9ce954d657d4ba130007363e0afc86830d0edcb51ccae66c258eac9349bd62f4

Analysis

max time kernel
132s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2ecb2310da02cd78e9ad52a50cbbfa6_JaffaCakes118.html
Size

184KB
MD5

d2ecb2310da02cd78e9ad52a50cbbfa6
SHA1

4e7924c6fb64a2e595ad128039ff405fff011fd0
SHA256

9ce954d657d4ba130007363e0afc86830d0edcb51ccae66c258eac9349bd62f4
SHA512

28dffef704d31b3c634ee08c2bd77ba092949f386788f98ecec456be901d888feb296d62438da627fb8e511035c5201e8b4b3186d473a2ec99efc140441126ff
SSDEEP

1536:xsPuhuTYpeWmyeeJN2W9DvG6TBrbd9kie5Xk1DSK7ChYaLeiLWwkoodalSsup74P:xsPuhuTYpZixxnP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000e1b672123cc9e359807d9aeb8988b8167c5c2077faba847a9236a0059bbe64fc000000000e8000000002000020000000e5027470c40b84f70883d6f416bc1000fac1fae168a97bf150a62261fa26b7ac20000000bd28d5edb8ea33d8dda95240554280205be8dd3fe809f2f77944b712cf58520840000000c062974dba357c361717175717afec84b2ba90c0c2344d7d09b38cfa683d0d48cc28abfaed359707d9ab73046ba489afcfc2cc3f47149e8db721ccd0e30fd62d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431908331"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d1d4a27101db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A88B0901-6D64-11EF-A27C-4A174794FC88} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000c362fb3410ba1b5aab5802302f4743254a2e841ad8f50669b33d4bcd94e9ac2f000000000e80000000020000200000004ae8f9e30530a37a228bf72fce899dea87def5aa9553d954e5e3db61a5350dd89000000055a7227050938ec37b6f9def162bfe7b7e02e99912f0a2d44922b99b487bc4c0259dfc02736c1c395b005730f2154bee7853e763ef6f9ee7f22a89bc4e29edcb875b5cf0c710bfd75db4903df613a200d33c1af8e7fded2b566b954e31ccdc0d3b6218981526c6410b145a380a3de4cd64d379c1f302bdc4690acd4db01e1cfec16703ed19a82814ead56372d7e3222f400000005f32170a30e80ac210b65b02118bb6b03d873c5f7af5fab8d0948edd3f6b56d8ca4917557b995b118900b03edd65be6cbae3584886af3622ad0b65c8344c0c3c	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 3052	1732	iexplore.exe	30
PID 1732 wrote to memory of 3052	1732	iexplore.exe	30
PID 1732 wrote to memory of 3052	1732	iexplore.exe	30
PID 1732 wrote to memory of 3052	1732	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2ecb2310da02cd78e9ad52a50cbbfa6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fd3a9def67a3b92f1e9f8ae8f10227a

SHA1
29e8c28932c0f5760f3753c6281e24cf78f38a8a

SHA256
c248958fc5cfea086df0f1a051fdc284c0f6977e4f4f8232d55ce70aa8507b67

SHA512
58c248546cede1074a938f736aff5f7b763c8dea248d294af6de1bb9df9d01019be04ebb2e9238341c4cea0511ab66bfce05ce7d398d1f1edc293a1f4d1435c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
434258f9a2c4e1435d21f307dc9b31f6

SHA1
9f86198920f3180396749c1e4f9c45c1eb692f28

SHA256
1adc413db89b8d2f6f594b2df32b4b32cd0bea54d0fbcfe2f83a37116b754f8c

SHA512
37a4cb10f5b10f8e187c4542bf2e884c26f6bc4cf5595b59190724c38d3213e88a26c6bec060b197d4149f93b921e233a9f0c464728d87ea9afcbab287e91823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30af2835cfced9e2ff1a565f2f4c6d11

SHA1
91c334e3d0c61982c7ae54924ed0062fc40773ce

SHA256
3a7a2ffaa64d5de5b733b838b9b000b2758dc249f69b3291c0241d1059b59085

SHA512
f213f18037a786d60048a2083597b931d941daf70bef294f5f969701d7d99a2a6096c49a16917091331ac9f085c8a68900d2f93b9fa66dabd8c4c25581c06ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57d459600e89f79c8f2087ecaecffdec

SHA1
4558805add0fcaba5ea13e9087aecc87a830a43d

SHA256
7bbd946a39ba58734f9794efcbeac52d01b8ca45a636b1d80360e03a660f17f5

SHA512
a8f72598737759ff444eedf166fbdaf6a0635c793e96de18c24099836a0a62db70346618405cfa44d8bb9e3d865d67c2199e8b0a212d643ef12327dafba38bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a205ac415c4955f751416251762d9ba9

SHA1
07a00289cd2e12c3f586c5cb05c2da0a613d772d

SHA256
9dfe00d7487d456b29377172c8639aec3625823cdb4b9ded2e31035571df9146

SHA512
2eb35e0539089ade7bf5faf030dd558053ab859170783dfd48e3f733687b6c5f9b02d4eeb5e104582bfc5baee36667453eb3a1e526384fa97c0b2c87262e5ce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c4c4afa658aec958ba1af26bbbbfcf8

SHA1
4b45190ad696868f85ff8fbc7d4634770202b433

SHA256
daaf27905880b943f00a8cd3eaf079ddf49b244d2447359ed919b11ea44fef3a

SHA512
0ffb5774aa730c5dded19d5250416cfb9820da5399e8667e86ea8fa8c52394f28bd79e7cbb84dea9d2edd29865b2e731a2d2a4bcd8d111624993a17ed3362a84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbdb311477f5962e2db955def71c4ef5

SHA1
af0a0ca3897b9a6e3cc091c9def49ca1d63fabba

SHA256
994a39862417429765711cf82f34226a0f6a803ec952a4887a090069b11ab73c

SHA512
ec19e7e4661887a746f3e2ac5e355908a9c9467e165fd72671d2b650f26e1a877011ab4352c96f20f7e863b4ef07c77ce78e385d75a9018ae89eedf85ea67146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7aadcaeb4d65be17f513d728feb05039

SHA1
4bb8bc3e7501bc7c14dec62a4a2c61e1080d8b37

SHA256
4b563d65f7aa2c630e61a9900d38aa687d76c61edf013975964a6cd8235d4a33

SHA512
677bd7b04a1540df6e860a2864c716c8c7cd028cdaf84180494796db2539da9522bf719a9275614950e7b9f89bf8d4d35a08dba7d445a0c1c7fd0d46d41a5876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7585b8396f37ec0df3d04308237f3cff

SHA1
dc06a1ba7d3fd75f64121cb811c5add2b9906fb6

SHA256
b4094d9b3731727587a1e12882fff845ddf6d26ff9aa4a360aa20afed0548f49

SHA512
57f58a7009d4f253f1d5b89d7a92316bd0e2ac4b02642ca3de2f410cbbd535d40c2cc4d0349d3ebde7d7f527a94fe8e55a3fd70bf6f0ddaf7730796bd3993891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
091a537ea133eeb50c1d303fccb98b9d

SHA1
2c80c1d9d7d396c0d9de3c212819de1275f0f8be

SHA256
fb550738c9bd5e3fd81f0c3a9e7ec69dc83255ea354bf80d46ce0358e0a7e36b

SHA512
920c7b2afb743e98d78e0c6a639470f5bb065369ab28fc4b46898687f60aa07de461c8a3010a5083c9c5275b84753c60c1cde84ab6dc3ae26884b8080ade6b6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c68b9034bf78bda73dc586659ed4e6f

SHA1
c2e72dafee191379f1faf3f16d5aa0d6d6ca379f

SHA256
929cc5f5566a49834c985b85fd1d19a80b32110b8005e7b5de9881e12ed34d71

SHA512
91c77c6c2873cbf1d7d23b059d47f7b0b5d5b56b0401f4e5b649a64e5978e0316fb7f5d77a04a54e76e1e909d7c4ec9b2d43dc452fdbd174eb2f42d62e8d438d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82fc840479bfff89c535c654da550c91

SHA1
6091edd038509707cd75e863dd9de9a0db4d697a

SHA256
c03a41bc27523879838ab640e8dc256da5b71e598ee7b4c1497b4bd167aa3a80

SHA512
1ebee092cd387531292e9a6858d0ef7da4c1e47885335a22038af2eac760587c9f1216a2079ffae50a33e7a7175e763edb1577d2e6cc45ddf7c1c0e0e8e48779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cadc54a44fad561009b0dcce19f2554f

SHA1
644f6e4e2b497865faffae8d5f131423cce17988

SHA256
7f0cc12df155b96ed8c1a372f7b5cd801edb0e2021088160853dc094ff66234e

SHA512
91520df69c598a915787763682d7625bf429d683c2bff3e483bed6333fea45fe0f36d2fb732d28fe6a121827c98fcd0aa562865ad559150535055e5ca028f2e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f993139186d372eee76fad187db246c

SHA1
b98b0c7b6d7dadd4a019f68781c11712f0c4e162

SHA256
0de47874e7bbf907262e569cd253e7134697692a86923845673e8614a6f968bc

SHA512
0ca6727501e0d0854f09e7677a1d295902ada93ce18faf53714d0a6235a497fd5c66f8dd984219671a5712dc4f9da9f8e7ea2f9385a80832c32818ac32dcf976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3d426cd8a1de197082de8d6a8a9a459

SHA1
7642a7a660fbd0b0c587501f59fa0463605f7189

SHA256
dc423f392f160963783bcb9645b541165b7f63effed8f08dd68448df65c21740

SHA512
84252e14f1372a177a8c8ebac445aed810859428a667206b3ba258b1ed5aab29ca4af9e1032d1833d990264e1ff395738ff74857b0a47b7027a4696af174f3a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e5632156ee1f0c05148b42a929b5918

SHA1
553bff883e0b68956114a9a0d84a9a9e1d7aa3e3

SHA256
506d48471871f88871cf528d0dd9153aad3d4a7deb0ff987acabf341e191bb87

SHA512
bc01c907290e130e91ec6a745ad5651e924eff770b58c91022aeebb8a41360acc714e081a5bbbaa56becaa6fb7f4dfb71f1ce0ef972c6159c398102926fec7dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f53c110b13025990ed59a1efea2aa65

SHA1
a9b3c8c7f61fd28b62d41c5295577f447dd2face

SHA256
4903fa9c7eec98ed81635ce06582fc4aaacf357235806c05451e8f33bff5bd89

SHA512
27c02b7f307109af1b48f0b6cfdcd68c8ba80de55b3302cbdc1a2c7d7cb5b13aaba900c01425631a63f745b7ead391dd01f185ecb53c3e603980bbfbd1f612da

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC083.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC3B2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit