7e81c36a2a006c61e07d095c611cda3130a34f538491e8942f97eb6012d80ecc

Analysis

max time kernel
143s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4203914becfa720ab208a49f7a908455_JaffaCakes118.html
Size

6KB
MD5

4203914becfa720ab208a49f7a908455
SHA1

6b444f571ec4e965635b40aa46de5b3763a7adc5
SHA256

7e81c36a2a006c61e07d095c611cda3130a34f538491e8942f97eb6012d80ecc
SHA512

b9e3b89f0dc6676b7ffc5fa929076db840ea14afd2539527223fef956a8ce92ad480bec904b9c28e763dec283f2eab5e236ca4c032aea5f333ecb50139b7457a
SSDEEP

96:uzVs+ux7eQtLLY1k9o84d12ef7CSTU19cEZ7ru7f:csz7eQtAYS/Ab76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435014708"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45B35AF1-89A5-11EF-AA3C-F2BBDB1F0DCB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000048790bfa1888f6599da654af8128ae3340a47118f514c589fb16c91d74153ac9000000000e80000000020000200000005312102cd27cc9c4f12a93542051c4956cd0176f579ab2e3a7af74d71cec20b0200000006a2b09505fc595c602e94dbc2aade7e4b1b2a2c09e0c0a984e16463875caf17540000000d758529b76a89e16ea33ef90caf181b252a1f7bde786cea7332908e086f02fb16f5d759ee51f404872f50bbceaae4a962381e9a0728b8ab014d90c913b6b067f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ba371cb21ddb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000d373799dac6ea4815a54052416c41a28e18ff7c632bf22f4cf7d5972e797c095000000000e8000000002000020000000abcb3543673dea53011d1e1bf6c8042407219080c1ec75c7f438a459e3b5f66b900000003328c5bc022aaa59585e98545facde343b49476a57092bf696b968e5b56c8c34496db7d780f8ab6cdfa913c72d74abf3b21886b98ada5f163c15dbad7aa3dac7bf0bb8ce130ac310e9616ce4c90a28bf54fc178eb6b43a786e5da2ffa0d6b5766a37045472fd7e73e891e618a800089f82643bdf00e00a69f9ada3f4933920a54394c0a8068415a85c7820d91e75576f4000000011f1eb1a6fd6f85add5ed9b2688afce10ef318596bbe62e64e9f80f7eecc613af4434946099cba70d745f2ca61b780b03b4982007b80ef8a6aae3ae350dd390e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2320	2084	iexplore.exe	31
PID 2084 wrote to memory of 2320	2084	iexplore.exe	31
PID 2084 wrote to memory of 2320	2084	iexplore.exe	31
PID 2084 wrote to memory of 2320	2084	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4203914becfa720ab208a49f7a908455_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c144ae7cdc8ad6946a48e8f089709dc

SHA1
881887392afca750bcda00f16c5ccf6140de52c8

SHA256
3631f39ea200cd960a0ae6d651e5432f6952ca1d856b255665dcfba785e659b4

SHA512
4d89fe35ad7aadf753fde42f1847644d6561887de633e642c11dc7318c6e47a3fa14268e809c7afff9003966b949cad49af8060b1e526e08f0e1ce7ac5521f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30bee1ac471b16ea915e2d66e3a46392

SHA1
f5f26871817243986fb71ac4204232eeb3ab5f09

SHA256
3c5a030c489bfd0e5380ed728b2cc48a2ba211de10c20f1e400fe74254b36ea6

SHA512
7118bb76ac3a938d93ced0af70a66e13ce0021c0031c730450045ecd47b72d8bce21100f0ffc66b45a2d970d00e1ba8a43a8e2e97388bd817e8451097a801a0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a39eef0741d7c8197d1478d4f7bc7b0

SHA1
08ccca419fece2ef3323893def3e61089c9746c2

SHA256
3a660d2e25ca2e77e155c6052e14d1a2504bffef173284d8aecc558a9f868c85

SHA512
c11453695a4da56662a6b8fcf1a7c6c94aaff9a7dcd27ae02ede351a0dffcc5d0c2595b13001b618241640bf66a47ee4b40143e237385ca5b4bbaad3edecfe17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8448cce522ca54de547faa8a503661cc

SHA1
dc1277ddcc206ee64b562fab32f6038fe8c78e82

SHA256
bd0729e43076e2fbd1bcb6b214ea95953fcbfe8195fa30eeb2b7600c4b619bad

SHA512
31053abfc154549e30482fc4f3f3e2c78eb9c651cd46f3b6dd7c2c8afb4ea8dcdfcb93da2a3d1b14f7135b065c93a3ba0e48d451a3e66847ecfda8deb7762982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da640a9305ef8ca2e9eac896ee686c0b

SHA1
083e36a74b97209e161032d397d6ac5d9b4842ba

SHA256
939ee14c8383dbc182cd4e113dc052ed5dbd3f2465b6d2802f9f3867683514b6

SHA512
62a8c386eed9e8b6ffe08f972c0ab22ca4bd44c41d2ddf7fc8383fd9f30ffbdc0bd93de2cf8aeb2ba535eb4cee3e768696a544b284106a85f35675d01c05f0ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a145b278da4fb00abe22cdc0f53cbbe

SHA1
36554f19a5e7e7d4a3f3c9013cb8ccb299176f9f

SHA256
349c6f32d4859708c6694076729658a3834feee334b30f2d63cdb0db7ef15333

SHA512
50ece77e1858ccada6af9678895866db4015181eeb5fab2533ff04f4a0e76b875a1ce67bc265c30b9caa68d0a5276033fa8be2e09d051eb381c35113b503a051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8847f36864fe7c8071773f8e08cdf4ce

SHA1
4360d73be10764191edf0fb11d3b85be859dc334

SHA256
bbcd98f7e45e3dba97ed7d93b22c12d3d2e80fcdc1ab20f11e1838654cbccff2

SHA512
aa322dc52c2a56655561ef2ea7219f0a43cdbe3a92a56ca9d7c4de60ab10bf761499683e591e6bf2325f404ef0b2738495b2ea57d252f8356847a9cab662098d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4a6e51b749f64d71059e7961defaf80

SHA1
dd788a8b0c50be84b341a3a901423d6d766cf564

SHA256
ad12d13e5249ed9b64b9bf3909d48c764e9e3ed448bcee6b645a850913affb41

SHA512
4e56039b82ed9737931c32a10eb40c6fb626634b9535dce1d6f14880e00da0cdc9def21d630cd7ed60040d000e2fbb25643f3af5fd6ee5e8407c989d635252d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24be5ce33d9edbda9ac68e604c87653b

SHA1
7f7c0a00d6ea0f17fb35b7cb898ba347d72d1c42

SHA256
f071146e5c044cac72f72478f54c06633720f44781e9fcc1d59e1987fb65e179

SHA512
2691a3a981927e081f5b4309d1133d5b235ec436df04c88b7e1d148f150433aafc0b905eca19aa8dca27e025db4ef6db900ba30efc68eec932433da1c85b2f84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac80a096008cbea2d17f2b6efebf3881

SHA1
192af183ea426f3db3eb49d9ab291396dad0f060

SHA256
8b1f01a74f83427ebf1e27cd246cfcd40b87b8fb9ab80cb91ebe4c4aaa423e2a

SHA512
4dd1a65815d874f97dc0a9a060974d72c40fb559373f7ed7a6d627346ed2607a8ff84652230d8296b1de05e542ea266719e94f1658075cd25c56d48173133791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ea549e47303bb78af9850813a2a65f9

SHA1
abdc4152c8deb41cf6eede7fba5e986b9decd970

SHA256
9d0597de8c8233598863d67f56f684e305327c4317fce02fd22e6ca7a7883920

SHA512
60a7d71cf0f8223c35ecac799325b6d497ebd7d25dbd36aecc9de70a4b5ed26754bd36aa63453cb8654735026f975af93ded10dc13f09878516f278882521699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3ffe3423df185f4be6589b425d1e514

SHA1
83dd9063ab13dd12155625059bcc9839454671e8

SHA256
e9c42db3d4ed4e60b5c3d0b6256d8c8ff958c19ff8148d08f5e6870fe0ad225b

SHA512
1a9db4a39e26f2b447e30591b1bd72704322cddf4236914beb87de4956df93aa617e31292b3b2c718089d755140c5f99c0610be2aa373104ff6304f363920ad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5836d946735adcb1352d64533badb552

SHA1
8e34f2acd79cdeabc9ba68a280a6a95432b80f76

SHA256
7bc4c9fbb29cd36f4593f69c5a6d76912625329dbb930c3286701b3275dd0042

SHA512
1977e6db4adff5ef0bac2681a011f79d966bd8c80f8a9908e059b24d6c86897b37a38efd282345e15b089942c1cdfb499790fd95f81d150b40c704235b921094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b4e6999d2cbee097c825941781f968b

SHA1
1ffa07c6b75580e7ac5f52b28ae5bf4bf74179aa

SHA256
d1646572565d1c9d8260219e26639f6e7f77103dc34108fe2ce1ab00d90ac230

SHA512
eed57172b0fd56b7c8d3be954765343355b81f3a0d237cef014422e6347f0a0adc2b5c7da364f816123b6c1372ec1fc26ef22bef68ed0e0e5d3b2ebaa6337fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
006e0bf21a16b344245ba10f48d16cd8

SHA1
cfe0f3a8985406aac7792e6e353dea0b61cccb36

SHA256
b5e4879e1a41b0b0d8ef467c5228441ba9e88052b37a80c705405cc5adea74d2

SHA512
e6a68d073f3715e6c5010f0ca5f9ad1e764f35318c1b1291c7722b22e02f6221aacfba3fd8d022f1cfaa0cddf745db2f74ea0207bf1bf821703ece6bca9f31f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
867074be10798aaa7bb136eef9e495e2

SHA1
5c6ae02b15703d183cdd88135d7a22435246a87f

SHA256
724bb76933ee9425ebd81a2e549846d9258653a48271485f29e9a8b9462eb581

SHA512
d6f9e904dd50a6ad21c758efc860f1404ddaa299868c300b0d1790b5fe03e631260cc878c4b92d4705c5ba5d0285d677d6d3beb0ca210a1b7680367c6215289c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb6f2df67609607d427ee750ea533cc6

SHA1
a563ce8566388e495d35d771972509a8d44666d2

SHA256
51ef717cc07dd9d2aa51b728f2775a17db361bea9102f1646d1024adefe8aac4

SHA512
ee17c2a23530d3a0d7b7537f278785e190fb7b1497a1f8026374056ec5af8369442b330a6f76c05ff21423ec8b2352d58f61bf4e6e39c5b1f7b2e359896d4d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit