16e526d44fed82aa68a893026938673909a02d6443f3e6dabad0a5a211320d20

Analysis

max time kernel
69s
max time network
134s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3edc06f8df5141c2c28c972118c1d1e6_JaffaCakes118.html
Size

12KB
MD5

3edc06f8df5141c2c28c972118c1d1e6
SHA1

c69289e5f1bf459a0b1b3d4f396e0431573ea30e
SHA256

16e526d44fed82aa68a893026938673909a02d6443f3e6dabad0a5a211320d20
SHA512

afb8420758e066b0c13fb16552918bc00c38b895e84b49a881b78d6ff71dfac71147e9f5fc5c83758b704607e8637c583a462b451fe841a727f10df568f2e2b3
SSDEEP

384:zGmv08Xkd9sula81T+GR2+vCqMm7kdGk6LupcD7FBiDb4mElVMcn8:SITXkd2uX1q+vCq17+6LupcD7fKb4H8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000f63d95584a96ec0b69de6c0f7fa038d2c0018e3e67cc2e30fb224b93d0fbe7b7000000000e8000000002000020000000a7fd3f44d2849cebbcfbcf932ee66bdaaa8d0dc87998bc3288b9190d401022ce200000009a7d90349f1046dc44b73aa822b6e8ca45e64a77c1ac49e786a46e56e5e6f23840000000bc21b0702a12dde68c9d5a525e7da29aa28abb4b9d8291bd57b7b2021697bb8222467720e33be1b5e536626ff9a52335107dee4fcfa04a0ef16f85e4d8bb4687	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9CC7831-893E-11EF-96DD-F2BD923EC178} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30444e7f4b1ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434970640"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b13190000000002000000000010660000000100002000000095e3d1d537be9a8ebe6c1c577d276301deddb0059fc5bdb5b3931d78e99ee96c000000000e800000000200002000000036f5bece7b7754dd86dfe4a693df03d8c101eff62e2533b77e89e365789896b390000000161e069c4cc6ee8cb25db5e2e041e031ebc6128259cbe21fb6cb927bde259ee4e7e4489a528c66922d3438896c7aeb064ed5b3a38393ea1b6e1ecaec3c0fdd23a387ba690a02c9db3fc54dd004d3b18df897d235230483552be179575ea2cbee8a9d0654d944a7c413ed09715ae57f1ea1243fd9d205302a277e0fb079175b13f994c68d4c6b1d5d284a8e138f15ed92400000001bd07562c4b21903285c3c08a5f0d8a0df844f5c971a0cfb5e54a0ac8c24d96a761d601387dd3f99c92e9bebcc0b6aa59586305e92b6aa3e5c6739ac9737de3c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2872	2916	iexplore.exe	29
PID 2916 wrote to memory of 2872	2916	iexplore.exe	29
PID 2916 wrote to memory of 2872	2916	iexplore.exe	29
PID 2916 wrote to memory of 2872	2916	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3edc06f8df5141c2c28c972118c1d1e6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bb70a659a18ee0ee1be290c5ad53292

SHA1
124607b5e5ded0eb3e18b43a31c25584dbf73e02

SHA256
9776bfb9ba554e3c85a62c8afd989f389e6d8a0c5af3e8f9dda2a51bc4f1a4fd

SHA512
4ae568356106043feebb437865240434010dc03182fd92c220fe4829da528f5c9454473d4bb28388eb97bcdd1756ebc8d2a531c100976c1164f29ec150fef5d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c31a3ebdff3d20abe52cd1cbba9fd0b7

SHA1
37b0174ffb7cf5581891356df9a1c4b6777bebdf

SHA256
64941d3f6f103ae62d4454d87db4507c3018584184a543cc9afb2d0d9c131ec4

SHA512
126ccc164b2a0528bfd61bd12353e3e11464a517ffc871169284b3a832d8b606e11117aef10d7f4a0af86316bb44ed162c754a234227f3c472d83f1eeab97d6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79fe9dffd28ea176d85dc3fbbf993fbc

SHA1
fb1254dea9e4d80663a5aacc4d98cddee4bd540a

SHA256
4b8e8ca1cd6a5033b44a76abd3179ec5211d8d5cc701e97a2347c1b02d5a5ae6

SHA512
024fc6d5eeb2967f39ca42c5f0187ddf4cea4bf37d8ba7ce219f4dd8dd13d07ac691fecbfa847e87c4597a8631e214dc5bafed2768715c6586a8b4c71072d74e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb5e90a2e783720351aa8ea9a739f2b6

SHA1
a3f04b6ac7ac793dd9eda0268b64ba65a55384e6

SHA256
6bc1badd2e63122ecdd3fc0dcf1526115ce416ce965ea566405d232763f85c28

SHA512
b843342ff5a756acd4ac75d5c6233cbbff1f7b5876cff4d086703eded8e3f013190a6cf1494e60803ce6889cc46b450a2f3cca685d60e756c7c053d5fb38160f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b697edb4917a877eb18272a810ec491

SHA1
bb7863917ee224d6890536708020e71700898b46

SHA256
adb25222d275c410e7b9a321575a289f56d9bc025f1bda920edc83d2d7aadd3f

SHA512
39c27bfe5d17ec47f3141db2c282704d351a584d11e63b05b279b10961b90c35a42d96147d8eab59cdfa5f7e71eccd4b1b24c43d6d41331c4f0972b0606349a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08257d7105f13903e90cf80ebbbb4238

SHA1
0caddc7d781f7d867a9d60a6e1d462e773279589

SHA256
0dc0cc5bb99b70d11fdaa1242315fb1c90fd871ffc5beca55f08955fcc3c208c

SHA512
b3a39a9ddce930fb41dbf1465698e3b6281031a5455076ad1e2f641762ec09d5161709a90759331da4eac57cb77b3d46284b43c9f129c492707e0fef965d99c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09470ab230d005ecfda194bb021d7902

SHA1
348751e62e0233ebd03dceee675550dac33b24b8

SHA256
311f1f40fa3e6df3cea77a166d165bb57d315b91e71121b3097f41127aefca81

SHA512
3b17a53221172d293d8c63de55aeeefd91e4230f374bfc62390b0413467b94431662cb290d36e9078ef5c0c231890bd14b6a96d0514a9b383df5c8903ff290f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0485c778f4d2e9fda629787914c3c794

SHA1
0c629602789046a799768c5846453ad3ec5b07ab

SHA256
c62b910ed96bee6549c99ca57d17ce20208689c810d31e1785a79e75225ac964

SHA512
d38854daccc7dc989a56ef904128c65d9149b2613cadc1ef13640fa641ab61f40b7c972ae4894af4223318f976388bd77f874ce2d8787c2345fac42bb1c851ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27ec39897a1214f9c69f5569023f9521

SHA1
bae3351125541caa239ec83b22dc3ea613573baa

SHA256
45c1635e99df00f137a5050db825a785d639606e8d37df46871bb81a81cda5e8

SHA512
7f4534c77a40ef53a803e71070aa11ad6a09708d2cb874de8d31f55bdea2525265d35d99a6618d88238c0b29a770d71b7a5868546702b1e7909e270910d113e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e53ea7024c4484f3f8be8ecae8096340

SHA1
97f84910a902527a64b103ca42fec28c0ec4a786

SHA256
0abe427af22ecc7a2f2cde74a992f47571f907818a382fc0ea464d18fb1e3115

SHA512
bbb35b5954149d283ed8db864d7771612cb3565beac6ff24aa31accc512396c0be97c70e80c2d113194cc3e95f5749c69f31d9ce79714947a1b49bdc168b78cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7aacb57a27680a310ee78c14fdd12111

SHA1
fed7caffd230a346928fec794d2cf17beb5a5a2a

SHA256
5e31889df8b93b90086831118d18629dbf32070296f96625b72b0cb2737e8e23

SHA512
f6250b468c5faeb54d042107dd9c490a5bf6bebff58dc0bc10283e568884f2ce2218b144c86a835e72e721b3b54080840e1e8e08df0d4c64286170de4569d9fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d23fa23393b27d7d90cc5d5a7d40e016

SHA1
b468bd2151f02f6211d5f1d8da6360d2988f7e5c

SHA256
8718eeb06bade2cf04e258cb0cc2758721580a68e3edfd09053eed45d6034d56

SHA512
a330f3ea19c74e1e277252c9a424610f4be054e640f42b93328f6643c247a4a055a54e88fecb49130fa42d4b689c811899e99ce4aac764a9592774d9a9f28096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eb72a66ec556108cd6c027f732b8ac7

SHA1
251883779049bd65a0c59be363f9fa1da4b4e7a3

SHA256
22c3e009580f1d3d27488b7b90e724b6466045e79b2ff41aafddecb1a16cf1da

SHA512
b32d927cc04fc4a0f9106b110d3b104ecd7fa0559f8e7196f124072f000cb7cf784276e7e5a244deaac1dd3aa07299149e754afef92b579e8c2968c4bbfe5957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9638599ed7fd3c45ebb908b593d160a1

SHA1
5e3fd05e438a302948d18734a6e093b19500b987

SHA256
2e8758f0532d69ef07b2986270f67ee10361e6310e33b024118f17836282b1c9

SHA512
014ca0c3446d39faca5a79314b4b8f4c4ee0de8eda80a52277c780ac3453434b9578658f9cbafbf1463a50a286dbb855e0dc6addeb54e3f24045068f1efa37fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c212ef30dcf55e2eab58eda0aad2587

SHA1
1284b5615172e03a8ce51f4de3a4d4c5ca9ce242

SHA256
967bf6a9f811de881e7c40c39ef1e6868aa38057bdcd5c61eafc23af34468b26

SHA512
ba7e528a82948cf84bdcbb0f3ab7db07aa8d04917c16ac3f3978d929cf448b3715455d568c641c6956da8121ae0752de0ed9ff2ab0b3b6b22fbcdb562f0d1649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c62d50aee87ed726dc9b9943bc7c6002

SHA1
59d7bbd578281e65afcbba337a32f5414f49fe54

SHA256
fd208c86b5c2746f395cacc718d6d0c02c025c70df08f932c050289d39953742

SHA512
6b71a2a503906de0397977f3abc2c58d305af861103978f137988c7f2e0a2ccb68f25e6f817ca65ec800349c26e2b37ef39324715437343bcc8bf4b1bf8aa7c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f3a9fa1f21faf8dbb5b3862f2481aa2

SHA1
e495e4ec7cc51acce560e197fc53b45281ad75be

SHA256
fe7da2f9596ea67ecd57deec0af8d691db08ace5106b1378ae0b53e2500015de

SHA512
55bf089ed584190ea63b6c26d5a77956e36138f2ce30c1dc51583bc6f94f346a00aeb82532c937c78dc543dccfe91cf224fb97fcbcfa1c6d7409f7ae051a0bb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab475.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar535.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit