hxxp://rhcsa[.]linux-shared-pkgs[.]de/firewall_update

Analysis

max time kernel
140s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://rhcsa.linux-shared-pkgs.de/firewall_update

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000e69f79bf8ca7f55bf5b8e5d400f463e4942e2264ef0375fe7c435eb7d5438e27000000000e80000000020000200000001e97b958e717df387a14755a3dc76034a7e6980f9535a2d7442ecc9fb11f0ad590000000601b31f875b372f57ce5ffae8db536eb20e0dfdff67f8a905f18a79de8e780a91fbfe2eb08868fbcd2888bb3821caf9993845c8e078176892252ed3f72b7095b396ea3489339e0a0a034be4a304c4ebfac6f956b3da0f25a83e0e5fe4ca772085367177a48410f3f02ed31cb059dbc01cb1254b03b51d3f414a26f4cb2ce3e5d2fc3cd1291b44cb6183029b115dfb557400000002a860922763e063fe4281f73eb9b0a47889451c22cc311783c23b54f74db6834e770c98f2aad27058e594efd3ec3f07774d092f2ed2cce0bb058ccbebee2a0d8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409588324"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000abb4c4f9741f3f13738ebac4b00391f1616021a4156cdec0962947bf4a1fc6b8000000000e80000000020000200000002480c18a797b62be9a28d74ac9a0483db4a01cdb4b59af745167d995ef27e83620000000a4f306b1cdbd56e1f338eb0cb3dd2a3f5fe9475c42676419813eca6074e52468400000007d7d162317b0eb7e817f1eccb6e402b79a9c2b00a344af136a1e0465c99fa6391ddc14a88478f82f96af789d6d2c83636a4b08d55f53140d4c4beba460a12938	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004815b07136da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB1F3971-A264-11EE-A908-4AE60EE50717} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2476	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2476	iexplore.exe
2476	iexplore.exe
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1736	2476	iexplore.exe	28
PID 2476 wrote to memory of 1736	2476	iexplore.exe	28
PID 2476 wrote to memory of 1736	2476	iexplore.exe	28
PID 2476 wrote to memory of 1736	2476	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://rhcsa.linux-shared-pkgs.de/firewall_update
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce81672a6698e8145bffb3fa983c78af

SHA1
85fdce67416fcd1727b612b6015f419c97f342a1

SHA256
6f69d45f09f3d1a60520b843d1d322239b6641e8d31b7e42568ae8587e46f0d8

SHA512
d281e94de15442b084534c42187d68394e0d6bea895435932fd7bb179f98f080038d13c84e9549e8681ba4cf661d477b652d7151e2c07e66f1160d3d8637cc50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42d3b1609acafef03a5561f4251e03e4

SHA1
ad91726e9fd70459256dcfa5a0458283c82965cd

SHA256
19ad9f384121240f769ecf80dcf4fe21be8ee34c83274b70561278cddbd879b5

SHA512
22307fa2284de903dc9c76723fd0111674dc7710024655040e9f2124f363d288a4c6dad2ff0526bf0ede6853ad606ceae4a12a454c1388cc8533948e59eb3b39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b380f7770dbc435e0de79e355c19f26

SHA1
f0e0bab6b501a3d78146e7751337cd875f7bc0ae

SHA256
fad8c2e241108d3c1c44bc200ee0b06f0fdbe13b5947f61e1d8c1ae9130563e8

SHA512
3196dcf893b2f08943f45e59da5d37f7aede05fa43050f31ebcfff58a1c18cf66af03f14c3690697cd695af966195cc07b54fcd4f5db5681f0c4c2a5b6bafb48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85bbd1c6b01c237278d75b7d237a37e4

SHA1
b02ae2a2763668014ace244d0a5d3afdd5644fad

SHA256
90716c5c43b296ec13f68794fbe3ca8f586219ac32c890ca953616cb28c7d9cd

SHA512
184092a0da68ba308640660b997c2017242932928382ad4e55ab25da3fbf6659f4976f4efbf9ba6d24a4507a2f51489d95505ba52af30c4be944afddb9ac9a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98f827dc8424cacd89887b24b1aa6016

SHA1
a9dfdaa59af93850ba8f3157b03309daae6c7376

SHA256
17e7c7cc2d92e8adbdd39e67b87e567d0b5642032d5ccda2434dd9806b760149

SHA512
53a4af9332d80ca1595de9568138c7bed00deb14fdc3d3b72f1188a9655d2c6e8c171249c269cd9372220d34cf37cf294e2329440a374d08a67a89da1c380529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e1dd4aa83bf6ce480b57cfb27727c1b

SHA1
d2fcca966d377f92c1f5b86103f6524f5e069c4d

SHA256
2dcebf20efc8c89d2d26197316f5a2cf5c749aa50d0eb003a04149e7d5673386

SHA512
082a758f49eeee8879a7b0bef0ba7e9e56d91a0ce4675aa960a37c7ba09dc9414a365ae682a288a2ce21ba8a7ba6eb42190a0d6002798269eb1054bb775251d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98e4548e6245a2e8073fd6633969f46d

SHA1
87aeddf1174e655a48f8883feee43023ef5b9138

SHA256
6732981549f7dafe60d2522037635a1bcf6651f04d40f95f95b82aefdbb75629

SHA512
aea921d4ebe3d57b80f8914eeb09cd54e90dab2adbf8bbe8a72c2c27f35d5e713948997f3cca2b40520e2d9e72d49100c308aa1a4de8d98b968b499ab176e288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57feb443ced9bd1daf7bf0158026044d

SHA1
dcb8d3b7ed4a80cf8c009cecdb6bf789fb8022aa

SHA256
80c98a65412918058ee7ab2f90327d820f792f90f5d81abff2f972912bb97c80

SHA512
2a3b03d63cab268da5f447815463cb8a239a6b9d51a470edfccfcdc59c7f2790507248472c43f6b1e81bc0c1a6f178a4386602200e5e5ace0d0f55b63a29a0c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4e0658dea2f70b60fee783d96464e1b

SHA1
82b804f0059cd218fe363deb5226bb58378e8519

SHA256
f51ce5a8a98102a7eedd7a8099e7b723b3832a34f0cfb15837f9f6ac3eeb57dd

SHA512
86d69b2cc4b28e0e551659ec569a65abfccc5e46c8b2f78cb5d5e811f8a42e6b874d2898c06376cda36fccf62a9c4daa1f4143190c1fadba070d5853858b9086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40e90009438c4e3bdb933ff00651600e

SHA1
ee20c38fb95f83a495f975a546df48bb7d7078d0

SHA256
a9d77790f38e4902fffa9ea9a9440b7ef3de6fed8cf667217c7ab4e73a29b925

SHA512
8702176292dbc3354c897a073c377a28c98d323a0c72a8af781e90394471211b4b0d1da01e1707da742cbb6090b03cf1dd907675a8f57b6f74fdbff9cfb8d78f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1cb89027e08e34dd867aa5a114f08fe

SHA1
e6c5e00d134b691643fb8f2671ef2ee62fe5fb8f

SHA256
6b07042a820fade1f37a95de36e5bf83d6ac5666793d3c74eecaebc9fac2b95c

SHA512
09a900cece87b4a2b8694cf755408229905e1a61e993d41c76a74ecc6a340cefeec7aba0b3176baf5cf425c0008db258cbf33a6a003390b871bad164e64a47a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdd87f33ea13082fe852dccc3fb19a77

SHA1
4d093889811ae9a75fd4487229b5c7a70c710df4

SHA256
9b2b7238e7e84bd6071b1fde78f60e99c48ad573e5b8844c0bf1c26fc93acf9b

SHA512
bd3bde94e022fbb13cb1575637702f089b4b664ea20777550cc59e8528818a41ee22c4383dcde3a3d10f0a0cdb2bf068a920a0899555fc342a9ce2b0904dd0cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5944556612b2dd184306135a6a2dbce0

SHA1
98c5cc873fad859ad495ed712ee660a34b1f3307

SHA256
5c10a5f59b8028554d6adfd33e6b567d68e72704de72a12db99127b2057c08a7

SHA512
85331e7854abace04062424ba83760c43b73fd77267fc27da3977711d9bd83eb704c17e415af7916e75a33a5c2abb33bcce08c43faf90769fa62707f1e337cb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16cfb89eef25f2b3b66950b1fc9e20ab

SHA1
71d8508811fdcf4116ef5d8c4eb75193ac05f9be

SHA256
a955fe70acc3956d704583ab420dbd10abc0d20309f2baad0e28a1c6fd5be00c

SHA512
fc223acc7d32b3a0fafbfe41ca664c4f6d5b727e72c9dd8cabf278a758fe0e0459d993109741ebeab187e8b34925d915364595325ce526b0f821850383a19b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baccfc3727228073d990f5e33dc03e9e

SHA1
0d7b8a40c146956741524d22d2dfef04aa7be022

SHA256
3a6ec54f0916aeb740c8604c024de647939316ccc9aa4b31b8c88da25abfbbf7

SHA512
0aa7341bb63e48fb2692ba9555b9988dcf930f3da874b95213f2ead141407463eecb5fcca4bf4612b28df0fac85b44020346078ac4c0c3d4573f12d835997acc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17cde865a408ad607864e15f3b1c381e

SHA1
e7deb9c82c4638fa10756dcb6c4f22028d2fddc0

SHA256
2b5e5dbd8142e7466247b2a7a15cb6067d53c0c6be6133764ac0aec8c816ea52

SHA512
42678b78f4ffc4d079098e02dbddd7f455deca071f8e5c48c2fec1e8c18e6defa8f98d8c27682f0cb00290eda78cd3f5df872c7bd43dc642ef769ecd77840a18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06b0ab46a3f75d23bfc000c461fdc025

SHA1
d094b8e59ca5903e764baa504720e0d6620eb089

SHA256
99a53aa028056718c201325841c67bc696c2049df11f4a1bccc7c6b064d5b102

SHA512
c05747b424e7445d7916a311846b63b718757a76f70ee54793b2a1f127d26f9cc82a489e042b02f7b26a75a372af09cd51a89a616119387490fe334488c09c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ae0f78fd5626649c71ebd334eec90a6

SHA1
c08ec020d51c6560fcdf852ba2d68ce9d05f79d3

SHA256
99486f947fdf442d500c01e1c070a98cac8d1069cba032791b73c535cfcaef55

SHA512
4cc95d3afa22ce7aaf99b800090808e2a4208d00e578c99a624ebc3f6a0c15301e545b8d35c95678faabb0f38c15f1c51e9331932bcee7ad562b2261cd555165

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95a8adf46045275b2cda0988c0f4d385

SHA1
ebe993c6f7bdf98e7981d59d164369e877b7545d

SHA256
0440a21a0e582985981640706a887dcadba61aeaf4d6df1422d98599343ff09f

SHA512
32dbb85e70c18c40ac34bcc76c964a0eb08e09346d78fdd8a56cee972564c3df5822573d86f37e1f5744e221b1b82bdc771bc1a44081e6ad94e91d1457955f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6126.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar61D5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit