5fe4c3b3debc49b479f6a8f4b6dff6c449fe1bd355e88fee9a7a3ec5ee79829b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65951970f699dd9065cdb5b1a9766191_JaffaCakes118.html
Size

29KB
MD5

65951970f699dd9065cdb5b1a9766191
SHA1

91269c195fbd4d343f86da54995efbf62b65f79e
SHA256

5fe4c3b3debc49b479f6a8f4b6dff6c449fe1bd355e88fee9a7a3ec5ee79829b
SHA512

453ae2eda85c88c4d786e8b3f927daa4d26ff96ec2c18295ebedd296a8de816f43eacaafb16ecc05c42f308c045081112b5c0d102af4c7a44c290b591c7dc3d5
SSDEEP

192:H8KfnhD+iMhf0ekTRk7hk8L0dwAd2VxaP65sjrGlofKJ8zNJA1lhGTymC9Gzl/xG:H8Wp95Nk7hk8L90Ex4VeV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3440	msedge.exe
3440	msedge.exe
3264	msedge.exe
3264	msedge.exe
1288	identity_helper.exe
1288	identity_helper.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3264 wrote to memory of 1860	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1860	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1140	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3440	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3440	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 4952	3264	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65951970f699dd9065cdb5b1a9766191_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86ae746f8,0x7ff86ae74708,0x7ff86ae74718
2⤵
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,12651622969061546530,5495685455580314499,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
2⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,12651622969061546530,5495685455580314499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,12651622969061546530,5495685455580314499,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
2⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12651622969061546530,5495685455580314499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12651622969061546530,5495685455580314499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,12651622969061546530,5495685455580314499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
2⤵
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,12651622969061546530,5495685455580314499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12651622969061546530,5495685455580314499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
2⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12651622969061546530,5495685455580314499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
2⤵
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12651622969061546530,5495685455580314499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
2⤵
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12651622969061546530,5495685455580314499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
2⤵
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,12651622969061546530,5495685455580314499,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
0237a383f862a9ef66dc71ca30595d7c

SHA1
f1c96cf88b87e47b7415afd8026b29b884b4cb3e

SHA256
6a3983879b0351a5a091ec0e1956115b717d638a916cab164ed56d88d7142803

SHA512
a27584c6cb98caa546f58761ab5ee0b55e004e74d07f3f2cad7800ed676f44f202f9ce585c7f4c5dde11002f4b01b5c50f6bf97bc2fe07456078cd961db3b755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c47664ba6924456a3c9ec52852a9f851

SHA1
567ff15d9ceec294958bf9449d9717308c0d476c

SHA256
ec867c9d9cf5c0c14f1f05ee0c6448c32a7a2115f947f536032b7200655fe8e6

SHA512
aa9d2c3022e97b8ed264009714c24e510161bc30aa520403554adf85fea1d144f7fd4ff3a203aadc9dcd353fa56a7f9f260237bf06409324181687caf90f4f5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52614adc092ccd961261dcb0b1eb32a0

SHA1
b66b2d72b2234176b903591294b91aa4fa596b69

SHA256
7a4d81cf719b368f6e38e933353ac1382b13b6422ad53f1d61533e18ac420148

SHA512
c4de52cb45d4486c1392483c5ae511a65b94e03f9b08723900600b273a013ef6710af2936893a2c114fb60e97570b76c652b4cee6e8b307620eee384e91df66b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b65e819b973178c240d979a9222f8ce1

SHA1
4cfe3aefb873a882d54afce9fb05534159e4fe69

SHA256
4ebe27f367259228761bdb962e3d2231b089ae3e884c7925f003eb4f9c4c6233

SHA512
fe8fa4407d663eacea7e125b9a797ca7fb1199f929171bfb28d59c43d9653dd1ebbddf4af17689f0265c4f171f3311e79275601eac60562eadd922d62ad6e6b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1b6e3aad13b428e7ec25a3e8d1e55edc

SHA1
b2c6612e00b2fa90c883b2691a49f6e101d41931

SHA256
23854a7a7abbde74d72e3df3ded641937a2526cb3d0a430a08f8d2618f2d3d67

SHA512
fccdc928d8eb71e538de48b7cdfdde76ce3b0ce696dd9bb74b21471a1bc852d86240f60c674a18c4d6a3aa0dc957ee838493d19bff7b164582d8701a18bd1975

Download Submit
\??\pipe\LOCAL\crashpad_3264_MHNOKZELIDPTAHCT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit