d068ce11c6695eba865e1174709e4fab232443c14e2bb2954daa0436448d97e1

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c20176416d05dc81a42cb03a6b9e6254_JaffaCakes118.html
Size

33KB
MD5

c20176416d05dc81a42cb03a6b9e6254
SHA1

8082791f261fe293f1401f47cfceb0387a6504df
SHA256

d068ce11c6695eba865e1174709e4fab232443c14e2bb2954daa0436448d97e1
SHA512

8c992e0f65ce61f1a864c5675265edea68aa832fc866bdc7cf55e4fb2900138f4769bb59cd962c784ee9f1d07ebd52cfdb28f1dce4a1c867020d30efeff5181a
SSDEEP

384:MqQ/sBMmBMABMABMFBMFBMFBMFBMMBMMBMutaLqf2yfEjoB9f0vQKJXwDnTlHXCg:MjsCmCACACFCFCFCFCMCMCwQoGJXx/C

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000003c96bca57c8d1e1a3828fa82a341b9976e21002742590990438795c7455273e7000000000e8000000002000020000000a14b713862c3022b1fbb9f9fe4b1871eb641613062e9f5f5d2ff7cfe64cb2b69200000003d3f2aa8217c18deea27660e84685d448645bd68e951cf5ab2884d842ef542e640000000bed047bec861d27fcb78b767e17653b4d540d9f17ab684dbc2583530506a953feec1bafc00fbefe2e7d5d4d507e9248f1ad87064fea0a265f8a7e64815a8504b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430797423"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000711532f626aec72261fbf7d7451c816ceacf8632e65775f4e24e1bf35b59ec37000000000e8000000002000020000000a7139ce31fb10c6dd62ae865bdcdcf7e21044be1134c4e0b4be6cf7aeaca3d5490000000f033ae52bfa23817b4dade4a5596f47fa4e086aebdd55143f1403f3a80e17ac6712675e518f55969abf513fdc231d976fe239a18e1e1ab9e356bba0f5e4e08c6a40e316fd18482c707d07b9378dfefe7b90ce6e34f56a6ecea2c91613ebc93fe646dece2de22afbd236e852e21626872393749a24dd8ad2a8e94ea6817cb74190c142064681e3e8f48f7f3963ece894040000000b2ffe1b82dacffed7bbb967a77e876f22916b8d9eb5033b8cec060e8c9ed8266257e96bfcd84a10a8aa5f003841564d833dfdb2b24a1fb889a0f667445dc9762	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23EB1F61-634A-11EF-A6D9-6ED7993C8D5B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f063bafd56f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1220	iexplore.exe
1220	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2436	1220	iexplore.exe	30
PID 1220 wrote to memory of 2436	1220	iexplore.exe	30
PID 1220 wrote to memory of 2436	1220	iexplore.exe	30
PID 1220 wrote to memory of 2436	1220	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c20176416d05dc81a42cb03a6b9e6254_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1220 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22f38e4ebc2c3e888ebcb1ed2aa7d61d

SHA1
1ebc4c80fd34a8840580ccd37b8ddcf9cb60884a

SHA256
607bd22b3bcf8996cb35edc1adf78f2dbc59d7a2fc82a0a75f749b7b51ece910

SHA512
d4c8886d52b65e2baaad9b4529d4a4eac8b45c19b2fccb5bb131c14d001f19a6fac824d609591d6e77ce9082df87032e0b1104f955aa2fa69041295602877d08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b085ea89b065bed48c6684bac9f6a2d6

SHA1
4660ed94d615ca3be101900f8e6322199498e7db

SHA256
7238508ca9a5a78c2ad0931e6a5998d99e2ae5a31f8c8809f31599d7e61cddb1

SHA512
229ea78bfafc6238c5af4514fd7340c63ca3c2e7b317d16554ab338ee0b335e46d4c2fbb780815fde19b686a29387669100af06ba4174d3274aef5d414d08047

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73b49b5cf2ccb78fc33341b904941731

SHA1
f9b8290988b05d17d8ba2681af084abab37e9249

SHA256
257caf4104f90cd4f8993796e2d6956b970e11e80509c6fdc5625d9288f2ab6c

SHA512
08bb8eef4387c4a71a8319130b99b245c7452fa444843da35a3614c1bad17fb8ade012d978cd508770285f7a125996c559d8f51a4602606cbe7c1dc20da23a99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bb97162067be14119cc3de99f7a5422

SHA1
8894b7b47e3ffb92fb065e22e1ae24f6df389e3c

SHA256
0ffb4e5b78e5c0428b7bf831fb457a50c8bccd891a5a7a0b96d572c4eab32d91

SHA512
c949e4fbd7c52d25e3de4bb511131453394c67f8e35145f81800229c570051964284094d75c43ad37ef7a597292d0ff10a11d0a927c7f76faac62aeabfa33e29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b3aaf755767e9c36296de4a02475016

SHA1
f926abf3bd96d16e2519e76b38a4907227e80fa9

SHA256
8943b9a2a36080962f983d7eb52020a9a645f8631a613db0293acd7b9ca1c4a3

SHA512
922fcbb162679a755a94ddbe2f5055a7c0650e401aa233b83185768aa2d73e505c5a7f1d1584f1c8342a78c72fbb819a0649be532b7799236b340472fa07292a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
363c270ece1bb5d6fef8c21016ce1c5d

