hxxp://deductionkeepingbabysitter[.]com

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://deductionkeepingbabysitter.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe
1500	msedge.exe
1500	msedge.exe
2788	identity_helper.exe
2788	identity_helper.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1892	1500	msedge.exe	84
PID 1500 wrote to memory of 1892	1500	msedge.exe	84
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 1564	1500	msedge.exe	85
PID 1500 wrote to memory of 3420	1500	msedge.exe	86
PID 1500 wrote to memory of 3420	1500	msedge.exe	86
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87
PID 1500 wrote to memory of 1188	1500	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://deductionkeepingbabysitter.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa458746f8,0x7ffa45874708,0x7ffa45874718
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5611959849178499251,79104373516323675,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00043122-1acb-43aa-8e92-8cf7f926a871.tmp

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
fde14021a80cca49466b59176d64a66e

SHA1
d5160cca197b48fb264801c5e2b968e5bb25de63

SHA256
0506717e18455a5102660a96d37839d84ef8235f8f8a3dde35cd316656da8f87

SHA512
1114fdc230453ce17b8b0bb93b421d375c064ed5f5bb08efb664c30042925497efff862d5c8f60e6df5d87bb6570d994966923580247b60cca1f240ffd2d5ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1ff6bf0c1306e4996edc44836f6abedd

SHA1
571c890160be8334aa2f9e5f4aef9de2ebc98331

SHA256
c1d42c3eb009d2e7b347735bfd2b6b3bfa6fbace18492b9c85cb1dab00436c66

SHA512
ceb4ad61d723417070ea0fc53c32534430b15d584f7f33512d0f741dc03ff9e2c4f7a84489588149eb4187973239911159d5941a2643cbaddf41e2da14087196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
17a8f03e16850329cb13ab5cae228707

SHA1
36c4be9daf26d267f94c6e192f6446e484d442ba

SHA256
2b314124d6d610f21103afbca1c7b77d67cf46999b57ada22c767d46035a97f0

SHA512
f8d15e4647d22408dcc97eef8b341112d9a0c49494efbb11086bbb5116876778b942004092a07808e4507bd336ca90492a01e7c2f6236c5a046c21a9d6209c9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1e4f1908cf398db99ab41711cf75491e

SHA1
3e5eafc97d1423a2c98526123238d12062f33346

SHA256
f4a2d94b2688e7ddc31d1c42f5446f4b18354e8a0285eed4f5cf53aa84449ec4

SHA512
27497c194e1857832900159530d2b62ec1a0efb214593a3c8e819165221b0f1975b434b4a69aa8908866a9d5257931bb38d27a437842c4dd0f73394d7d9871b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a94c5da2be356d96bd116d963d51af7a

SHA1
e486b9c05d86f994f9020832d87e57c6ee4a88cb

SHA256
ff840fea57362eaa9c0b98bccb78f4c0063ded12b74a18d106bdc30fb83b6e76

SHA512
5d82d66f0e91265b637f91190d2c1205d90c7f0108b3cd076b1fdabfe40eb497c93b3ccf80e413011a1f237a68850bb2c7aec72eff507f70a655a3a44333b40e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
9f1c85477c1370ef6026277ce040ce94

SHA1
e6c921ab66fc520855168ad3901f71143c857396

SHA256
c19d5ea2f14a86e997d8dd6180a6879fab860b04723e41cca973ecffbdcaced5

SHA512
148e97b3925007550d213a9a17eb1ca7e3f6f97921d8eeb24542f316e8e1e663586492c51cd45001be987f38156042232417ee90a0f3d477b36af7880a25d9b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586c03.TMP

Filesize
372B

MD5
7f815285979054009b8254bff3205c82

SHA1
2e583ba91b18fb75b440dea1821a3abc51b82d72

SHA256
3b40f4c71012ae35c9803bf230feab455b99cc4670c4edeee61226c2e0ab314a

SHA512
3a61c603ae085e26b72bc4d32dae00dfbbfe7b1b4742826d95684716b629f3ce4a74cf381b26691c04d29ae878d8af1d2814a784173bac5f5a97acc9fe20ba37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ce4a686a73cc8673303bb2c26f63bc62

SHA1
0e3890934b879a82ba3336bcbcbddc71cbef060f

SHA256
7ee596406513cfc92167a5a291347deb7c698a94db3b1ef66834d38a86a046d6

SHA512
9a2fe227284291ae3656dce285a2cf639b8ad4ea6261be247198266cef6337666c7e48859c74bce104c4d6d4d0eee4ab3929662f9b32ad74ceb14e33f74d123c

Download Submit