3828ced5f79df042c9a4e1558041069214f776301a6bf8f2bb63730a260acbc0

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea8251ad9bb23a2731ea1cc41f60d04d_JaffaCakes118.html
Size

160KB
MD5

ea8251ad9bb23a2731ea1cc41f60d04d
SHA1

58a599823318693d66aa94d6e2fa7630c5b521da
SHA256

3828ced5f79df042c9a4e1558041069214f776301a6bf8f2bb63730a260acbc0
SHA512

c8d890b0672b3d04784d47a29ec88ef359c4396eb442b865c0209a292e10846d7f721cc5fbe9d1807d41298f634988f9c6a4015558ebcda6b20428dcd59fb048
SSDEEP

3072:pFEijZeqL1EijZeqL1slTDut8aNWTqodZhLsC918pqlsMIfTd40xAlYw4wYKdslB:pFEijZeqL1EijZeqLkDut8aNWV9b6fTZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432878717"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0735E751-7638-11EF-B40C-C6FE053A976A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2748	iexplore.exe
2748	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2628	2748	iexplore.exe	31
PID 2748 wrote to memory of 2628	2748	iexplore.exe	31
PID 2748 wrote to memory of 2628	2748	iexplore.exe	31
PID 2748 wrote to memory of 2628	2748	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea8251ad9bb23a2731ea1cc41f60d04d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
65fcc936dabeeae2bb989a79286f81af

SHA1
69357cbb3455f49206c0b6f45d9523c6b4ce4868

SHA256
80aae1f5b0366b89bca1bda1d1353445850b9c233fb34af439cb9019f2ecba0e

SHA512
47de61434a4b16099531111ec8b77bbe2b23c9217f0e029a6d24b4a4ae855cb889387cfaf539f5bbfc7f9ad7c658d14785310e9634a3cb0215275cf50005ab93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_4B65292BF8E4474E2D57D38A629C5318

Filesize
471B

MD5
f395d47bbc67186879baa8a5d46ee5df

SHA1
07e79ad7f4a7c378c8804593e22d9c6d960bd4f4

SHA256
bbe30d891f4b57290da56244d4a1db03915e290fed8a603701cebf69be7e271f

SHA512
7825f8eb311c2bf06dca6ad833e6e9f16d7becfd3c28b51c12016022c4769d8608e6e4030f5b3c6977f8df5dbe10a4dae1f1b4ca7ae2a9dba2423d915f5a37b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_F968CA97A68F4E6D5C104EC7FE3DFDEA

Filesize
471B

MD5
a8b199d725e204fa9db45cf198e23b91

SHA1
cfdb28ca6c3d4bf5873016fdc265d4d54ddbd086

SHA256
f1eddef6988eb7ef72df5c71df7e57aaf2e9097a8db30479c97c0417cde415e2

SHA512
b6edffbb3b072034f804845e9c373ade96b8ec6c42ac9ef819c68dbd2840f2a8728dda9710c98d56a4b59f9736342c46edcf1c646525bee6eb400a545d8224ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
fecc770509f8e86299ac9bb5319195b5

SHA1
176f313afeb4d376840ed1a1e45580e13e5a31da

SHA256
d774e86e2af9144e22abea336e10f5b98b8e580748c97da5209a4e0122855db2

SHA512
ca6666f064ed40739f2bd316f1daad30e13d95571baa0ba3e2c2c28d54478bba099e57d24386174447bc640b6f808dbd1dff7469d0de71bf0412114cf1b7db74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
a1f435be095bbeacf1a955ac1461df3d

SHA1
bd7be37e800e3ffadc67aa6b778abc7a92c0b02b

SHA256
26a489ac449e5876c14c200b4ff6816a3615a25c95a3097ffe2d4103443ba53e

SHA512
e1b226e4cf7e44c752c07e2e7ddd29d8a1bec1e6c2df49ff0503db418185ff441ec16d6d29adec48a80424754113d92d4949da76c43b68a3f8750662dd3539ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
bc25e1b95a05c1c996782613d7d4a12c

SHA1
00ff776fde1b8e9c7070c5b820025cd5c4a27cc9

SHA256
4a9741a16dbe34b98247cb13b5f0da129fb003fe4c166360ddb37e093c41ab96

SHA512
e374a10c73dca9f0b35945c20d1bb558d1203fb2b1263df1b538af53dcd8a67a0b43bae145104ed8bfd292447a256a0e16d28c502b4cf3d376ce97e2405fe314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3186a4b2a7f218ac905377326cfc66b

SHA1
55a948aec26b5b80a773693b65404a83f33602be

SHA256
5ff8579e74a05841e662c90c413b350e0eb6597d78fd6373324320c804d15c00

SHA512
06eef90bc662d42f000689ddb1954976d3abb7674f56d60fc34937dde32f57a3a1bc7ea519266e85500df73d2d9d8681b7b370c2f8489ecc41d7e6fc7760228d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff9b24d3850f4a4c4e9c99b462e673d3

SHA1
c26aa81f1c9b7c5abc630268b56fee1a5c568015

SHA256
4703093f5a29155d2d77248688b2fdca07870b0cf5c6dc19b3f5ded97b577f79

SHA512
a4334ebac7c62887282512a3b165b1322af05a8280f530226c7ef6e4ab3247837d2848f1eeabc64ce8accb14fdcb32d8264c426a4b0191b2c9bb4ce57f23de65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69f8101fe249638a3f0278884070e2f3

SHA1
8c1d710632f9401bc129540ea8e57b9117e91b95

SHA256
bc2c5fd4760da36228b863f0b3e0b6ea72e83957a63f6b06a46f2e4c8403bba6

SHA512
3fe44a19e1eeb8c928b9c7a221a2ed4886b6a1eb73c9bb8e2b4867a741f28a7bc1373e81e132bcc79f1f072d67f00c9bd216dd09240944ea15343186fbb634f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b31d935d8ad57da37da7f1ccde0db5a

SHA1
ac7dfb983876d6bab970c6d87502adf4dcbcbbe2

SHA256
ef6ca1126ee78b960e78c65b806ed2112f9698206bcfb84d21a83b095eb92edd

SHA512
0b6a23ea58638da077b78628fbfb0f1a21f99452f42abfb3e96df679971f237e2fe5a83b91c1039d6a684f7feb8c6d2818d091b272fdf7143cd79e78ef046f3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee2e3cf1f579cee75fafc2edf32a9442

SHA1
6906b700724bc8c3724cd49a22e5e8523caf7efc

SHA256
ef8fcd997a87ecaad0c4967d024b0c453907f931f7c7cbf59853863b1b752a9b

SHA512
c415407a42f12c48f06c1327601b2917934746e0a4c848622ec33caed3c7ee01f7cc48f7f54a7f876c882340b5696f6cdc6fd7e4f29604bd45888547755cfa48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
539f210ef18bf7ff0efb7e25840cd0fe

SHA1
032465e690c118bdd9e8148616e9cdb053cb1ad9

SHA256
d96c3d0cd9d5f85b5af58b454bbfa5b6e2921536afbfac23967f6e669e6d55d5

SHA512
5a44a242de2faa391afe5d39ab9bb9d557a78ec9311d39782dd8c876eec05a9ed514639cacf29b19fa815948b65e7397d766e0c2a19236ae93eeca05a1e35513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04ab31e5c91da789b7b234f53325ee12

SHA1
32c02b6db6104f8b49bb93e871b105d82f396b4c

SHA256
cf583c64eab8d70f1c0c7c833732302d4e942da42a9d7e0cf40e6f515d6228ef

SHA512
b640f2e512013ec9004c01fddfe37e286823d2d7290c522fe132c19548c0ef4e22f5e238a820957a15161ec1f54a11fddafa30ecbd5bc53ccb1210a9c224d661

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
027b2e4311e2f7b41e1f7a1d6678618b

SHA1
819ca0448ace5850af6d534222b35d52bf6f3e3f

SHA256
71805a34df274819c103455409f200f4cf044f59a7356295497f8c8e826746d0

SHA512
2e327b2bb20a695b99f59e0182bb4c9fc00dfd98865c403dbac97d07001700bfa570438d997d6539c0239f1ddca38066e91f36c19af207aff00268f8a24120eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2160739ed0eb9f18780f82c3f9e8b5b

SHA1
4cc9360e597882c75c6c94eaa613af09ef7d455d

SHA256
231711451654d64f5f0181bad6841a47ca8ad64d96f7c1338c25180eeaad1f3b

SHA512
e3da3252e631508f942f0c81e763a3ab6c3caa084cd185b1a810cd0b14e52f58cf6f453a97f1024d81ed235f665e043ea809bdb69ef8601240767e3d330b942f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2073c3f523c63739566d062ce035cf4d

SHA1
9285e24fd7f821afca2938199103e34273ff5832

SHA256
da62591093c57f3736db816aff56e5679b90c28db2a717a2dd69f76c35d766ed

SHA512
34aabaa6905b3c130ab4d5330080b27736df873c19ca57c1bcfd1804c43bf754b64158cb4fd6690e9bb86305b3045becc5eb13659e1ed558403cf4cfe74616b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_F968CA97A68F4E6D5C104EC7FE3DFDEA

Filesize
402B

MD5
7f93fc4ced86221143f6b1b42a50c1e3

SHA1
103260fd4a55e14020a93d1d0626454d429a0178

SHA256
9c1a3399f48c657b7749e47890f8c9006fd93a36f499b0ad11dd5d473723f316

SHA512
5dee14ecb62e8f0c061c9b96709440f0960d34e9c05ddaa3a2f2e387ac84a40ded8caf25704a7555557e56c5d6b12dfd892320919e7a1c47352269a4af114291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_F968CA97A68F4E6D5C104EC7FE3DFDEA

Filesize
402B

MD5
a9edbadfab84ad21892f03170caf7311

SHA1
3474df9e6ba35ced0379b8103a5ba387639f29d7

SHA256
87befa756fea8d56e00e7440acc186bb87f2a0124d2872ea777664b21c197080

SHA512
821b4f7be5dcd52e4cc230b7582e2dde40a77873329dd9f7d3912b2031b12ed8ba1093488d1b81ee578eea09ecaea8315dee24ebfb5aa78596865e6d5cbf0031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
00ed981484cd82b7a4300fcc37c6880f

SHA1
642194241802442f86667b73c5e5644977e9b50b

SHA256
fc0a412e011b2183857de2b18340aa2c21ac9c6179962dd996dfd5ad5b4d3347

SHA512
181ee1dc42d50459dfa81a74810d2c7f46cbe8dbe086440348d39c9dadee5f86e7a2d00b05ed3e6e3548151bc857630a63e30cca2507656bedc94e5c9ff1666e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF660.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF663.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit