35783b369382b7a6983c9f261beeb3e67a26890ccdef333bd0c9e0696b95a000

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2977c69b30cd8bd83d1abcc63100fdb5_JaffaCakes118.html
Size

63KB
MD5

2977c69b30cd8bd83d1abcc63100fdb5
SHA1

a545833a20ce5f2f0919b430ee872ee070cd08a4
SHA256

35783b369382b7a6983c9f261beeb3e67a26890ccdef333bd0c9e0696b95a000
SHA512

d68fc8c041b2567bc69c532d6fb1be2af3822784ad4f3e2ab27197fb7099337774ac1cd99cfd0909c3ee836c87566b6d34754987874e039a1d17a41d8937b059
SSDEEP

768:ZswdpJ6ZX4C5JvneGzBi38WV7GL2Oo0oYHr7BkuiqL:ZFdpUZX4CydV7mrJiE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB8AE071-862C-11EF-976E-62CAC36041A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d246a2391adb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000054213581690cfd64696e2ebeda3375f47c904b6a49a57dfeddd2dfdfcdddf858000000000e8000000002000020000000cf0343bff3fac6476ed8e1f1eb754fb42f3286626ed562fba342406779959e52200000006c72113ae576efc1376c5c4422af478cb2ae8c36a26716773078f2ef27bdf5dd40000000c86bbe195b1c478d2c3dfaa9f97e05c0fbc65874c449ff351449fd6d2a7563aadb6e760567a5983410b471c1b5fd5c28d37862bfa88a505de9d136a62cb7221e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000a97e8ac8b2884b3b799127ff419b676a9d5000ff9e7fcba2dfa47eb0a78b6531000000000e8000000002000020000000e13586c265e48b7ce864007379c59f9872b5c02e96c0952962babd8d156ff4dd90000000be87c6021526f871ea5433b32b50cbe2ebd41c1784fd9a5586b315f4ffc67febb7768e29dbddc434bc4fe071215f5558da3f7eeede5871af1ad955fe69fa5456b7c2b3b173dfa684c49d2696f09bb600cabcceaa8df1f2c3db04fff8d5d331336f38f177fd1d4ffd81cf7821b1994f329010a9813dc39d60710e5dffa516240725c5fbe9461e915ff7e825688a8127934000000046741339df1d0c52252f4033a229219a333383e70d0b1b43691cb27b52ad6eb39faa00a944bf0b45b0a719962604eead715ff8dcddbd07e6759adc15f61e98af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434633109"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1860	iexplore.exe
1860	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2332	1860	iexplore.exe	30
PID 1860 wrote to memory of 2332	1860	iexplore.exe	30
PID 1860 wrote to memory of 2332	1860	iexplore.exe	30
PID 1860 wrote to memory of 2332	1860	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2977c69b30cd8bd83d1abcc63100fdb5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
551a6326d947e9a33cc931dd246987bb

SHA1
de79e2e0a020eeb555c5154396b44380c6c8cd05

SHA256
d8b00a73554e68f99d466d7d2de040c451b27bf8d13677833dafaed0a77255b2

SHA512
be29922f52f7c8b40d8b5cb5066f69be846699b3aa9ec3227cbd4392b0d24ae277875106185822b37765badba2f29d2cd39c2e8861d8acf9589d054a30a44e5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bed913274fe7bf5915595dcabe499f0

SHA1
5e3db5e94ae44af6e967057f39ff65ae04231042

SHA256
c18e6eac0f5ce811b729400908b8f3699d11a5b385263b7214ce086d8d11e1a6

SHA512
06b079818d4e98fa7e5301ad502b89d97383216cc66918056e76674f9d6e38398bd4a9e387d5d672f7964b72dcbba4423a9ac005dd1c0d517071925c5afcbe95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfb50d43c7a6ccb8e14046b472f459fa

SHA1
b307ed7eab7e8c0255f2a9f4405a2c01b52ddcaa

SHA256
90a6cb1f8aeb27e3eb34a5834605829fb0acef3eb7b5e1330286f0eec681cd18

SHA512
c78c748392533297f0c31ae8ac094f07aaf1bd46e35c1206df4163a914bf91f3cbc25e59c0e3e72c7bf090b8881f6dcb19bde8ccc056e0649c76c87dfdf506b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2af0296c67384124c3418eabf7b3ecd

SHA1
0851358742ed9f78c506a33ae9586ec7ffc3ca7c

SHA256
4b12ece36c15741e173ee64a524e104dedcc69c10ed89b4d055e29cddbb4bbd3

SHA512
e7fb33ec747023d46286b7c4f8d65932b94d821d11f96bd4f9f2b696b645a0d9d25be4959ab37d5ba39977e139d197ae3514ec6318bb3c7fefc2414ce59d0114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0898eb0f9569d993cc2619b75884676d

SHA1
8e9d6bc6e9095af09e747726f869f8ae40580bb8

SHA256
8f68327fdf79e8bd36b3ddcedc41194207b3949a497e2162f30ffdf3fbdfa355

SHA512
768e4eb068df284d05b1ced14b395f3f7bf572407b07b6ddb7d305e7da7d99a07bc59913f3063533ab05a3a0ea43fe28a13b5821eccf2b83bd14151fd02f69fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7000abb27f7098dc4dbf594615cad59a

SHA1
f39812e0d8399c13f7fe3ce741333c5d4bafaedc

SHA256
f0bdf98996f07df19221ee63ccdda93361dfdd1cf6930ed3b8e42c2eabc00eea

SHA512
6705ddc7363b457e2816dffcdbd67ef0bee4e9192c487d20467d502ab8d638db87451d0ef800d013a6f98efec8f3b480a9628a4c1b00d9812a655d41f09cf944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcb337c94915cf25878e207fe7dc1895

SHA1
d660e4b7fd5ddb8649097da646ab8d4747f4dfac

SHA256
4937f1a9a3d3ae13177effb091f0030b5988aa2a3a5e461fa6ee6077cfec7638

SHA512
29e0fe339e03f790fdbfaf224a3b16a0ee4a2517140958cb1f650dabd348299d0cb7fe3fa0b6c83b21a27cd82da3348df64e52bfdfd780e9c0752cacc5b4d0a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f282a9d67347c2aa0f06047cc94b31e

SHA1
173098828658236987df39761afd3c59a1e16517

SHA256
9795c5e612310972bc4a31b9a8a0f7c52eeb2c333caa82491bb4fccf974f6d8f

SHA512
78b75cd9f9c0a1b3331a9814ab85fb57efa6ec7ed6cb971df39cb7f2b9632a9d1d3e9d4960d91c5d02ac5b95c3860a827b42a990023409db25fbb726ab8b59f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4926d7b87d19a427b23dbc21496b2716

SHA1
17299cc3510e513aacbed5fc570474277fb25472

SHA256
23735c44959cf14f0b8462a156b113757004b485df145bfc13cb7aa4734e91a2

SHA512
0f57361259e07573ba4d0b7cf39b7e9e0c939782c6cb5b4eadab575da0f75d83637b4a5e8ca30c3f5dae7f94e47526ea2f38b2ef2ed323b645ce6ddf8cdf7930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c86ff3b9765b6421c4cd3075e28e08e

SHA1
27e2ee5d562d80535e76a44ce536360cdb7bc9aa

SHA256
1c881d195f5594370c500dd314210afd8998d1f696627af24308c1165b9eb55e

SHA512
a14db6ee4fe03970b9160e539409c9322584671503acf6e51ce914a8883d8cf859d3c925ad2f2b32c61b143cf507cf63af3bf9bc7d88a09ac4bd1bdeada16fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45a5811cc90dfe37f308f08eb0356d68

SHA1
51df1d25d2b451d9bab3572c76bfe2c203dc9d48

SHA256
b7e7f6a8305f033d4fbfcabe59560716c7496a95f56c68b4101846b7fa059ac6

SHA512
4c76ea6b200ed2e2f5508bddead060ed039ed8e7603d901aa15e9e53977a5516f0fda770aa5774eafae2a45418ba5a93addb6e887e4789881ef646c07c09a169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b8808ed2e9601b655cc295f9717e832

SHA1
039257af939daccb2f957ee4abeb726a47935111

SHA256
d508338ecd6905c66ea2efae06b45498a8004ba8003ec61197906c9063b09a6f

SHA512
5b82c01100c895d374fb1c3f83185d8f06d4bbc738eaf67873a49c0055f06350569c53f739e48bf638e7294f34d8ea25cd4f2be15e14f2df900776ecd6101e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b638d06cd455f108d0e1d392458d438a

SHA1
5bcb9530ae174d72b6daea487e28dd107f0682fe

SHA256
ead3c4170e307a73bc1c41d7841a14b1ee61e2d0b7bfeee785b8cbc2a3c559ab

SHA512
587825bce245519712a0adfa04f4528580ab9130e98ec08065de40d7383feb3eaebe82f4e1e2ecd25971c7f1a7dbec97f3a54b6f1cb9ceb64da0ffd689097d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB78E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB78F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit