d9568dcc38a948a52caa6d7e6e34971faadd5a0f559846fd7b4566255e9e39ea

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ef07c0c31d2962320ed101a60b6e5108_JaffaCakes118.html
Size

48KB
MD5

ef07c0c31d2962320ed101a60b6e5108
SHA1

1e077ab84092d9f49b1e37503b996ef61e07a11d
SHA256

d9568dcc38a948a52caa6d7e6e34971faadd5a0f559846fd7b4566255e9e39ea
SHA512

672d0582f1d739328f726e6020e7b2383d764af72abaed51c8a44200f85469be1786c7791587885488e805d90d443e1de5846e6de10cc5bb5d48d96e9c3598d9
SSDEEP

192:xPhMCkByXIwcY0G26FFaGUuj2xjfp6J0z4jSeSlZAavcBcjfVbFmg1zzmP1G5A90:xaYgSFFtqfp6CcOAavcBcjNbY0znG/Z8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
1224	msedge.exe
1224	msedge.exe
2628	identity_helper.exe
2628	identity_helper.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2748	1224	msedge.exe	82
PID 1224 wrote to memory of 2748	1224	msedge.exe	82
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 5052	1224	msedge.exe	83
PID 1224 wrote to memory of 3148	1224	msedge.exe	84
PID 1224 wrote to memory of 3148	1224	msedge.exe	84
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85
PID 1224 wrote to memory of 3480	1224	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ef07c0c31d2962320ed101a60b6e5108_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff636c46f8,0x7fff636c4708,0x7fff636c4718
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2894258794714244396,15562407187427155992,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
70428ee74ee3943399f27caf9d51fc3b

SHA1
df6c7508391dd5e5f4eee14b8d6a80c6d8cbfd20

SHA256
f8a9f468cf3fde9f5295f88ce3957a2dd50f1dafc3d7531c46ac9f9ce9850576

SHA512
30763df2353f7f2eded243870334856c5f91c2149026f436b70740cb58cdb7ff8f48897b69d2827f5cafb471c8bc4aa76430633d65460921f14d80068e3f2fd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
952B

MD5
0193735cb18aba33b55107d95d7b477c

SHA1
4f1fe3c57ba589c83fbd66870f300ed9a5350254

SHA256
79605d1fa77236fd1b9f07ba16f68a52b74901618a55144e086dc519f6ac0fe4

SHA512
a74014992cbb06738b7319c00f7d47eff78c6bbae36a2527a819eac4a8d0f176e725cdec35f3f5d86d855d28cc3c41088b85f31740c03cbc681a897760e46473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f96ac7cdc29df8199cab5487fb78220f

SHA1
d8e7f735170821f6a14a742cc403d4acec072dfb

SHA256
8fef6df46c39da2abcffba98512c0a6d9999fb61cbcf122545acd3a278b79525

SHA512
0bb289ade6a813c9ca5eef89a8134af26b287d2f82d4740fd5e14adf80eece3b911a940b8899ea55886676628635eea523bcc2ccf36750c115cc89681e9a5486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b17acdfb7983a31b724e9b0d54c2336

SHA1
31d603691e9c3cef5d9b23b5dcd1d49991a85390

SHA256
0d5e02c2f2f48bd4098d8ef6f7b6463a1739aec268e3eadabd365ff76f1052b5

SHA512
e4bda6b5e5e690e3482011abc110414735b0faee9d7ce5f6a258bec9e1d02cd5956a9358c3b061639fd0db44e47a3d6f2b89ca6c9b4f48d24d1d6e552a42dc06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
329eb5ea524f8adc2d55134c7a284b57

SHA1
ab8b086ce3e74c57c62d8179a7a0d03e11a3937e

SHA256
5ac571025754ea977d4dcec0c72e91daab5a07837044e25ca28961d3d889a091

SHA512
b5a1d7593454b8d06cb4ca4ce1eb893b2988ccbc639e5ebfa89b9ef0c015db9844c645157acb4456b8034aa65e4c084d04a8bd79c8f7e01b1ebc38640070d5f7

Download Submit