hxxps://discord[.]com/channels/@me/1221870519716941925/1221872525789888662

Resubmissions

09/04/2024, 16:30

240409-tzwz5acd26 6

09/04/2024, 16:23

240409-tvtn7scb59 6

09/04/2024, 16:18

240409-tsfdssfd8v 6

09/04/2024, 16:14

240409-tpm98sbh84 6

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://discord.com/channels/@me/1221870519716941925/1221872525789888662

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	discord.com
11	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-275798769-4264537674-1142822080-1000\{CA6BEE33-9A56-49C4-813D-2E18AFA38697}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
4752	msedge.exe
4752	msedge.exe
3412	msedge.exe
3412	msedge.exe
2892	identity_helper.exe
2892	identity_helper.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 812	4752	msedge.exe	86
PID 4752 wrote to memory of 812	4752	msedge.exe	86
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 804	4752	msedge.exe	87
PID 4752 wrote to memory of 3696	4752	msedge.exe	88
PID 4752 wrote to memory of 3696	4752	msedge.exe	88
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89
PID 4752 wrote to memory of 3676	4752	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/channels/@me/1221870519716941925/1221872525789888662
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb51c246f8,0x7ffb51c24708,0x7ffb51c24718
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13374618384166020958,15116415591300611012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
867240d03a0e4b102ee0d5e23a60d646

SHA1
563397b94f661186eaba18e772ec3e8f9b28c8a2

SHA256
ba91174ef19c77d9ba5adf656a5f863d18cc2561e07eddc7f341f8caa9f625d7

SHA512
849a4c1f5ccde8a060d649569380ca2418d823703756d519ba8f5f988fbb78bc91d24c16137a6ade19904ac5d877ccb3be0318a5ea5d6909ad906e426120e03d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
a48362a55554d0954365f09b4287ebcb

SHA1
24a5fe32d927be4b30689a4585f745da74299dd2

SHA256
c76550d006b93629264d4948049d8a0b3f363804e68938fb1924ef69c30823f3

SHA512
13ff9ea118e7fb1b11efd72f7bdb7d5e0d71d38cfcc8fd12e7b14e7b7eb20359c4f880cc8133acfa7e592eef34db22d644ab94087de1f675e07115d73ed5357e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a135fa7249a31ac31983eafc53399ad8

SHA1
10aa63a0663f9a66259503fa9a55cfc7d1eb01f7

SHA256
bd4f408a4b8476750525b0ceb496517b96c15d60e158d2ed63880044b0a6e601

SHA512
eaa9fe7c9cc895c74351fd9da74227b33140302cadf3afb7f96e20f9eaf44f74de05789754ac1a1f8f001d931cf21b89d9653e120fe001c7b38a267b6b34091d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38182b0972fdf7714d85d3027c6f33fb

SHA1
adbd3188848134592dc90b0a308ccc608d19fd75

SHA256
abd31d2f49e08983eee0e21f22660cc77a88f8369c7aac09343f742124e43e5d

SHA512
d077077e01df746380a9cf3aed629696a2be35416c76a4cc6a8be50010503e000c9e1e2c072787568cd578dc2dfb3029a087d01ac4878b112f0b87f3e2af1a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ce28a8403b9e49f06907960189cc63e6

SHA1
a38e4e5b778cfa5b21271b578ce21aee056f5c86

SHA256
01d269aff292674d944d76e8d8a33fd1154fc48beb1ee36912e8616c5fde1b48

SHA512
ba5506f595ba2e283e44b4987f857e487c0cf8057857f7121433be3560a4fbbdbce2b6594a960c3359f8d8a6e943f3b05f6c3820143164eca94c2ec389fd541b

Download Submit