4385eceafe26cc79afd73634620599999d8613c3a8119d3175c4f2728216a529

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db0b8cf327a6bc42c7c04f904fe789d8_JaffaCakes118.html
Size

16KB
MD5

db0b8cf327a6bc42c7c04f904fe789d8
SHA1

2b9c41b263e907791ab636f87eedcb41128dda22
SHA256

4385eceafe26cc79afd73634620599999d8613c3a8119d3175c4f2728216a529
SHA512

cdeb245871dd44bfa39866820a7302b74d2fc492dd7118a46b133fae26b413cd118d98efe4a424db8397b16e6eb3768d12507eb9c9d5734970c8b07ac0de54f9
SSDEEP

384:5crjdoN0/end6Dp3+eZTOVHG/zsuUXAJWK6MSpOFN:t02d60eSHGobAJJ6MSpgN

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4840	identity_helper.exe
4840	identity_helper.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 2644	4872	msedge.exe	83
PID 4872 wrote to memory of 2644	4872	msedge.exe	83
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4848	4872	msedge.exe	84
PID 4872 wrote to memory of 4316	4872	msedge.exe	85
PID 4872 wrote to memory of 4316	4872	msedge.exe	85
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86
PID 4872 wrote to memory of 2316	4872	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\db0b8cf327a6bc42c7c04f904fe789d8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eb2046f8,0x7ff9eb204708,0x7ff9eb204718
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3484124587703573721,6089957923919095897,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,3484124587703573721,6089957923919095897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,3484124587703573721,6089957923919095897,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3484124587703573721,6089957923919095897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3484124587703573721,6089957923919095897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3484124587703573721,6089957923919095897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3484124587703573721,6089957923919095897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3484124587703573721,6089957923919095897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3484124587703573721,6089957923919095897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3484124587703573721,6089957923919095897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3484124587703573721,6089957923919095897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3484124587703573721,6089957923919095897,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
da9f982339d06d1365d839373e4dad61

SHA1
645eb67bc6f2ee26a54af276ab0265ec2a7646e2

SHA256
2fd3ceb7a592b386883f72c84bc510c95519ec073e16e72d6e5d0a4a7ad84832

SHA512
557421340e63b8b41f152e1140fef03114d18c4b56df380d39e0772db24207aa76cc302ac8c081ae09e7e6e61b809f4f9140c047cb2945506cdb0d4750af9965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c08b7a6b89e1db6c8be47101ed01f95

SHA1
dc8cc31e2d0915e3aba191a5facaf4fa67590f34

SHA256
d7cd54d4f687e9b377a3f86ddcee25ad84b1dfbebd7728032bac94a9796ddd02

SHA512
2155130502dd8659bcb6dffda771f3758b75ba7ff454b63a0689e87e6ee050b8cfd10d71ea2280232af5c05bd8df4094840e79d3997d117a80565e4d754c9c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
883c829d471de89169b9b860cd31a1af

SHA1
e75e1ae4e1b2ee7f6f9c0065cb14c7cba998cd56

SHA256
3f7b3898426a93aa77897ad1fae49771e21568bfa8b660a209221ea19d04520f

SHA512
b5c5fab4fb76ce8e370bb96ba6975f00273bc6110eaff1ae0c027990c98c363a3f02ab1268839992842bd0a8be7e56e904d4ad852a0d66ac4450d4fbe0824bf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
6f921a077c42b6b1007cd563b013d0a6

SHA1
0e8ecd27c4ce84c7990641d191dd97fb825760d0

SHA256
9d31345c99fcb8dcba006f79383f5af3ad6fd020080662277ede24d9f682f749

SHA512
333a587f493bafe29c85221690caf9f7fdc92ba05296a2ba47317dfa6d0e84208d783901972709ca8fa6dc5b0aecc77223ed96509649a4a6d86e1ab974d65581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5828e0.TMP

Filesize
372B

MD5
6cf3a6354690788a39fe38f9e57eecbf

SHA1
75ebaad86ff16b5c8bb6d1035625e58ed7771f03

SHA256
7825bd46d65fa539f0a953ac9de676c1d4f0f0943e7ee2faad4bab1c0dd0754f

SHA512
1963117bde67014beabaadf7e38605baef6481d612e21d50e92e4bab9717ad3aa073ceb4fa50d143ea5c335069896d3e11cbfbf39c60c67ab6682bf6b9f3e5ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
393d6ed123a1aac1588e1f478993b127

SHA1
f15c4c9fe0fd39c9392587034984da3453ca156d

SHA256
dcdfa82e2c96a33c55876836516a21fda49e4ef5695a3f509763b5daf16818d2

SHA512
22469a87b47db8e21b28688c6c6a9177062fac25a4d81b31ad3ed03added813f224c3d2a05647d72d3d46552c58ea400d90903bfca645c98cf9e9af79589e9c9

Download Submit