ce3b03bb12ba0b83064867a7ac3241188a92311437fb21a4e187174704360e58

Analysis

max time kernel
140s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ba4a0252b7290cc495fd151b2066c4_JaffaCakes118.html
Size

28KB
MD5

63ba4a0252b7290cc495fd151b2066c4
SHA1

ea7a2cf57403db972729b26e0d6658287af0c56d
SHA256

ce3b03bb12ba0b83064867a7ac3241188a92311437fb21a4e187174704360e58
SHA512

721a30cccabea040b12e5517347ba5959480e32e35f4e653f741847dca46a64c4ccdb5c60e77988182d2ab0e8d56941d5fc6cc3534343fcb72b7eac9cf49ad0a
SSDEEP

768:V8LkILHmM33oK902FyKx+39IE0GDkGqPCqatetz7apAlk9G3O:V8LpLHmM33oK90SyKx+NIE0GDj6Cqatv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

1524 msedge.exe
1524 msedge.exe
4552 msedge.exe
4552 msedge.exe
1312 identity_helper.exe
1312 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4552 msedge.exe
4552 msedge.exe
4552 msedge.exe
4552 msedge.exe
4552 msedge.exe
4552 msedge.exe
4552 msedge.exe
4552 msedge.exe

pid	process
1524	msedge.exe
1524	msedge.exe
4552	msedge.exe
4552	msedge.exe
1312	identity_helper.exe
1312	identity_helper.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4552 wrote to memory of 3492	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3492	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 588	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1524	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1524	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 3220	4552	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63ba4a0252b7290cc495fd151b2066c4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc074f46f8,0x7ffc074f4708,0x7ffc074f4718
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11638733524944314789,1167342106791596504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e1340e9-a219-4e0c-bf22-bc4a907f5255.tmp

Filesize
6KB

MD5
bf4bbdd4592358a03fa98a3be14db5b8

SHA1
75bdf85fcdb681e7ffb0e9144837cafbeb75fac7

SHA256
3dd1eccabfeb82511859816f09b2008d7dc7d4cc9b9857630cf3e6fca429014e

SHA512
4da0831babb50d61b2e7604382c5e852db09c600ff7d5045948ff5ae01d8f01248056b4275e4f534cb70823563dc921ef04c2dfd712af5799fa5f16d2876e5c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
0600274ba420273000e6faf7605fe800

SHA1
e85e38a1bebae019ffe1fd9045d7b079a49db99f

SHA256
3d7f5d732073ee3bed585545522d1e7b61022a9883a86ee9b44d1cf7965d468f

SHA512
b63aec2b3fa66c95670dc666610821a5f4965325f3a0054b4372490f75d74dbc6a760b105ae7ef59ffdb8ffca57efa1c5bce3bf8b02efb1b24983e6116d4543a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d69fb732b7fe85843fa5df15410b269d

SHA1
ff580a99ad2b4ef7838c0e836a57d0e619c0d942

SHA256
75307a49b3b4342be9cc997c970aef6c9ab27ff4cc31374db9df760e6fec7a53

SHA512
5e1082a19117d4dfb76c3e18c34d465224271bc2881c7f7ff41c716b59c559522e45bddba34c68daea8519dc20e1910ff14b0cee01e4748dbfc385704e06cb12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b6f9b8e651020d5da39eb85426f9f63

SHA1
3de26e7994c9ae6514b5082d4181ade9a64ab3c0

SHA256
15cbdcc21d30295aacd68b7a98e7624c5da85548d594bc73a7992f895cb54aaf

SHA512
83f6ea6f0f0f5afeba585332ef9b6072e3e2ca4bd2c906a6a9ec59f78e45e0c81de36e1bbb9593bcb6b5bc696ccac61453536483fdd1adc6957abda88b19f929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
302c14a4869c4bff84a9a275745dbf7a

SHA1
ed1a3235487779abe8122cf5354aad18c3e05e8c

SHA256
aba5e63a55ec2d5470df35935c206cc3c9eab75540c18af18b98fc927f4fb536

SHA512
aa385a52bd7d186b6141dad1671649030e6f88fdc767b0b1954256ff0ece715e0da5870352ecd69e714994ecea87fee0d86919e5cc899c1bf0b8ca688c0fa486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9f2471511ebe63e01f53388fd5aabdb7

SHA1
5359996573be737d6e20211179718ab653166d48

SHA256
203ad226212b77049e778671a66e3063a2aa29154b3f98151ae880c31f694ab9

SHA512
dbef4233ee4c039fb20fa72262f07fc1723ecbe62c79aabfca55d37dc63da6f592cdaeb773b228b695709e7e862cf2faa3fca96621ed33f49e36e91c6478aa3a

Download Submit
\??\pipe\LOCAL\crashpad_4552_KFIUEVQGEOXKAXFG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit