hxxps://blackfridaynitro[.]club/

Resubmissions

26-11-2023 11:58

231126-n5nm2shb61 10

26-11-2023 11:46

231126-nxq37sha86 10

Analysis

max time kernel
92s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2023 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://blackfridaynitro.club/

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

960 msedge.exe
960 msedge.exe
4384 msedge.exe
4384 msedge.exe
2472 identity_helper.exe
2472 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4384 msedge.exe
4384 msedge.exe
4384 msedge.exe
4384 msedge.exe
4384 msedge.exe
4384 msedge.exe

pid	process
960	msedge.exe
960	msedge.exe
4384	msedge.exe
4384	msedge.exe
2472	identity_helper.exe
2472	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4384 wrote to memory of 4692	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 4692	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1016	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 960	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 960	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe
PID 4384 wrote to memory of 956	4384	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://blackfridaynitro.club/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa126746f8,0x7ffa12674708,0x7ffa12674718
2⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,18084243537857785718,873507991199969435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,18084243537857785718,873507991199969435,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
2⤵
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,18084243537857785718,873507991199969435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
2⤵
PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18084243537857785718,873507991199969435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18084243537857785718,873507991199969435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
2⤵
PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,18084243537857785718,873507991199969435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 /prefetch:8
2⤵
PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,18084243537857785718,873507991199969435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18084243537857785718,873507991199969435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
2⤵
PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18084243537857785718,873507991199969435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
2⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18084243537857785718,873507991199969435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
2⤵
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18084243537857785718,873507991199969435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
2⤵
PID:4292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1316

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
3391ffca71f07795cde4f2050a374de2

SHA1
c60d217cb3c03d9ce6d9529874c4d9d2cf401ad2

SHA256
3ecbb6548a8d8274d25dde6d3ef84f9f39d11fe53379f6f596c9e3b1b53ac3d7

SHA512
315f69e0318391bae6e67d311138559a1625958e190476fe84193b94757d0a450b2535dc859a7e7d4ff69be721675ffb0ac8a8951b7d76f6df3cf6f9e41859f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
818B

MD5
11aed589b5396e79e7841f1769b1dc7b

SHA1
cbc7cd2b648e4fb5b8b40024f5ed6ee5066881dc

SHA256
514c9a05c7c1d38f2be7f5c3333c4ef56c378b5cbe7e20b5e7dc2ad4ca89dba3

SHA512
14ce14884d14911841cf4396c7f51ce04d072daaf1f55b4287eb8bf0e6bcdf5101207877278ad67b3617f752b8b2d4057b767da4a7466c52b7dc6c2e71c53085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
1b8c53bc6023e58b5e583e0576735fe6

SHA1
f57636a3f7e0267415bf2fd49a7502df21674099

SHA256
dc9284a53d021beda718500aec08183a78df130b03da17ae15d80d51c8c7b6e8

SHA512
0185d24980da0bf914491eb5a6ff6e6baab0fa32fea9e8c51336a740f614b00dea586b09a3af2777c84a500827cb53be715ddd2011df656bed16e5291c62354d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
27727f30c3455decfc100c0333d78e4b

SHA1
d35d21f15182a01e45b44f87a8568be13f6fce5d

SHA256
dd85b8c1b04abba0cbf648103899b220e62ad356a9e2e37e6ac1676d1e2b9b3e

SHA512
ce422d4f6676bfd039318cf9eaf26db6399c3d5fd2d6cc4cdbeee72abf07c0662df0628caeeba2094658aa57a5e9ca48584fc7e081501aa4a0a9b28c8a94936e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
47dacf66d28548b1edf1611e06f35a1d

SHA1
a5129e874363c8248144badbd128c137d5fff75c

SHA256
3288a89af0d64c5aacfdc8dc0d906767136eb78208d50e0598c07313dc51a5dd

SHA512
08a18805eb46c21eff31ed0477843fad798d7a6c2ef0625cc025aa20026bafe045b22b55f9f9d5ac4c802e96653bfacaf5583c9f65cd161753c14ba25260c6f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
15079e413b41fda48975e995c6f70f9f

SHA1
7dcb3fc302eebb291b29e6555729e7f261baeb10

SHA256
d325f325cbca3f1b447afc1bf3f4b1309457495b27881caac6a6c9374d0f7104

SHA512
e6c928bf65d878bcf37b57c9dc55474ff212c56c1c15190fac751875f8ec1df27ca2a1e2417ac023faedfdec866b2471f77782efb7ee972dc5a7238f1ddf3b0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
2e17bea51f2b091e6d5b3f2b6b49c8f8

SHA1
694c9d67d8d19b6f054311bc3e096161436e26a5

SHA256
7d036e91f0a4b7dd13244ef9ddecc22348cdaa011ea37735faa2bee7bf78b54f

SHA512
bf9940d7744c68ff450cf2b15c86cdcbab3ea5ed260c2c99c31a7c4e56e905d6bbd23e6eba8ab8500ece61d02d03f7c359b4ad8c90196895d36d3eb2fe210dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
352b75a9e9f4a8870b666eedd02f71bf

SHA1
ee0cb32dcd270ad9aa347d9f42be0076428e9e28

SHA256
17eb08da88cf7cf7743bacd2698aab608e3fa288e3aebc2baa3216906bd9488d

SHA512
9658ba0cfb109b556f3682847051fc1ec79097ff1565402e1918873f428ac2b2f3f742c82e8d9a52f1dfe7dc3b8a0d0832e27bc058aaf4114beec9a61698a73d

Download Submit
\??\pipe\LOCAL\crashpad_4384_ELCAOLCWMBFFPHBQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit