1889463f1fd846388603f213b79d391e686c25b09b28538363a8d8a8e704ea82

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fc7f2d07a95d22709b9e5345678e6c9c_JaffaCakes118.html
Size

7KB
MD5

fc7f2d07a95d22709b9e5345678e6c9c
SHA1

d404169b164c3d953052b56eb542a3d399e31510
SHA256

1889463f1fd846388603f213b79d391e686c25b09b28538363a8d8a8e704ea82
SHA512

3593b79f59726492e0a282adbce2a693ba98019782fff891122444f4ffc103aa16dd98b488e9d67a072655aea232c00f562748a0b3fb69783901be5fe53fcaba
SSDEEP

96:uzVs+ux7rpLLY1k9o84d12ef7CSTUdzMcEZ7ru7f:csz7rpAYS//b76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a041b233b311db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000001037098a6deb2a19c22529c281ce3e5ec47cb9673bb6f3b374686d65a2516e97000000000e8000000002000020000000c2236ebae1c9781e60b387ec5d112581a83f551c83ae54272d3921c9cfc37bb4900000002c62960f8ed997eb2060771d956580932acef7c4f03a513700d331a45d9d9905fda3c03b01da7423ca02c27263d2c1d494fa0ebc9ead8791d2bb27e8fd57c37c9233cf26f49efb9618ba978b511ebe318c0d0e32635d6875a6a0a0856624fca5722ef173dd58df2a4c259b058e8de09fce80fbf72f48569b3d9ad822049ed9ea1f913743f7c9f0e40d9c9c7a99c61d6d40000000d4c2ee2341764807e234b07c8143c764981e27488638c6c8893872a835ac921915119c2ea8ef0ff2b65dcd7933260e2e0de3e7d9e1eb870ea07805f00c186771	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000023e1788fb8c791c0d8595d4392fa96b3cfb6b6d7ede63fc38b0652080bc4d5b3000000000e80000000020000200000009d9ea9d379228a2908950f714d7c36b1a222ce59fba543ef23d1d23a37747be520000000aa88bbc5226b1112b845b59055070cac26fb96d3b9e54088b1dcf9075d3af87540000000d8d1f4ef98da5cbad3a7622eac01594ee86075f2e16c156e7c5188ee98b1f76f2443f7346fed4ee771af3298dd55495c3eae33153e9d74f13156cf5cf1d56755	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D2DF9C1-7DA6-11EF-BDF2-7E918DD97D05} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433695763"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2452	iexplore.exe
2452	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2084	2452	iexplore.exe	31
PID 2452 wrote to memory of 2084	2452	iexplore.exe	31
PID 2452 wrote to memory of 2084	2452	iexplore.exe	31
PID 2452 wrote to memory of 2084	2452	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc7f2d07a95d22709b9e5345678e6c9c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88b5841a2b4c6d816d3d35fdc789d3b2

SHA1
cd76cb632aba0f4d95e943fe38bfb8a4a69a9a60

SHA256
ef2d9df1731d18b46e82f1cc7d077224a3d5c994ae7c12d675bd418ecdf1c6ac

SHA512
b686f65a178f64351f331e1c0c4917e039fc94d9cbca436c3457b1d57f0eefb18865356e891c58d1a3bfff811f79f197544e782f1f42c764304e385971cdadbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcf6ef5e0f7b4e4569b54e41440c3ea5

SHA1
4d22253f010aac33ca1cf8bfc6b87f1aabebc258

SHA256
049d9557926042288f0ddfb4c8273db8173d378fecd7b5244cea17bed1320437

SHA512
ccfbe023d81367894933819d9b7699c14a4f6ba6c26f04cf7ccbf8b2578ab550da8bf545de22615fcf26879ec0842ca2f5a53574cfd2f8eab7e6aec2b58b1def

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b411379345f36c52b16b67708c236177

SHA1
a8243713753a1a44922fff0bd1a2e55fbc79e549

SHA256
2e0f8ec988bfa4480fecc0ac9a5f10d037f6874eaa6ed92aeca4a0d94fb9da4b

SHA512
0ab9715e687535edd7ede0fef61a0a76541b9b326a61f25abeacf04e561bad75cb8170f849bca518e6b74d60ec3a39f64ecf923d05cdb4b72ebb88286bd5b772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f3c128f3a6bd7240aba1ff534011a78

SHA1
7552716389bc88d49f72a03d9fc6c270ad0bbec6

SHA256
83c739327eba9619a0d4f1f484038d6d80761b8a541487a2ee01134aeaf15f11

SHA512
3117e9b176f58e5d32283b6ed875b7d30b88e81f094e1a273be098cc260f646bf646d9bc4897b27c104fc92fad8ecaad27dc696536e2b81096882a688a1894b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96574f4bbc8b75005edadc763e49e51d

SHA1
2aff8df404dcb0d8d5b59986e6cc6b8cc81a9cc7

SHA256
dc70137128c8f228b1f63426b81913782ae718a278d2b4c57eead20d82797f96

SHA512
fca702da53c6879e1c51e56ecbc69df732b20a846338b743ab5132db44d60d8c2318422283083a720cb26e18a23a904373afa0786c8ce6e14c3f17ebe35bfd8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15f39b121a6f26c00d0c946bb0726e36

SHA1
1da19db18a0c73a5582df9475ee352eb44928062

SHA256
34c6b170e1514dac44fa16f26d589d926176c8c97ccbd2541bf07440f61b33b4

SHA512
41f46834e554825a8edda6a3dbafe42124f8c9514269009a699078a26ec73b32ff11fe6a571e31d987df50ddf688167bc049340ddb50a75123bd65abffec4174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c450e84186c4087e4aeb9d0d2d39121

SHA1
378975f7e48e60bad890d9e53700a9e19fe871f1

SHA256
9a37a04ca2802c7e012854eb02422e2a329bcd934740863434bb66f5b8e94b07

SHA512
762e54771061ae7dc3792aba6718b42b86ebe7fc927ff67d2858bb3653cf8202a804cae53a2c5794c2fd69654f193d43355ada2c038072a8ce749301a5963e5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87b46a692586184ff096b73a37cd2d14

SHA1
162e084f45cb7dc4b8f4359f47b8af9c73335ad0

SHA256
3bef2570fe108903f8dd15f2cf405947c29da2c74cb889487a74337e8aa0dd60

SHA512
a5451066a78f4846c19c3665259b6e2aff381884857cf1912eb0b3afba3cea660354cfb409aaaafb9c033d1b17b01606f26236e86f8694686123858993136a16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7beaf09d7b28d82507f79e14826c3876

SHA1
7e25068635608813935aaf497e5eb8005c05ed2f

SHA256
d15985b26c49fbd145fd0bd9aba3ccc3f2332df3acc0c330cfeafc7a0360a2aa

SHA512
847aee61bb2ceb3ac04a8498afd2d8c49797f8d91fb6cb3a0a4544b4ba2ab280bffe151157381f4a8447841013dac8b15f91fb8cc6aab8c44ecb7b02aedfba18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56963a95f0b39c7c0944193724fda48e

SHA1
799276cec3c248f878157435bbeeb993414fb6f9

SHA256
03ce2154977f857bd950c4651d0defbc91d63f5708a1fc48ed49acdf1e77981f

SHA512
7171e7809d9b24716c45dc0a6f3da59d7d07937ab43b2e22f77f4674e4b8382d324ea36d87ae2c969d7833601dc0c45fbbf3b28413d6e25955fc3b083ca90ff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f3a5814e5658702112cb61a84ac8839

SHA1
3bf6f6ccb2ed55edc2f95b4fdeb9422964556365

SHA256
7c3f67ef96a1eae85a165c234da37ff9fa985fbd0f840d13300532246c510660

SHA512
4f904706c06cf93fbef02cf6e073e157f697cbb54ecae11277b4c2fcbc7a6cf206dd422f3a69e46d6a3c3ced809b55970ba59bccbd89b0a18dc16b354f8bd863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6c9f48fc8245375f432ae45c2a68d9a

SHA1
a1fce8a5bc54b3fd6676f637627b3786617daf7a

SHA256
1398e906bd13d47a71df0957bee5f1218155fb3d2885a1708038f14b93edc2e5

SHA512
2226c1d007a51cd85030c7083ec89a249f1d368cc2c18a5f9e3a8cc3c71972e82344e3996d6a3433128e1c7d23f15f5ba599d04aebae9f70033bab42582a4435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89995ec69837d7e9adbc24f9c3317913

SHA1
6c7906429d2d9188da02e5fe79133ff38493788a

SHA256
d907bac60f165086a258ad87884f9fc8d2f2527eb1560af49e909d43ed7a3aef

SHA512
e6fdd2d0a4e8d698d522f9fa04d39a2bf46cde42c971a71b9e09d5798b0f65192044089a70c0b960b3c45a6b4a0f050ed27fa0064eb1009936597d0485a5484a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f97f5ff6f1f01924ae1b104a8a1a26f5

SHA1
66d71d7842ab190dd4603da1cc69c888b2971c0e

SHA256
a7cc9509d82a686ba989e478ba74a32f1f7bdb18a3668cfa9a68000bffb4b815

SHA512
e1972c97a8677fb31aafc709b99f368607e733629105d880b123dd8b9f73fb9fcc2332b6fe8c9f57639da84ed69195c7e0191bd1eba83506c037ff7e7c1325d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d9d2e693b7c5866eab30cbbb4a3873f

SHA1
67a7d582274b3b4f7b3861ebfe695b37086daf03

SHA256
2b20eb8f692cc22a99b7b1591b4ce25db97007cb414f44a6f04383bf19f99991

SHA512
43122a83cba2a5c78f9cf59bc7fca1e6c245b4d38400000222153f23dfdf698f6dc2ab2a65b72baf542ea87cf283a9d830a892839bfa9d73493cccbff98e9f0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
011fd6a84fc8e00f5d94fec15703eccd

SHA1
65628bcee5bb02a7c308cbf711a89e8c25abb780

SHA256
0dad0cf1279f3dd8fd5456074fd9ef5777be58900dfe050141a8065fb342277f

SHA512
4ca624de65a828f8297c93063e47ca3afe25eebacf8ca4d8bd0bfb84182399b354b26d38e66a7eb98a89ff3f9e13648727267617785c724b8bbbbc0415721057

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0df9e2deda9ba65893be4e0c00d1b138

SHA1
2c0e432d350cdb51c0d07e8295e0ab6e5e66914c

SHA256
41109fde65cc01df1389306aa4565129f933a33e750537d26920437b651c3e8f

SHA512
9bb7263dbab4049523f472ac2ec7ed64f51bf8f2b16c4d1017f508bd9044ec1a6fb139f9d5d689ae775de7912f8a8b35ede8cbc204e557256eb290cb8b9a9ce3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab37D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3FF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit