97d7996c657dac39497001683776ea390ba3f3f70f31da017547bbd4590701d7

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Release/bin/Monaco/index.html
Size

13KB
MD5

8132342ce4b039603cbb3b1a32ab859b
SHA1

66c46050a6e5b08758c00455ae26a6c66e94ce4c
SHA256

3818906ed429acd27aabad7ec8771893d60658ea31b8d0c92418b96de8ee94e6
SHA512

44d93118187e703af1fc1627de7e97c39072e666c9086b1b4c00a7eadce1913c84dc97e8f80e2b514154ef66b23baddbfd71a2faa250735ddf4d2bc12709cef4
SSDEEP

192:oL3bXRggAbYm/9mv2Oxr09VpDwFgBsK7u24FzTkcmc/VT+9taAc4dReigXN:2RggAbYmbD9V9wFgBs+SFN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000a9f731ef65b9c2e04cae0fff4fdabf17e9daa80f2935877ae38f6392bf8380e2000000000e80000000020000200000001b5f7d47d355f11dafe67378ec076c7c682149cef768797159e2aeb923829d6b90000000d2dff87a5a7cd5f76f3436bdc688a7ab99bc0b1792fc28d6e8f48c6c5588752b9488acfaa99fa48d2facbb509a88f47cfee0639055ab74764d96ab0a7e0f92f3d59884c2237ba97350299f1538797513b2d8e290e8e206069f761624f29d51478b3f3316c16732b429cf75743273d53bef7ae4cf685f0fbad1590d1129569ef4172d6d10530b8e64f53d4c0494a1ae2f400000001085967b671df60be9670b3249d3859984d454f0232069cb50bf9f00ee0bf503d30c0a445f4f702776302ce511633f109784aa56b91974e1afc11ae4f3319d8a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87D14A61-56AA-11EF-AB8C-CE9644F3BBBD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5019525cb7eada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000cbec5d2f41607a612be36c5e74c23e566bd6dfe6d2c060f7d148adbdc9444bb1000000000e8000000002000020000000c4a0a08c4e3e8a2a0097cd3d5d3f98168ef42454e95b6af66a2ab7d213f06d2e20000000d619f6d73ac4e0eeb590c8519e94fdfcdcf773fdaa31a0aa2e3f0917bc52ef8740000000d2d05e72af571f0687e21b7069a386fd98c75243ee08fd0c090e97a20d09ea92da4fe21ce862872095a643f97c5074b8185f96ceec6fa26e197f19e6d04a2416	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429409457"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2532	iexplore.exe
2532	iexplore.exe
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1636	2532	iexplore.exe	30
PID 2532 wrote to memory of 1636	2532	iexplore.exe	30
PID 2532 wrote to memory of 1636	2532	iexplore.exe	30
PID 2532 wrote to memory of 1636	2532	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Release\bin\Monaco\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02839402051f134647e97f4ec2e9e06f

SHA1
7ea9e01c25a94891d4596be527f7eeb9f2c4cbba

SHA256
7792ce9ec71a2ae2e9f366b2dc9f4ef080ad057d049615abe4f3bfd5c62816a9

SHA512
b972f8bd7ab3f45950cec0a82b9a3f5f9df20852402be29ef3dbe03d14b5078a288623267e75c0dc808015a2d05e74c3966983e0df693de33096a90d670441d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eb6813e813995f7b6050d101a0eb080

SHA1
e2cc08ad549b020df56fee0862b233d4d61d3fce

SHA256
30700f032e5b91f61bc8a1b4eb11a4a921e9001d715a85afc7a4d352213bf350

SHA512
2448d52628c6f07348db9ec2ca19089ad7a1d70de5ee2afca425ae12d0546c9630362f605e1d11737c7396ccfe575e5f61f2f05b82e8af3f5b1abffc38cdc7c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da22ebd9b84167c3b1d99e66268c9c02

SHA1
27e341cafe8926c4a6b77904846f0f3831abb688

SHA256
f6e7fb560bb638bf9f5ddff138b08aa41886c9c6627c284c34e5a12692d045a8

SHA512
1ff472837cabdcd780eae34c15e50231e3ee888b82f1e27d06aba712af2eb6d6c48b2be8ea764affb513e57813e00e12ada886c6add63561412927428e8de53a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b94b33e6c54eed7b41108013ef15d7f

SHA1
5215a3785c293aba7ccaa8e1f9644e715ba4a8c1

SHA256
ba5ef044836695811ff4319a68f07325aa00a26e208de3f834ead868c838f45d

SHA512
1351c566896bee752741edb7d7e767656a66fcdcc223f61980293af05401aa9ffd7083aa9bbc567e0ac1ff6e2526c760a4a78f759768310338b5ffe56b463b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5f4084df7f08a3949a43f23eb0d3e7f

SHA1
09547f965c3cceede79e2ef53ce3daf8552cc500

SHA256
c13403f2f03aaa55dd1807ca4b9c4381657b53d50c90b2a849d524f89742f9a8

SHA512
d0f94e07db3d63c8decd6af48a41a5256d3e78b995b9164bd228375e2cc22564d432ce623d68ca4f14cdef91996a28d9cb3045b1ea74ea73f497aa4ce6ae6c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6ef4b0faa40ac5e42cfe2cad1d3aac1

SHA1
8f6da371cc8186cdd508b967d436929e38b2c992

SHA256
4bcd6cffa18105dbc7618f0d7b75dc42cdc2bdd60afee06455156360185e4d88

SHA512
e8a8ac9b3507bc155a1bd83e2276ac8e29d6977329cf61ca4970ad139075a098fe252eec1860378668a4147d31957c4108a03716fca1792f0986c708107853f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2488c5027e800495597f36e97f996e7

SHA1
09e8316f6468a0f66d43fdccfb993056d7c4dc9e

SHA256
75fbac1c6cec83cd451c13f302e5000964ac581264630440b36adc38ef9aa790

SHA512
a86b53ce0f7596434e3b91978ac173594e4f1d368e8a69a7435281dba54f695939cc92666c5c9277d75e0cadbf5f04877258b3c253e92cf2fd3adfcb00520725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e4026a4db11bbfb119f03210c7889b8

SHA1
24a00b823db9ea7661eb562307317ca79f371f05

SHA256
81faa86adb8c6e7399c8c9e2e5fac27380a4830a6126ab6082585e7ed886c7db

SHA512
09390ca297a4ddbd8c3b7190e550159227f3598a591fce98b3d4f063449d7f146a0a5e91b1b8c3169b198b09344202ae4a335bffdb86982ea6248705a0dde600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bee04443a5266e48dbd027a2e48f41b2

SHA1
c530ead8d244348ea1a6fc66856779e7bd9bb869

SHA256
a860b5a8b031d477f4ecef3a684636432b88bb52f5021b73e756478c5154fbd3

SHA512
ed56c242f5247d80232bc74c2ed6902e83c3759fd5adb901c2be976fc91ca436f1953c1968c9547371f744d5a562ac80cdae0c599bfc2c0cc1931c563db0a426

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52ac4ee7178b28bb0ae236702cd6a3a3

SHA1
710f15c05453b28b99c6ef13cd9f2f87eb4ed28c

SHA256
f156d76692bc7e1fff4626db1ebaedea13d83b399880423aef2cf8bb667bc220

SHA512
2020cd4cb82db35fe1c3786a392ca20107df6aed9594f6d8f475e859a1928a7525af34d647f0625ea4dbffec4938c4778a65310c27deeb179f70d7feefb0ff61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f23fdd64fe0bf4be4ed95aa067b5140

SHA1
6dce0ae59178f56f3e85e90290d22e6e3a16076a

SHA256
255e9f43f52686d1f7de90442c3c7e29ad34b41c521d0279ee037e170fc439eb

SHA512
b3673699936a37ac23b30be7dbf48790cbf259d2d554e4a1d9338ca7f9462877316a85126204d1c89682b9551c2241d95cf38fb02880f3e572221513216f87b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebf2e8cb69b10ca97605db91d70aff41

SHA1
ad757fe76a25e8e732f1a2d943de6b3ca1e3ad11

SHA256
55f46981624de52f8b546fee39fe0c4a6e3729be45926edce0bdbd4621f1183b

SHA512
d612b284e09933fb519821c2ac7e3be787a911d4e0326cdd7cb834e52499923e26be2059647441164eecce082b6610c05fb4c23bb4a5d41713876c5de723a5e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b92e3ae22d634b689d8d2d5f086564d4

SHA1
4c72057d3605652e1769f681e45ed1f1864c8095

SHA256
7ea7c2c558d80cdee3799fdbf9f864ec673d8b97f50a4acd2605f2931cae6439

SHA512
64189082b415e6dc6d8cd6f8d90400fc8f621abf85a977b8f601b7655988dc90ea97e0ae7b2ef769d2321ea3f1a7d8824c48239cf859791eca96bce8053062ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ec3c98e9ece5ad4d84077013bf7a458

SHA1
558a9a23b850e9b983f0d0c05c5b502d01fab0c8

SHA256
d2f9ef3e889d348b2d9e510597a2ebedc33b5fe2b736c6cf51fa3f0c0e6126ed

SHA512
a70586dffb200c5bcafaa50a00edfe99576dc972e2450029be7adcacef98d44d0966f7d9dceaf4f2d5cf4f73e62fb0dd2220686f4d379cc1075d83cc3d56eb39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
253ea1f97b39ef031f9c9ed5c195fce2

SHA1
dcc14dd1240e94c8705e8b5d11cbe663b1a4a2f1

SHA256
8f66c1d23d037852b39ba2a713b6c36127b22b6233fce50dd54e9842af62834f

SHA512
2625bc0d021d3852d7936fcdab194ff8d7db899b22aae9891554d183277320896821a2e940d40c4258241b81f5a1098c33fe64322339043087309e18b7911351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a9a1befc79282d867d13e4b2ae26654

SHA1
7fd006914b6789d322d1f70bdfb234ba627acf36

SHA256
cf7e8257e9f62f4d7dd851e13bebeac655497ec11c1c3ea075adf972fc66b9f4

SHA512
d4db8c7a776768bbc36f21bb87e6de88b726c6850137006673967a94b2bb6db7f0e9e08e8dd946701022adc2719633753befc01c48c8ebaf3ff2c0b9e2729b5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17166313c499d31dd98b5b10f1e0e2eb

SHA1
e45fcac9f9fc28818cd7ff12e72d054ac5a93479

SHA256
bd704e82db4ba76cc65817cebfb4d39ca0874f3ebe0f4ae2c3251cf865fe8c16

SHA512
739c4a784bdcba82d1991dc39c09712e42967042c4eb1c85214bfff445519aadf7098449e12bd44d0e6421c4b79fa883ee009aea810bb9f648f45f326114031b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB8F5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC539.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit