688e075f96404800e79afe58545591771386b5d56e0553331e11c4e227363425

Analysis

max time kernel
139s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a96122322084464ab05801f0fd8ad1f2_JaffaCakes118.html
Size

26KB
MD5

a96122322084464ab05801f0fd8ad1f2
SHA1

e77ada4df1e4cdabecaee9d98f8e521560ff2854
SHA256

688e075f96404800e79afe58545591771386b5d56e0553331e11c4e227363425
SHA512

8b0bd9b6a25acb880f037b9caed0f57c93ebeca76812e647d687457f0f24e1e372ae2c2409a1bf7fc7ed05e075c9f00076e4197627ef6f94a5b389ca274a85ef
SSDEEP

384:4+QfPFd9QZBC7mOdMsCBKfpC5IgSnbmFe7AcOr6NykJvAgo0ijAUPd:Zcd9QZBC7mOdMsvpC5I9nC4bIP0ijXPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000002d0dc9be33841acdc1002ace6a1d23c1440f7a051a4d78f0903dddf971431b87000000000e80000000020000200000005b83d276e484ff5a49fbb82eb38a7a40e9abc771912e4797c6241455ead07619900000001301ac79419b742bd451e2d6ece42df76df11692539daf23ed7fc47cf274e6c3099d2bc54b5fe91a77ef2cdee423b4b3db631bbceeef235d7ba600f4ee4cf8448e5ab1ed125d55805d7cc87c78223874c078c47d9d351129c704576d432c4481ecc4c786485caec329e6b58b8fedadf78d4c32ffff383e5f3e3d902a9ef0a9d94fcb647c38fbfb441f1c45ef856d53da4000000062682ea210ebf9aa34fac9930b5304d3b72682ad93679653ea69ef7abda035954a13c7d615f766187f166fdb673e8c0d6071129976a67ee1b0f2384783473d7c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000005ee5a5af283b29f36c4ff341546446d2c1a2e7cdd3d7797be89947db8b8d409d000000000e80000000020000200000001a933cdeef364187d5f8a46cc7aa47dd4eb82cd0226713b436e69a00a173ff7e2000000012a121a52364883fcabf552fcde4ee65b36af3637b1b8867f679a618c1fd616840000000d51353c4a672a36cdaedf5a52bce52d0ddb66b76a32047af20ad3825b6dedca394c9f2f8538e3e47b06b22f3b847c98347f214c32c5f696bf363b77d2af42766	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{095D9B71-5DDA-11EF-9A68-F6314D1D8E10} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b764e0e6f1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430199518"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
760	iexplore.exe
760	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2136	760	iexplore.exe	28
PID 760 wrote to memory of 2136	760	iexplore.exe	28
PID 760 wrote to memory of 2136	760	iexplore.exe	28
PID 760 wrote to memory of 2136	760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a96122322084464ab05801f0fd8ad1f2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:760 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2f11946cd2762a7c4cd5825cfd5de6b

SHA1
a8400fba7721b5705ba388c4a3395c9594dce0ad

SHA256
e8f776f2f2be77aaab104eff0ad991c0a62bc6c4ea06e4827e35a25935cef176

SHA512
7ef0d605d2af3b26f9f78978de03ef86342a32a3fef9cb35ae158af21931c2d6ceaadce26abdb158d621572e1b916956b2c294339addea8dc4e191e1f9f90886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7162000b04952f988c3047dd6d10e5c

SHA1
50b86218946dcb27e8a3a6cd008091572747554b

SHA256
24285a61e36e48339546ada5e411566d32b982057ce48d6eec43b6d1a77bc37d

SHA512
80d7e7cdaeb5773c6ce3c9bd51ea5b70b1e89b1f03ecfaf86ddc06f20ec78ac71aa2084c69dce1cf547f99d2a03b19b3f8e606c904ad36fc29c91019c661041e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
883b0c871b9e774f4e23e7a56bc3bece

SHA1
3b37f83a2894ed4d648fc38237503cf545deb45c

SHA256
6df671e39fe9772691321a869e40f33a6fea0a3d03f494b144ca1f639074dce2

SHA512
fa7ab2dab88714d4a1440bd04d6e69c87a8ae58afcea6c81823938cae3fab8ba0d0c63f3ab3af644ebdd769e5dc18d0d057ee9e0f96c4ea22f67ec55ffa1e700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6106fa4c49ed37268d9f6ab64955f67b

SHA1
86df2bda5ca687c881b8f0c01b7e8adb943e41d0

SHA256
86b62e4ff08c4ffbe127ad54403554fd35242b86aedae24712390c1e2a5e811f

SHA512
eadf099a3c819ac99a07a88d7b4e9bfaa4bb3bdc190310444f384d39441327efe1d6cc227ce26bb17584c8139a946892de8e722c4522528d970c5a07425fb4bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ade8dbde5f359553b6afc894f727c7f6

SHA1
264a17d2acc045a73c670b6e12bb0a2cecb7afe6

SHA256
fefb8b0f7b1a0e5e759d03887a8de7614484bff0025b92fa233d2a69040ff4a3

SHA512
94d5053c9d76b1c2b44187fbcbbd13a06cf76e8a6557bb93a13a5b6d93fc9fc73b9dacd812004e377f45af981159319f672195c67acca4facafe143a63278bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84ac4f91f59829bd1d0b0bfcb9d71d56

SHA1
39b0d9930fd363cf011fdd156af1ff48a940a392

SHA256
141fb42eafee8a2dee7986fa4848492513da11015fe8b3bab5da5c7315554d4c

SHA512
f777a9b3041d9a22de349285a73ec434e6694afd3d9ca950e2e07c570a339145cd15df7ebca11c2338833797d1c4b970875faaa13115ec84492af2f116ea8298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00de13be981313fc30b1332a8a422387

SHA1
15c24b18b38c2bae3fd7990fb3bfee137bf562fa

SHA256
936e163905065f0933ce1af4210d3cdce96c55e0f6cc12cea2a67e6dfef1961c

SHA512
bc5d2d049f0c0de1ac16e8eed1c2bb255b1419241b4121841ae182f7d49933ba53c1d91b8527581b515ae99e6509dc4a71163a2bec05bd3175cc9fe634997a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
922158e2065838f6b7cd03c2020fc85c

SHA1
d0babcca4ffcac9ce1cf9e6a91f26903005a7a35

SHA256
5a8298f2e7cb0ff132e91a3672291e0b2a360aea57b8b3eca13bc7fb086b2466

SHA512
e84b09625ffb62c292a0056cecce788c1d24806ada52ff4258ead5688feb106449435f984ae7f41d085df2da2ee8908f75667b55193f8e56f1222df0ed3df837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8897321c256b99017cb0d20afbd99e1b

SHA1
d2edd2da04004301279ef7e631efdf1463b55b6c

SHA256
a854c5e8ad1292c526d96eb21c089aa5bdbe9beb4268e0d27651d1fec3808353

SHA512
baf7cb1606d2618c183298acc38eb419718d07aebdafe00ab3772507c7ecfced7c869e73b0ab89ac735422b4752ed9ba6ed1b911d634966ab78787e23d878c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97f1234b80c2602c73a42de16132b541

SHA1
975e8638fdf521d98793954210c3668c97f522bf

SHA256
0967527265578a7525198eba3dcdc440cfb874a470d638181704968105747f1e

SHA512
cf454d37fd0c970b2994d9eb81ba14128c0169d61b3f7042e3352a2944b9af50a5aa0953753787827addce7974234d43b31683f6aa238660eebb935f28eee8e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4a4be0ff3ed5ef7d90fd9fbb5b04298

SHA1
1b7d418c76e845761e54478840cc9c228b4476d0

SHA256
96e50f8654952dcd6ce82f9a2a6666d15069324a583335ed265dead8cc170dfd

SHA512
7713bcb81749b7600b5accd39cb98fc0757a09020373d082c95758dcd63a876128fca1ffb241abafb9fb211bafe7c315cc6cca1f5554222aea42281edd4d96b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34491ffd4a63676bf834dc0da1eb73ea

SHA1
20e156b53f1e69d82de34793b3dd6f2c179075a2

SHA256
decd7341470414c45a8b557eb0891c8c2f2c1944337ae3d26892aa48e5ed1b2c

SHA512
e3d728249d27de75a64867059720f1cf7524b5cf4506c967d246fd119078711438b1320bd953f18bbb647aa4f9b2c8634c1ea80479c721482f7836c4036cee29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62858c520af9573d6eb0e563b964d0ac

SHA1
4bfe801a2c3d7b3baae21fb00d81022b5dcd132e

SHA256
5d6ffc4be6e39c02462d3ce5b66cb98aad69d3c98a45da35c8c3b816c9076572

SHA512
f449f3d4ab61d989442babdd4a69ef867390305b47bbd5f17189f6e5dab79b5d601443970f8421caedfd028a889e16f9ac544118ba4c7048624e29b7ecd893ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a73e189434a4b8406681c7359dbde7e3

SHA1
194d95dc6c52a0403c409b83d2324cb2bb888a12

SHA256
4b4c481283df6e1c9c674c0e3949b44cb8f6379997a9bbcd7a50be25239df103

SHA512
6451b173db5c829bf2c11587886354ba24bf1be510da7236b892b0a4a92707e762ec2a96d43670218bc8250831d5720aeb9949c630b76fe6291a47670697342d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
498f0716e0d011ebdbd840337f549fe9

SHA1
73a289de0c9d5234322f6080b8868389be323ca6

SHA256
1ba21d49e192f24e178614d99dddce365d055cc577c04fc6d1bdba2cd0eede6e

SHA512
77fbe20a51d0aee6ff31c81268fb54ccc52ff2e3f5db32f841ce8cdca9eeabee9becce045b16b7fc0547871712fce51d8a0279312a13f4988a66e6879885d77e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b5cbfed0a73f492b9e920aaea9daad7

SHA1
733788dc28a7f090e58d5973997d7db11fe753a1

SHA256
2539312833541984f63c41138a7eccb12a412a57e9b63b95275da866a82b2586

SHA512
07abe35f3204d47171bb936435700fbce17c1b2a31cdb40467dc15289613cb381147b6457e67347a54576c0c3b91c8d2d07f2b691d5e58474cf97720c1e76d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b449ea4abbbaa78bf5ad5a3e0fb3c6ee

SHA1
09e79445e68847fa502187e72232edfd6d4269f6

SHA256
84352ace2f0dd4a0f9ecb08904eb1a5c1bce6694243d1ed1eb3080219681211c

SHA512
d132619a99303cf091a635ff8dd6b5750b4732ddd083dbf89f39af3cf8465dd689d0afe6508aeb247ad03ac084dbbd39b46c91efb8b703c6625b23e8d5759f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB6C4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB783.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit