8115567495ccbf9c4b213d90801323538ec5683546347a881c50b5fcf06c428b

Analysis

max time kernel
137s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9a692e2a2fa4d867ee3b1a0bd7fa11d_JaffaCakes118.html
Size

13KB
MD5

f9a692e2a2fa4d867ee3b1a0bd7fa11d
SHA1

1e4b1471ea9f4e9023099d287d4b18ce1dc71905
SHA256

8115567495ccbf9c4b213d90801323538ec5683546347a881c50b5fcf06c428b
SHA512

5fed80fa7c4a714383f724ca448a78ad6a830dc425e5fc0d1fb88e0a2e0c2bedcdfc5a3634a9c808e9f45901f0e90593bce3c6035cd710d0a2b3dd1787e993aa
SSDEEP

384:3RdBXS6uiUo5fhxDM/jIBcrk5dqB13dR3kGCOTZGQU:BrCUH5fbDsjIIYOTZGQU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 905906019010db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A3F53C1-7C83-11EF-B956-4E0B11BE40FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433570697"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000080a4c0895a9c6b0e383992678d12c18ad78514f0a6be353d7c548fde6face72e000000000e80000000020000200000004e11a0a792604130721f63c65445d0404a2451fcb15b6fa56abbca59c3e891eb20000000a78c71dbe3f9a86fb4d6e83f00eed73ad348f4c1fbca49a2d390333ff6611fc240000000c51bc0d5a5c96a86cd77ed97551bb5e38e65df896da97dbf6273ef21afc1e5d636052d0a17606f409897b2fe6a84438aa33e70f00b2884afc222335b75864873	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000019c157653b736cb240c5312c63a1254a3d3dc6fb110721ce9dc58238c47768f000000000e80000000020000200000007f28c30a89cb59a03781217283ea356c41d46beff4736e70e7b29d7e776b8dd19000000086f6ac1e40648183087c1adf9310cb9c7c4e2afb8e9dbc0f6e8195f310180c63345826c73ea79141807b94204a39e4d0a4ee3b6f7f03477c71913ba1e1d563c99f874655fd3340b94106ca499b77e705f46f5b982f423a5b7cb4901089e0a5324881026496585cdf59793e3f36f43ba0ba5c2c4cc74c153a6ea8278fef603e9fee63b4adb67fc3dd500231c1eb586e1140000000e9955372fbab77728eec1f93b845410cdb374abc67dbadf81ad834e635dde94a24ef844ab8faf87bc764a77c75f651477d7659bcd422fc43b91cbedcae29b0f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1120	iexplore.exe
1120	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2824	1120	iexplore.exe	29
PID 1120 wrote to memory of 2824	1120	iexplore.exe	29
PID 1120 wrote to memory of 2824	1120	iexplore.exe	29
PID 1120 wrote to memory of 2824	1120	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f9a692e2a2fa4d867ee3b1a0bd7fa11d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1120 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1662f18e80b42bdb52d724439072cb6a

SHA1
1c6803fcc3ca3de3911002a4be1603981071c44d

SHA256
e719cb84a6c9bb8b682ceb57d0957ef30c6129a9e57a5d5f4e2dc73519d00cce

SHA512
8f0cd584043dec03992c5f71b4ca4ae66058cb3c46425a3848d17ace033949cffcc31a2a0eac528594c78098a3ae52ec45d7e09c03597bc044e85877d3a8bded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
279868eef54ecf219a626850eb5df833

SHA1
f8ec0dc3f09f3a7c7e689b59fa3c682a7382d186

SHA256
34b0f0fd1ac05da1882334c5b8c468750816f715e710c0a191f478c3a4d53950

SHA512
1b61a3e216eb7228f92cdda9237028cd73e201007a1d52a07cb88ea507d0f8d274d82552d957885c108a79d174a941a072711db567916985ef345f7450e893b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae86f50f89ecd931b97b84df4ed81558

SHA1
eafdf9be5caf65b7b424023f4b054b416c329b09

SHA256
68669fc4f0d522f7280dcfff049f2e95b7714d497ba687442c38e47411999d62

SHA512
5dfe72a3da94d772096ee45fa6863e11f0bd753db97444194b287c2ec39cf554a01e6f44714e3a7ba6d4373dfc7539aa6cdb2f0ab9c55629fe3dd4fe4b51558d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b96ad07a051b812215797651265dcac

SHA1
17e1fd6bd17bd063e188b46bdc1659b3d2312310

SHA256
a3f9060eb8b0f8e644c97d37bfa3efc80a011cb3d294ba3108336028511f0e82

SHA512
d0b06a64218aeea5da1f6165e79521ba2a47d0943a1c1c69ec5170aa19b1e3edd82b21e31223e70c9f2fb3c6b55cc9fe0aaebdba71bdf2e2bdf323c04aeea5a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da837c80bb1f65ce144fa171ba845d6b

SHA1
5584678a01cf9cf5653693e3708c8549934bb321

SHA256
0857066003db6049d4dcbb7694bce22e773da5fb98a19602622d61cf8d8fc85f

SHA512
e4942f8c0fb1b3e36ec77aba5a4aee946b93c2a868a3cbbe8553fa20d723ba9c31bb85569d4aeb9f236def4c5afb058e8b977a39d348f59b0d1a17347761274f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff1217a6a388d478337fdc756ede93f9

SHA1
9923c1f9c46765650d994a9b99f2f01bb1e6aedd

SHA256
7872449b2e48740272a7d25efd44357012a21f9c26ae72723a1a272e4393ce9d

SHA512
3e1d1b1e8103335fb75ebe2740a60d7e67c2dbbc07f1952580d6872740e4a4d109d45a0764c5a16b4aa0ad2671abd1c37d0d2d37c3826cc732978664a60de732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c44ed4bb53bd9311ba72df3952897107

SHA1
2e75ae1c5f50af79bc5d9b06d5e52917adc8e7c7

SHA256
b0f74ca4c2095d939ab6e22cca1ce3a6beeb0c42f1c026b576fad777d2c8cbeb

SHA512
373e4ae315a9991fd49967d9ac2b4fc546c182383a96dfd4f762a19b9064fb1e1bd7ad32d7173c181797fe9d48caef00d3bbf31c360116fb8d2e49b92a1dc8eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f18e1e70b3cf9de5ed087d336af1335

SHA1
9f961464be131f4b84928ba3b77dff0e290cc7b3

SHA256
f2224adee89c774cf956cb558c53ae1003a088e0ac00cb6670a35a327ed10d75

SHA512
eb9b25d9d4267b4031abd6831c26e005b50403bdcf4358b5090cb0c8f20302700b0691381c22875cd54500821d6ca1579beb9a31821ca81c2d36030498b2200a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44bed4fa2f76fd49df23fc33e8d5a857

SHA1
ba4113b0be55480a78e07866481bf0aca9363015

SHA256
e49aadf301253496eba18a95c3151eb4ddc4d3d0d63f9c9348b5141d51d2f940

SHA512
b2d105152350a9f1296571233fe971ba0429d526d1a5da52cf23eec9dc93210bdb0029d66d698c6e50321d2449086e8769f7dd885f0213c9dd274076535f6f1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aabba88250393d188bb73f1dbee49cf9

SHA1
c4f61a49635ca3eea028eb600b9063741e382081

SHA256
78ff87913dbecb09f75370542163a088814f8b01004bfe7322307db7841d6e26

SHA512
81b77dc8e14fbf567add0157155d7549f1bff234988a55790dbc5d19bc02d2311c9dfdde0afe4c4ab9fbab175d4c0d95f0c3470503d7c96ee7aa874f0a0cdd9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
646bd357c80c7140a0804d5f182b5cd6

SHA1
a6c475079cb69b183c34303908363b3bbd1ce9ce

SHA256
902fab54bf27ac5de41d7d11d98ca0b076cb3b4d43ae88bc2bc432b4411340fa

SHA512
120f04b6ce1c6486a0670d6d276b53812371257e06a9b8e030b6ac63330fa7d2dd115d8f324c87445995404fcc7bce65a52c8422589022556b3f47eacff1f88c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ace06188fea4996c393d6bb34e9a3bf1

SHA1
6040662d5e58d4402947f3f090ab9f5ffbae1799

SHA256
eed052c931d2572362bf480d7ef0319a98138ce4d7b1c36b25b94e04066cdfc6

SHA512
0627abad929421eb6b74c5a99ee4cdc97c4df731a096f2dbe3c892a7d83bebc8df355b3684ad1d211f62bec84f46433cfd61acfad1241cde5cd451db76b4946f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
226a52b254741b7784d8e55a2484add8

SHA1
2774496e1dd23ac42de8675bccd24fc3a8306085

SHA256
98ee4b927b9cc987147df9e20e9da9e0572899bfce68c673517c7751788923b9

SHA512
1014110ec4a7ed3d262d06eaeb0b88f22550a4b340b73ff50a7d9cebf771c62e0f8d2cf9b28fa624669d09a1cc1d262a4bad415d5aa1df7ec81b43db1b8d9266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e09cab6b588e7b89fc27fb0150ddb561

SHA1
3b96ca1093465fbddc393819e16ab2031baae0b1

SHA256
b9abfc395f1b4c178b7b55e9787c00279f159974c7f1f5fb8108aded3ca8ac8d

SHA512
9516e6c2254128d1a1df01ee9c4be49c40e1782936c42393b877fa53f8124ec66301747a73299aa5ef971d9f864595d30abc71b61ffa6677ba5feec8c60072d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2440d9a0018ebe0b087030d302d9686a

SHA1
b892930f1c801508322e1646a6ad938f5545716a

SHA256
f5b7392fbc820d73ffc1588e152773984e4a543dc37e329c51ab42d8bbb452e3

SHA512
a51c6461fab57b1ff77e2729687e6149387683ca7f98b74954ca34bd9144c79afbe8bcb69e531ede352a87ce529c94d05c59c592ba3c8e18693788e598286a9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
370d052ed66c5462df17728f6e44276a

SHA1
67f62777095a18b9fb2e91f110ab563912a58d31

SHA256
853958071ed5f1894fec6be379a58c9bcd4e7498e915e60a8938bb04957f53ae

SHA512
3cc7c00aab5c9b716efadc98ad26f55c5bbb1940db77a3014370d37af09d0f91847936322eeef57ea656e4b92a8c73952acd75607ae470220a00d3cf3c0f4a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
969535e66ab8ba080303f3a406e39ac8

SHA1
847f4379522989526f1d3b5d42509462fd64e7f1

SHA256
a614c89ed8f46b093ec88968a7f0eb50c5f52760a0350d6617c07f2579e1d39c

SHA512
42004ad7fc0a3867d30457fc1b80571b30dfed2ba2f6329bbdf799b202784525e6d45cdcb1b19a51b1cfa0a43f4618347b5e001361d1ecb89353bd74e0d7aa41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab78F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D81.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit