59a667c678433351248dbeb04b4ffc1607eb491045fb48e9de9ae6914902edfb105176f74800c7134e0ac568283f6dcc42b82d5bcbc8379941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17bd90f9c0d68a198562d71676ac17a9

SHA1
0e9143c72bd126ec3a5a61dc9a05031bf282ffac

SHA256
7418d39227deab370ec35d768439fad2969b70a2dc9418b0dd51e3d4a612d989

SHA512
b411dc0435e48ace2234e4585306f0e37c274c1b59cf22b147cdca8ee711633b4d37efa2e922e255f407f4501242e53b909e22b264e3391b260dd021b1bf4869

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD200.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD2C0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit