hxxps://drive[.]google[.]com/file/d/1jEeC1bznQ47765ugntyIhyHeou52oD6M/view?usp=sharing

Analysis

max time kernel
538s
max time network
592s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1jEeC1bznQ47765ugntyIhyHeou52oD6M/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
4	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
4824	msedge.exe
4824	msedge.exe
632	identity_helper.exe
632	identity_helper.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4808	4824	msedge.exe	83
PID 4824 wrote to memory of 4808	4824	msedge.exe	83
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 4584	4824	msedge.exe	85
PID 4824 wrote to memory of 1856	4824	msedge.exe	86
PID 4824 wrote to memory of 1856	4824	msedge.exe	86
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87
PID 4824 wrote to memory of 2516	4824	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1jEeC1bznQ47765ugntyIhyHeou52oD6M/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffac6446f8,0x7fffac644708,0x7fffac644718
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7521612660444223718,11510177186179750880,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
c793ddad074d92ce5a2948aa63883c58

SHA1
ea754dcf917939f7a857eebfce5c8668b7b8beef

SHA256
2718ebdccd5c4cd760ff0329a2e7f2232b66d1a503f8135c0fc74e3585159d50

SHA512
dd8983199b046597edafc479ed27d2141c65822dc59e750d3bb2520e60bc0e789c8ce4a8588c4f9e3a5ffe9396fc23c9da8e5f36fcf9844e4dc8394f7a5b48cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ace345fac2cf635de8669c5f7bd1dbe2

SHA1
bb620b57c3053de089ba873a4782fc859cac5f40

SHA256
81bb3d7cfe4b2be4caaf4b7f966867f58178c228381887b0400adec953ae6877

SHA512
d1d61ad455cb91292148803a36d88e57b8f3a3b75eb3047345d2cde4256581f9dbb756530ca0bc84c4cecf95e32f424c27f84843e0fc4bec80b58fd39e06394a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3e48d5367533140a963964faf8397e35

SHA1
dcc076a87dd0b35fb921aa06c9e9ea0b3d0a3574

SHA256
4501f099d52b217305bb2505b43f0b44c44e911a825b3ed063cbd62b9b3ec51a

SHA512
d9be6f6ad80ea1ebb96ffb99f3595ba146ab136087c56462f55f96c6a4ff93151f2a244f4fe52fef345d6de6ddda87fdaa047d81ddc8e813fff3f0b57f40e6c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
13aebf9d3b4755cc8a1af360d73923a6

SHA1
f6b32ab6ad138089da181bc42bd46ac374fb7b38

SHA256
cbe2aacc12c751a765660938aa4bb3fabb6bc160ea1e62510ff00a7178cd252e

SHA512
5b0b3c1e9557f2fc496f0bf4f11676c27b79dee33b0e814564c635bad0aa3bdbae90950d3704346e5478d0da0a8f6fd4b4f6dce47e4f043ea64735777d72437f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
313894927761e75138ef41e78e77246e

SHA1
753e6aef891d48e22c51fbf66eba048b567ce4c4

SHA256
153f888f11e2eba26ca0af244ce0e0060b029bc2009a6fe3b751e7123d176591

SHA512
89698300360bca8b45b426bcfb754e924ca4c6917f235680348b87de9526732fab74a53702f86efc4fb7bbdba5765743a82710655cf4d73f9ecc2e388c014be7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4fbd7c20391a4d1621a9d1796cb5967a

SHA1
f2fdd482276e5c067ccabecd6f8dcac1a7a7e4a3

SHA256
4cca3c86586914d0f6a5e9416b3e1d6c06212c7afba93851b6626db96fa716fd

SHA512
d18a7177c79ed76f1f7e017408f6710dafa222b61cf7bcfcb1799c5cc0213962609dc4aef41e6c58578ad671e42d3557c4d801a07547da7801d77bcd196a8f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f08eb8b626e028d8f7f573e809b7ad44

SHA1
e50926b518a0e7b45a032cf4cdac1de6b6117aad

SHA256
dfd3d7e46a99ea1ebdc4513eaa385b77da6effebacb78b4840fa89a32807de3f

SHA512
bf8f204438d4a9657bc33272a13a3ec64088c7f4e22861ea72bb81a30d39627b2d0873dac9f07e93aba13f472ccbe371f9b6fd578930c811af57d89ac0c641be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3cb7cfeed638e4a1530fc51f2cd75c9b

SHA1
07e4dd8fb70f89e08784490fa35039822179fd6f

SHA256
652d867e5dcc6831035973c34fb5398d94d58d0aa06ee65bb59c7ef244e4b476

SHA512
f15d453408a3e8cad0c8bd389e1657ebc6fe785f3ed6281be3c35f9edc1587be9d11be9c2176564daec6d0d3470125cba54c5ade3ad3576e4f005646aea387e2

Download Submit