b72f9e2e44572e62d0fb97d1a289e3cada4292453684ebe93d7e7a1ab8760ce4

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

634266ad603fba710dc20bfe709b7c9b_JaffaCakes118.html
Size

907KB
MD5

634266ad603fba710dc20bfe709b7c9b
SHA1

33467bb67eee6b0fde3f553f113773106ff27642
SHA256

b72f9e2e44572e62d0fb97d1a289e3cada4292453684ebe93d7e7a1ab8760ce4
SHA512

ba5d88f478b3d07642f923c09647fe3808c5418f846bdef09b8135406c7aefe09b99797c04771b019f1b00b7a07cca1b597c452d0b6a139fde2ad08bd39e79b2
SSDEEP

3072:LpBf2szA0N/Gd7ZXtjgDJtdYyVeefXxOMQfw/vf2szA0N/Gd7ZXtjgDJtdYyVee1:CsM2tdYyYrM6sM2tdYyYrMpr

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
2248	msedge.exe
2248	msedge.exe
4804	identity_helper.exe
4804	identity_helper.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 4392	2248	msedge.exe	84
PID 2248 wrote to memory of 4392	2248	msedge.exe	84
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 552	2248	msedge.exe	85
PID 2248 wrote to memory of 1576	2248	msedge.exe	86
PID 2248 wrote to memory of 1576	2248	msedge.exe	86
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87
PID 2248 wrote to memory of 2076	2248	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\634266ad603fba710dc20bfe709b7c9b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f40f46f8,0x7ff8f40f4708,0x7ff8f40f4718
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,10916494853055128411,15033807017278847614,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,10916494853055128411,15033807017278847614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,10916494853055128411,15033807017278847614,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10916494853055128411,15033807017278847614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10916494853055128411,15033807017278847614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,10916494853055128411,15033807017278847614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,10916494853055128411,15033807017278847614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10916494853055128411,15033807017278847614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10916494853055128411,15033807017278847614,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10916494853055128411,15033807017278847614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10916494853055128411,15033807017278847614,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,10916494853055128411,15033807017278847614,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
512B

MD5
77f8186d9f7ec6a4eb9f72ec43933c5c

SHA1
fa4f86a410ab05192af9230584eed44c27be3576

SHA256
6edc1d855f93b1379d84c6e64320d4770bfab28073c2517f73e1c555bdd42bf0

SHA512
81167b17c785c8a2dbe82402a6d6aeafb004c021098d96ff7af095d1e22fc8bf9db724278fc6b4c9f5cc763df34ae76b3efd1c2811de9426bdcdbaf74118c8b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f98843a95af6e45eaf45ab2f26359cc

SHA1
721cc446ef1c18c5089bbf91e6df2709f414200b

SHA256
6e5c35223761fdf16ecbfe53fc6fb8b49df9d23bd06ca57b9f4b05c374adcef1

SHA512
661f1b47f3a3dd029f431c7b4579025770e0cdf8c4011cdba40db19d5b62258cf01f750ccdfe88aa3bc6c6a75bf8814852753ccb44060dd0877e6f9d29547625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
91c954fffe6b12efdc34e687471bd09f

SHA1
8445ff37dd7458f2732c6bf154c56d4d11bff4e7

SHA256
f6566a882c3c3989b405870c26745d34b454642aea2fdd6aef9a376bc9539853

SHA512
57615fb24334bb2b66b8042bc8cf7c7220ad2076b24c7aded0db7e432d3efe5e698a1b4bd2385560330830a3923d21e8bf3ffe45550f86d214e8163f66bef86d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7168116ff7fc9f540216c1d4cc9a2fc8

SHA1
0cc1b5393e1dc247cc55d2b3798cc1a8d83adb3d

SHA256
d13b18c0b45ec8c59740f7dbd74ca50973e81ba37399b4a3976188be59409b0a

SHA512
1d36b28cde8fcdd62fc1a65e36f3119630cacd127ab1037a5f4bc536439cfac19dfd5869c9ac57eb380dc3a0ea4f3e468e893dcef8eb7ab5b560af1252afd9b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
08afac039aac66f844526e76d09c5e31

SHA1
92b16d8ba65b39a88cd9b54ac03eb72d3a9fbcac

SHA256
eee05412f5660ef38c9d6cad8f6728c82d9fc282cc14e8a2bc08e68e1ce6c1b9

SHA512
f6e5045b6898c40f38b10752da2ed56d3ef447d27bc6bee8f7e27cd717247b931d21007e9579a3b71f6f113efc99318dae22aca4d87dec402b51504701f77de2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cd33.TMP

Filesize
202B

MD5
f64925c97580aa710bd539f7e8f92a44

SHA1
304533f7f45a506b69beb123cfef912b1b95bc8a

SHA256
a3acabfe1fb4ccf05ff4f53ccfd63335b213ae513b2f7c2fb65c1800d4b2c8e4

SHA512
84ba17c3bfdff97d86aa2402de4723be45f9d17d725840df79c2c9de4230da2acedaac821f6bb7ca6e1987751cb7c6f4a3119f04d9f858d900f215180e87ef8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aadd5baa-7fe2-4586-9846-4e805c8e638d.tmp

Filesize
11KB

MD5
338e86bf6824765c488e574a2ef89a7a

SHA1
65cf49bc2f058e8eb4b75960849e682e2ce2ce4d

SHA256
88f060c77f81fd6248cee327082fd3883fdea8002b9e68aaa0b0408b93122b0c

SHA512
54ae00e4b1f64f862c8b86f0f6980d5bc450d4037926eb89baa9587d112aef6fc0b9317a9fe5dfd220c3312cb64bed7cf12601777f924e214b824d9074ebcca4

Download Submit