hxxps://url[.]us[.]m[.]mimecastprotect[.]com/s/17YMCXDA4jsPyAwJs6MDCV?domain=urldefense[.]proofpoint[.]com

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://url.us.m.mimecastprotect.com/s/17YMCXDA4jsPyAwJs6MDCV?domain=urldefense.proofpoint.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
440	msedge.exe
440	msedge.exe
2396	identity_helper.exe
2396	identity_helper.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 468	440	msedge.exe	84
PID 440 wrote to memory of 468	440	msedge.exe	84
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 4088	440	msedge.exe	85
PID 440 wrote to memory of 2176	440	msedge.exe	86
PID 440 wrote to memory of 2176	440	msedge.exe	86
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87
PID 440 wrote to memory of 4972	440	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url.us.m.mimecastprotect.com/s/17YMCXDA4jsPyAwJs6MDCV?domain=urldefense.proofpoint.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe43a46f8,0x7fffe43a4708,0x7fffe43a4718
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
72f009488bb955d6bada13d4bc617f36

SHA1
310e38bed757f3f912e4b998d419f49a65a8a281

SHA256
6eedac3a2257e55b628a50f51a8653d73ac7e22b69f068176d2eec4e9774651e

SHA512
028fb7ff5b58415d046d77f807416f25ee46145651c3be9c3f073b23ab2f416b96e4ae38534f98b47e24f43aa22d0a1958b94dc579e5091a6f5e680ada3f4b69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ef882f4ddbcf719d839aa8ffc9c17f7d

SHA1
622b39630d31e9954b82102cdd1f13c97c5fb6ba

SHA256
fba312d61d018dc0d65b052847c62b986a7c3d9b68db3f0f423e2a8013f8a053

SHA512
a9ab05acca293918f38bd7cda27355a5d6a36c1788f72c3dadb9c7b84b0aa816ae1c36a331774b9a23203654c71b88aef20cd4bfbf7408a8b321d842ba5f1513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1190443421f38e083b0abb48fada6ca4

SHA1
438a11845d055cb126df389992788c23b0193cd5

SHA256
e7c0ee6716a744c7deb0ca891de7eac162e0f44ab568e879b324a4790efca19f

SHA512
cbbe235572a861640f59d5e0c2e81596159bfe2eefc5ecef1e704d0b9afb2da5018887cee1c6ab844136915e1468d68616588e4c13e88be1724d567e7f64571c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
967219013ea9571dca7e9e3d1cdc4f7f

SHA1
24df8f51905cb3ffe19e1a1699949019814d5732

SHA256
5760ff60554b0f2b317d18be1eca4815862f2612ebdc8ca0e73244519313281d

SHA512
dcb8fd2efe9aa9763639e9cdb8cc7ffb67804f9ba90a6c3d87c725b01b2609f2673b99003e5400d01d37e1592992308a4de93f7444928c850265df31fd5f005d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e95e1fbee3e546afdec2c6e596919419

SHA1
026c81cfc03a8732bce851a4501df4e391b5a336

SHA256
c84bc890a3cf29b8840a62252c98661d496068f636e09c4e68f96c26cc623da6

SHA512
2a1045192ca4d1e947c369b34ce2a72db19387541c34d2edfa507a79340e41dc20350614fa40f3128a5b2103343448a1807ed378096a0f755cdba36384b784df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
068f82c109320de1da43ee5bec47b346

SHA1
3691a05b837766d5b807d18890d71bed8bd3738c

SHA256
a848b81b9f966870dc18be56b8d7844267e40ae9f4b515cf9ccc642ce59e956c

SHA512
4807cd5b4146b981e5e728ead1574dc9de3540cfd4da126ba3d4fb1effa278f2310e0081b3be0f44d3438563795f773a2d5f3c23110f340d8ac5ca58486bfe2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b3df.TMP

Filesize
1KB

MD5
05d1c2a1de5a766ffc933644da41280f

SHA1
1476ce38d261c5ec8d26363c5ce741f67b014c3e

SHA256
c69d42373867ab2c53ec243fc5fed200751d82fc70206cbc2fb04676202172f2

SHA512
a4be8fe4e17c5fc9cb1a4773d8a447c6573946f00c2043a4f8b78f5e56850a4869baec28cd7518b643f8382bf7bec21d803da0658267f6ce3f4574816e66b3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f437d313-9077-4e17-a0aa-aea017e194db.tmp

Filesize
6KB

MD5
745bb06b8049948e67175d3c93b23aeb

SHA1
1a085c2b643fca8729f0829aa488d6559a071cc8

SHA256
f594bfd834c732b2a6465ae8163a5b03af76913888922dd7170a92704db9b22b

SHA512
40358be4baab3aa19302793a3f3567443ce4b47f7ada3520f7f02fd8a72f6b84b35cdd40dc81ac67f4396b75998c4736aa4f67e63266b76ea9784f5d62c14234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
596cd4cafef8cee9519e3c85fe2655ba

SHA1
bb976ecfa3f453f1fe2ca190bde4b50755cbc0dc

SHA256
59435be1765c30446f6d703f07b42ec3739577e2cc9da518ba4c2bce04ca2408

SHA512
8342ce24be00f38e3dd8ae0c7ae2949cf8a21a14d8c894ad5394b0c25bde9a220b701d2d701db7d5706614e16c4e5c777e5e3bf62d4391fb70419d77756d5b65

Download Submit