SHA1
db8174b4dc842e5225131898de09da21db44145c

SHA256
67bf82d51689a0900f0a5b4ef06fce5103de8721ba5b9a5a8f259aa03d53a4d4

SHA512
2f795ccb078ec732d4c61589c7c1c852b44122a107f2f262a58d6eb616e6fc883d075e742b52ebd7b57e4725cb77650eb123d14eebf943f671955ceb623c4bd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5701b38d1ebf7a551c1cd356020df717

SHA1
de287f22307caed853a53fb2949e62da17d9d58d

SHA256
6de37edf3b0d4a7a987848666e96ee9a075642eba7b1fd4d5b400802730f5d6c

SHA512
62aec5fe8edeb77849ed8430534437a5483a7abdd5f95c630b1f0095eab1428449e98fed0319a1dd07c9bc0eb011a8c67c0ffd963299b00d6a128accef88e381

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
163309a8802ebff9e62facd198924581

SHA1
5b74a0412959c3fb5b01a41b76d79c7228f10235

SHA256
617f829f4dea3ae8e9aa069eaf369c86c7d44ae534f4e6e30846ebd31b9b1417

SHA512
bca159c2a1e8ef047282f1b5333ee52ab1eefe57f3b9a939faa9d3544d92b0e2741a8afeb7446164da39e27b37b37ac695df26f2225958e26588d6ab1ea0e913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0452f408538fc70032dfe0d6c5e6f82

SHA1
83264231e5ba22606dcb4ce461d7a4a9788f7bfd

SHA256
e532f0a9606b72649cb1493ca1511456350eab9e9d4be3c7e44eda9d0b35ddac

SHA512
9518eed3ac9dc6519adc140f938a582ed6987f7aeeda1864c705c90cf39fe787cc6a59f8e7db6ddc8cbf619fda522c10e934c7f919495828f98d55adfa84c694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
979033e56afbc8bd1579f77084dacb58

SHA1
d96792995dd726bec1e07e05a8abf4d5b1370c8d

SHA256
17b530971033ffb7c054940703a221e0ef0b9e120657a1cc754384e1759176fa

SHA512
6b9c0de4751c062a2cb3d67b4712a8eea8950bfa662bf667bb1ffd6a408908d7f6465f1d79cdad376dcc65db362bdd93896bd93797b729e49a391c2d2b5a5302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9af4858cef95eea72586ff8cd286f39e

SHA1
e2a6bfa98ca5f7ea46e860a9de1384f0b3998e2f

SHA256
1797a47ad2c29d606417503321131f2aaf94f0161a495c22983623ef94fdd10e

SHA512
19d6dfc657c5a486b06f116f1194260f30409da1d52e467b8251916e7638e0432ee04c870c80334a9d5a534d3888bd182b5abd2e129bd75e826a1e34dd1ffcdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba29562b605267bf3b07063284e1238d

SHA1
bf37cc3be467eed3c7f9275ad3dad9724ebaccea

SHA256
e6d4172d021e1779627c20f0cd230eb1ba8c945270119ad8b1c94ee0f70b8f09

SHA512
2077853b96d43ab67d211fbea2cd7853f6c8913de5686d9cbc8f9660af82adcf945bbb20d8d30a767eb05c449cbf08f86f450289c4117a747d09a8b0e1cef455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c986a91487cf8ee512a3fb648dcccdf9

SHA1
cb013284a833f25d59db2f66e0793cd2c022507c

SHA256
929621b3463867e62b25db3ff8a60a59120aee76fff8c1848c4db49637f0397d

SHA512
06bdddba670adb97140e9040484bb2ebc713f53f62a968776aaf75be3de0c3f126697cb953c9f2033b7d0f92293c76ee8a743cc3253015b88c2b4a1100eb3193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee4b8acbb08f22e415e5cdd522204dd2

SHA1
68612b79444fef66a938fdc8ab93c6cd5ef6b54f

SHA256
2aad9a8d47e64a202afbb49abde8873dd8384476571d0923a24ac6b14f9f9891

SHA512
c5939f228029e9e8f511d8569c2a91284983cdbff0e40189bbe7ea76864d77275cfbd3197eaa785b2738856aa7046050e05232ab6f034f23dd991feedeae1284

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8f67ed915892b940c289181d8148877

SHA1
b1a7f72c21f4a330f9b386df2c3945b73140160e

SHA256
fea5e8bbf3bc1776495f0719bcb49854e349174df7674487f0ad0372fd7662a6

SHA512
19abd9c952f3b3af8364ceab971b4b900a9184b582f36c1646606e81e94424acab77f79af0f0ab95034c4eb6d7898149e9d0f447c6b20d99e07c0c4d7288fca9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c8c69a4f72e6042374d8bf3117b5abd

SHA1
f92877bcc3d91967ac1e4db4711c73ac768a5a9d

SHA256
410dca36e63afe2ca80eaff323e1594cc25c13be21c98f2b38312b6126f41eef

SHA512
95f5dcbdab393d4acddf7fd00ad92f0eac4ed8f0f94f8147d6eca4341926dbcba78e7290609050e7b7e94aa23c74d0a20923e3e3aadaacd2428ac48713765a67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dcdd4d2339e75d31bd4b79967fc77f9

SHA1
1978608dd06da48ae0e182db71983f81cd483258

SHA256
d6b873f25a6f7ed997500e4f308610d49f35c3c8933b8d34ce964b3d7d2664de

SHA512
f753776f987bd3be49b013bc06fe8a2040f022e8cd56b4dc21f13ee19b8f8c637c21ce7f157696572b1eac42e7e6f3c6475575f7e932427ed6f8c3354258612c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA21.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit