hxxp://u003ewww[.]bright[.]directory

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2023 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://u003ewww.bright.directory

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1216	msedge.exe
1216	msedge.exe
728	identity_helper.exe
728	identity_helper.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3800	1216	msedge.exe	81
PID 1216 wrote to memory of 3800	1216	msedge.exe	81
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 3776	1216	msedge.exe	83
PID 1216 wrote to memory of 1528	1216	msedge.exe	82
PID 1216 wrote to memory of 1528	1216	msedge.exe	82
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84
PID 1216 wrote to memory of 4736	1216	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://u003ewww.bright.directory
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb31146f8,0x7ffeb3114708,0x7ffeb3114718
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2479940950495475678,2162060747898270199,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3423d7e71b832850019e032730997f69

SHA1
bbc91ba3960fb8f7f2d5a190e6585010675d9061

SHA256
53770e40359b9738d8898520d7e4a57c28498edddbadf76ec4a599837aa0c649

SHA512
03d5fee4152300d6c5e9f72c059955c944c7e6d207e433e9fdd693639e63ea699a01696d7bbf56d2033fd52ad260c9ae36a2c5c888112d81bf7e04a3f273e65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
181KB

MD5
4c75aa07dd23352ee1225b5a64cc6b59

SHA1
387c73c282f9b15d8f62b2c9d830945772c88c7a

SHA256
edeab1e3b20750bb1c0d394b111109c0c7ab74d34117d16ee1487cc1cb8c23fc

SHA512
a0e185b33114a19e6ace4b7f6af1983c45b124ecf4ce82f92ff832ad9a57ae895798ccd4473a46b9fd530831482b3ec3dc729b10c2c85095a54a6834c563d86f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
adccae1f38b6f4d2777347054c616ca9

SHA1
7df0c325f2b639e165ef888a936854bcda590e45

SHA256
d7f4913a144ba95185821ccfe830bdae47cbc9f93c4dacd2ed4d63511ee2d9b5

SHA512
0606c4fb58b1dad378da2a6d4243ac5cb76802dcb601698e9ee316530ca7160b90f1a73736a48e35a745054dd459840de766a1a6ca57610e4cf7e6166b8cb355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b7569f7029fff7b199fce01044785f59

SHA1
5e67da74d70eddee7f0cc534b75d6cb3ffbd48a6

SHA256
f62e5c40069d23926a53c59392efec0596ad1964a75b86a90601c2b0bf4fa04f

SHA512
f6fa9ac9c657f45e9af3c4f6ca27531a160d97e3cb1e2cf9f63469c4b83374ac6b039ed1123fd64694d4693e6e6a7dd3f72e8e112d7999790ce063bb677e9c00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c93edf994e5edc145d4fdd6782dc3aa8

SHA1
60eae0eab0c33219c908d4ee4054baac5763b9bb

SHA256
a7a4c7f5fb14b15ee0da96e53caa8cebb52b9a4a8111b9d1f2f47fc0630595f0

SHA512
563ddad2a58eb0566c96139509c323f160862a50f02460576a16371ba35d29b29ec9994e5286ce7ee4cf95f972ae76ce65ad4235e43855b866f841205b730619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7991bedd9ec076f5242afc2b496dc155

SHA1
086ab69e3111d7da91610b7f4584763bbb8a37f5

SHA256
384377472395f94ec90dec81e8294d6909395ec55f3d22ccd30340c0d3824563

SHA512
ab5bf4f31e890a9e1d6d12165d337cc68b31333598eb23d1038510ccc7c9f0235fa2a705260476a84b6468261bc29a1a2ef20d1ae5c991f2310dfdbf94009752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e78f9a3ece93ae9434c64ea2bff51dc

SHA1
a0e4c75fe32417fe2df705987df5817326e1b3b9

SHA256
5c8ce4455f2a3e5f36f30e7100f85bdd5e44336a8312278769f89f68b8d60e68

SHA512
9d1686f0b38e3326ad036c8b218b61428204910f586dccf8b62ecbed09190f7664a719a89a6fbc0ecb429aecf5dd0ec06de44be3a1510369e427bde0626fd51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d0dce83536019d5ad154f0dcaa1f3062

SHA1
615311452835bd9c8b7f4ccecc220ee6f773094c

SHA256
9cb8f62ee1dedac06cc6b399ff25b67e2ed522291bb3856f9a5b99f9ec09ea8e

SHA512
86e8cfc24e88de012897fb8ba693bd7b2ee1199d365b8fa2995364d332715863471798b2b05f3c758ee01bb71553204ab84870cc9f9d194bb9ed3eeff98895aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581de3.TMP

Filesize
1KB

MD5
ef7bd8bdc86fd6eff4f42dd90a2d884e

SHA1
8f09218843b8e6a148fb9e1d51eaebde59950d67

SHA256
e3c34da941fe0e46039176f1da891efc15b95927389f5953be50caaf09826179

SHA512
ab57cb9a8f8ba28dc7842e6fb5f879dc8d513bf33cada30ae4ca99dcfccc3bac05b5f0f6b0341610d92c1a4b4f37c351cb7913ccccf5e5a70849bb91789fa276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7f8c828b6ede7d9ff8702f7f67f68761

SHA1
8551f47c7be0cd4797564e47e00c8491b77e1a9b

SHA256
6fa3acad8003f547cb601f3adfcffa7eaf94b4b7e489f0247157c3d198b95afa

SHA512
76ef1c66fac97630a2805691cada836e433d6e49402749d5872b4c894ad372a3d7e3028fafeaaf67c730f39668712acbff23e610e70bd95050701d524bab69cb

Download Submit