hxxps://steamcomunnutiy[.]com/gift/activation/feor37569hFvrba3

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2024 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcomunnutiy.com/gift/activation/feor37569hFvrba3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4468	msedge.exe
4468	msedge.exe
4748	msedge.exe
4748	msedge.exe
2852	identity_helper.exe
2852	identity_helper.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4748 msedge.exe
4748 msedge.exe
4748 msedge.exe
4748 msedge.exe
4748 msedge.exe
4748 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4748 wrote to memory of 4464	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4464	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4732	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4468	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 4468	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 5052	4748	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcomunnutiy.com/gift/activation/feor37569hFvrba3
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe89b046f8,0x7ffe89b04708,0x7ffe89b04718
2⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17795936966343182289,9410268217178466454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17795936966343182289,9410268217178466454,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17795936966343182289,9410268217178466454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
2⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17795936966343182289,9410268217178466454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17795936966343182289,9410268217178466454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
2⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17795936966343182289,9410268217178466454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
2⤵
PID:1840

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17795936966343182289,9410268217178466454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17795936966343182289,9410268217178466454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:1
2⤵
PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17795936966343182289,9410268217178466454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
2⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17795936966343182289,9410268217178466454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
2⤵
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17795936966343182289,9410268217178466454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
2⤵
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17795936966343182289,9410268217178466454,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5152 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a65ab4f620efd5ba6c5e3cba8713e711

SHA1
f79ff4397a980106300bb447ab9cd764af47db08

SHA256
3964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76

SHA512
90330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
854f73d7b3f85bf181d2f2002afd17db

SHA1
53e5e04c78d1b81b5e6c400ce226e6be25e0dea8

SHA256
54c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4

SHA512
de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
504B

MD5
04bda35bfbe15ad92a9492cc80ced290

SHA1
ea82fe1137d06f2707d000e21e85351bc4e75701

SHA256
6b8a9ce9b69f9f2646c551308160de52ba782449fd9dc5ce3e1a4f0b83916d73

SHA512
01ad7282672ba9ebd8b6715cc5dca9cbd00297cd5928d650ee3ed619811310f947cc8cd756e028761220c6bb6417af56dc5d74402ff32008dcdae4db762866c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
480B

MD5
6d0c01882d4e24274c4500ac76e10dc9

SHA1
442b2303ae98636f7a88b079ba2a9150446d5d47

SHA256
894769be3f82c2a0a819b98760f64294089dc0597c3e1b0f76e01a5dcd65644d

SHA512
82f41246d8fe05f5e92393b6d28685802ce3f96bbde70e726fba6b2ea8e63adbcb0eb12c6844f763fab82e34b71fcc261e76aa8feb6365081413a2f90356d1bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
543B

MD5
2c43b9e0ad1a2b776573d8ec68715511

SHA1
7c0d0a32c499e5d29e7350b3125a1ee1b5f248c1

SHA256
d8e082d2dbdd75277cff53e8e46e51ef933de650c245c68c3cbf86240df0c685

SHA512
f75df4852e9b72b2c3b3d619fc37c48eb6d2af0c2dec9fac26a3703a835383b0cbac99fea6fb5bb27417a0d89df4d75aa66bf8df8402f6be77e736b060821d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2e613fb8806794c3352900bdde00794d

SHA1
d54a9f34a9513fa45b3546bc78ae3c05c65f0f1d

SHA256
e40badd6c6d2ea54b513bf5d84c3f5c6c5e5d5bdacebe3fc0ed01298f7f5832d

SHA512
7544039e78afd5be1a352d1a9a0a2fe094645015703b7e786472ba8f166a6791b04e4b8c0f2d160a9cc4994d959395aab390af7a373022ae1056aefb9155a548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3d14cef71c21ccd1e0beff54f6d32621

SHA1
6715a746ac2ca1d4defd2d338cacffa47c0e7e65

SHA256
c4a77378e9a44f38a1b375c896bb648d69470b5490d2df21350405c9d3a99dc5

SHA512
250c12b746f4fc2b146830ce4f1b3297dd38a9d133a2a43f19e11a6cf7ab8e2b514e536ec3b705178ddc8ecee00da028fa3d33793307ea4ffa786369ae7c2f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
b1c2a815acd07a53fba200d2590df3a4

SHA1
d93f88e1750b335874a29075bd9ee5475cf606ff

SHA256
e1f6e3ff0426ba26fef4ceb3abb4581bd411b788c8ff45875a7f587ab04dfb77

SHA512
a371943575bff8764b712c05d32cb04632b4fcd4bab3e2719b99e3af21c4a848104f4bd4e4267a1e3b58a3a03c766d041e3f842c0b984ebdd2a3eeeea65bbde5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_4748_QTCRZMHORNBDQFEF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit