hxxps://github[.]com/LuNaTiiiK/Image-Grabber/tree/main/Tools%20priv%C3%A9

Resubmissions

13-05-2024 20:39

240513-zfn33ach7x 1

11-05-2024 16:59

240511-vhrjragd9t 10

Analysis

max time kernel
840s
max time network
845s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
13-05-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/LuNaTiiiK/Image-Grabber/tree/main/Tools%20priv%C3%A9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
3092	msedge.exe
3092	msedge.exe
4764	identity_helper.exe
4764	identity_helper.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 112	3092	msedge.exe	80
PID 3092 wrote to memory of 112	3092	msedge.exe	80
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4700	3092	msedge.exe	81
PID 3092 wrote to memory of 4528	3092	msedge.exe	82
PID 3092 wrote to memory of 4528	3092	msedge.exe	82
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83
PID 3092 wrote to memory of 1708	3092	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/LuNaTiiiK/Image-Grabber/tree/main/Tools%20priv%C3%A9
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff875443cb8,0x7ff875443cc8,0x7ff875443cd8
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,11736454905953955978,15161251146513188353,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,11736454905953955978,15161251146513188353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,11736454905953955978,15161251146513188353,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,11736454905953955978,15161251146513188353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,11736454905953955978,15161251146513188353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,11736454905953955978,15161251146513188353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,11736454905953955978,15161251146513188353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,11736454905953955978,15161251146513188353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,11736454905953955978,15161251146513188353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,11736454905953955978,15161251146513188353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,11736454905953955978,15161251146513188353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,11736454905953955978,15161251146513188353,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1672 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e027def9b55f3d49cde9fb82beba238

SHA1
64baabd8454c210162cbc3a90d6a2daaf87d856a

SHA256
9816e980b04f1fe7efaa4b9c83ff6a0fdd485ee65a884c001b43a0cad7c39d83

SHA512
a315e1336c5ec70cbb002969e539068ba92f3ec681b6d863db95227fd1808a778fd994e2fb03f28f0e401677aa5f7c66813e315b6b99a5065384c49586f9782e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0c5042350ee7871ccbfdc856bde96f3f

SHA1
90222f176bc96ec17d1bdad2d31bc994c000900c

SHA256
b8b1cb139d4d19a85adce0152fa3c4f6adfb73a322d7253820e848c6f82afc1b

SHA512
2efdb535fa6a06c4f9702b2129f2dd07c330e37fd10b492f2236007c660c1707773c22005d1e1fa580dbf633dc1a700ada3b7b611ef9accd9555a17a244f61ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
72817fb01670c39b1a0a051d65256639

SHA1
946ddb3ac586a09af14064948cc3d6b8c3bac227

SHA256
a40e12a887d8723c616490bfae05617912208d43155c8c45c7106dbb85e3a7ce

SHA512
6d0145b7a7a6b4a84c59dfec2bc4ad65ecb8061e300acb62fc3d4b803bb8deb4eb5356ff40fbbafbbd986baba369bd0f670a97adc5ea43640c50d4d125ad7711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
82eed7f6ef92c6ef0f8e81dbb28b7dfe

SHA1
053e648ac8b91789cfab64112250d3ee6023d7ce

SHA256
0e6641cb544fccbd802fdbdb5d7c9d0ffb4c7f73c6f89ef2f05738e4f10b9f3a

SHA512
0e479ac82709b089aa78f29b9622e51b71f3f1d6b220bf1ad7144722a4cc47e5d428830e47b7fed74d8907f7b39828886133b17d1ac530d9668340a14cf0d69b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c655152e6889c6a39aa6b94b74d78965

SHA1
e15fe38eceeedcf957fd16b883381452f8bd8ac6

SHA256
aee5c6e47bcd263784f3ab17a00ddb6da3d0e0f1773bfaf6c0e24708d289e7e7

SHA512
8f1c2bed4a2d506bf5785cae6c2d4bf6394327a211818cf29ef8b0fcd5687f9c4f9d9ba9fd4285d5995d237582305c79ad619d2b83eeeede27783de5fba496bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91f0fb8767f15edded33f43b0e082796

SHA1
bbff6b67081401f6f9ec19dc2beb2c1480cdedaa

SHA256
24148b04d8b0c5de1039919f0151f4e518d80fee9390ec618b9d477f2b2a3855

SHA512
e055474edf897e9412a5f5d7a543914cfbf88065647a6849353df0290e51dad718bb8152b8db5bd8f6c2a187f38e15cc55ba23dcd1289c6c760c89dae02653d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed9b04e8bdad670e2d7c360dcf5e79fb

SHA1
1a407fabf18d9db9ed876651bf9b2f7ff224ada3

SHA256
a341677d55183485447b538a5dc3a8029682f579dc345fdb5ba91a727340159a

SHA512
35b94162b1c6b8934ce2833eabb9949de35d815e70078f1dbbd4d60487cd3e9bb0331833f26b334dc63cccb4f614619f03c1aa572fba58f2ee7ed91a4758441d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
9505e8634085da91a6d3ccf42b154dce

SHA1
5595c73e0cc8f0f0dfff511fbd6807d2ecef05e1

SHA256
07ccc60ab4dce5c009850ae5361a4fa83b257dd0bb030b7a5953d06375e39d4f

SHA512
4b90660c267ba2edf580fe13772d05d771fcd3074f3f6c1c4198b7b6bfd41e036f6d7e2bd4f011fd2e4e5cf1425d69c0369279c0c04916c15bc0fd3331cbd444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c14c.TMP

Filesize
874B

MD5
1ca193dce60bd4d1b4545ff6560c1061

SHA1
b0c02b25cd3e0ceccdbde3f6332d501180c680e4

SHA256
15c09adc249757a1e2dadfe9cb8e3a292db6254e7326968c093c9bf96d275b33

SHA512
85f0ba39e9eefc84a379a01e1ab92436be87b0cca2b14028f2d71b3fee28e6a6a57b051511def298b2cae6d1737f72fbb91d4a4d0222e18837712ad4f6178cc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
943e72db487be3cb2a145a927d56bd89

SHA1
eb1a01d026041118ca4a108d64b02b5e308bccc3

SHA256
0d8efa6c696c16f3916f7d727010709d77966f1144443bb069584dc3e11e0ae6

SHA512
57450d59dd24f133e774001df5844d5d553bc5dd1779d30769f47482ab679a12ec0bea67dfc2499d1259e42501e63676a72e580da420975b1077ddc750b790e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9aef75866aa8beccec1917d889164865

SHA1
28bef000e3e0ae50e2f19cbb920016a31de768df

SHA256
71198ce34426fe51affe08ebedfc069d7f782e231954214afdf63eb1f89f8c43

SHA512
1e06853eafb10c032dd8e4ad5b21835313da21a302c90ef62e9978e0931ace3314432451184ad61807e40ef485ec35f271850ca4e65fb90bc9ad865a0280d4ae

Download Submit