725cef742812614079705d98941ce2c2657c27eca8901407225966cb1e8d9ed4

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6879f9c04dea4729dc8d53fb8f01bfe2_JaffaCakes118.html
Size

201KB
MD5

6879f9c04dea4729dc8d53fb8f01bfe2
SHA1

4ac54355b12cb7f270e5f957552e33f1a9916804
SHA256

725cef742812614079705d98941ce2c2657c27eca8901407225966cb1e8d9ed4
SHA512

bd970bb3eed31c5de79242147b9aa4bd76c4741cb62df019aef03afebd3cc9d1427d71ac8b806c6c6f2b562d880e488a4c3679ad83ec1cfbb52181e5d415f31c
SSDEEP

1536:kauN04MMCAOleo4nKbKbgR6Oxd+hoiNpnGyTjLK2GvM:duLHj

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3500	msedge.exe
3500	msedge.exe
1356	msedge.exe
1356	msedge.exe
3100	identity_helper.exe
3100	identity_helper.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1356 msedge.exe
1356 msedge.exe
1356 msedge.exe
1356 msedge.exe
1356 msedge.exe
1356 msedge.exe
1356 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1356 wrote to memory of 3752	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 3752	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 2040	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 3500	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 3500	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe
PID 1356 wrote to memory of 4944	1356	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6879f9c04dea4729dc8d53fb8f01bfe2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffceff246f8,0x7ffceff24708,0x7ffceff24718
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14928877861289210886,14492507507153206931,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
84b28e8ffed9fa0b8f6a91b5b31b308d

SHA1
efaf4dff37c34966c481eef0caf7dacee9e2a78c

SHA256
cf81f066b1ba1e869f5551bbc61c497d91035e2afcb750c3e63d5c7644b0b29c

SHA512
a838f81d13c5ecf02aedcdc60159f4b3f6e22e1f14c566ee3b2765e5645fe0eebabe24124ac018ea64986261c904e5bb50512708babe39bde76d7a5ab9280ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
13d8dc8e11d89d61912ce12c1a8b05c4

SHA1
dad073542a8f7697415b492795171ac98f540b4f

SHA256
20056b9802bf3fc5bc6b7dfe424e9874d288d8b3935886c91cee8cc1ee9a1a51

SHA512
866f3c229f9cfd3aea6d4afadeb01d782861e404483305ad1d826bb42d7cc8f587068cd8712ccb9c54f50018b611993dc7f67842483c52837ae1f373b3abbce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dfed9cb07ffba219aa7af118f1b0812a

SHA1
a61abdbf2d6095fe42fc0babb348a11c8767ed45

SHA256
eccfe05c279d72ab4f73ad8536e30d581916a168f1de8c127244accb84726e1f

SHA512
01955312ab89054ff03bd2faef6fe560e2e474847a79f9377f40667fda84919b61b8e3ba1c23fd575e2cdee13cbb240a3dc71d5a6943ee8b87bc2b3afe53abd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17ea26109481360a21783c3e3c767511

SHA1
2f808027639bbc0586acbab5a7c01fa20c017824

SHA256
8cb86b30cd06d4960fd89604d912e79a906a81656767431d15bfd0cef65f33e4

SHA512
cad53da54be2c57c986443b75db49d1f56a692766b2b0a502c323f0b2a202597b47aebe6c9cdbc27a2167a1e5005142f8d585a3d69782514310cabeb1e384a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dcc4084b4e029ff650b46911dba59288

SHA1
afa36fe89f0c3fe9bfb97f67b02121101c3093a5

SHA256
4887ac1d1067ba89beb4b7a18ebd721d2804c7d16248c50ecd26fdbd4da04cc1

SHA512
cd376b53aa4552ffac8b3ef14ef5fe58c7d4f18f2f5c2d49a5acf45d34eb359785ffe0a81750f9867b173b4cd4293dd2afcb183d1b44bcb133b16756f207d933

Download Submit
\??\pipe\LOCAL\crashpad_1356_FPQDZQGVEJHQQSHW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit