hxxps://excelonline[.]nel[.]measure[.]office[.]net

Analysis

max time kernel
46s
max time network
53s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
16/01/2025, 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://excelonline.nel.measure.office.net

Score

9^/10

microsoft discovery phishing

Malware Config

Signatures

sample_rule 4 IoCs

resource	yara_rule
behavioral1/files/0x001900000002aae9-89.dat	sample_rule
behavioral1/files/0x001c00000002aa57-256.dat	sample_rule
behavioral1/files/0x001c00000002aae9-287.dat	sample_rule
behavioral1/files/0x001a00000002ab69-286.dat	sample_rule

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133815217556519609"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 2256	4908	chrome.exe	77
PID 4908 wrote to memory of 2256	4908	chrome.exe	77
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 2788	4908	chrome.exe	78
PID 4908 wrote to memory of 3568	4908	chrome.exe	79
PID 4908 wrote to memory of 3568	4908	chrome.exe	79
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80
PID 4908 wrote to memory of 2928	4908	chrome.exe	80

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://excelonline.nel.measure.office.net
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa626dcc40,0x7ffa626dcc4c,0x7ffa626dcc58
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1656,i,11911479409689920681,13695595538448666879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1648 /prefetch:2
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2076,i,11911479409689920681,13695595538448666879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2156,i,11911479409689920681,13695595538448666879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2312 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,11911479409689920681,13695595538448666879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,11911479409689920681,13695595538448666879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4556,i,11911479409689920681,13695595538448666879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4836,i,11911479409689920681,13695595538448666879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4884,i,11911479409689920681,13695595538448666879,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2668

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
bb1fbd020e4701cd3210915c40b7850e

SHA1
ef6208b0b089b0204863da68a00713e89c468230

SHA256
595a45601bc7cb981ab1eba4cafbf6609ff7155439c51ccbc643a78eaf70cbd2

SHA512
76961c5af30b75f34d52e23899c351ebb47bab73a570b8ca7212b986fbdfb805c3d083cb4df0ce9c86c5e2f42f5f9a53176bfb52dedad7f60dd2f7a4b4175370

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
d4b7339153fbaf55f082667339e8bebc

SHA1
863967a51dfac2d7ba0220605608ae064a7e1858

SHA256
286d8e089ab637aeab462d745bd9874a3750db0c7b0b5412e259e8b1f90d259e

SHA512
c3a78b10e0581b81c5c5cbb92c0c6c0b334e64670ad543197fa8b4ec816d00c1d9c63f150e81ce16beb512a292935ab32a1caf884043ddf5b6702d4f44e37f6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
93c5b24d70183090e602430649427e68

SHA1
4fc9997d7e6dd5fb2398ca0dfe7a55d504c87fd2

SHA256
2bb304f979f7157f998f64c18655e7716f690401d1f65e59f0b56608f4e53df9

SHA512
22560d666e0c46686da118049d0825b0164d9f81c8ccde87960addda22736f1899cfbf49e287ce7ea202d426f88ba11f4833729550148229dcbed886c5f8ab3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
46c7bf46774ecc37d6e672576a95cea7

SHA1
8d4774f0b0071f796f76f1516246d6a0943dfea5

SHA256
bd58b6ad1cb5ca54ad1b23b8a84cee33b17999a3c114f8f86a049a1a60c536b3

SHA512
6e4dda3db72b5d11b7da68a5002215f1386dee505368b0246b0065180ac3e570277427f6079bcf9ce2d23bbfe1d1cb11c9a9fb0563a4f9022e28020a892945a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b61cf242ac1768fa58fc5fea9c1e381e

SHA1
9ef086123ffc604401a2ebfdb4e8fe73d24df0f4

SHA256
c96a4d5f460261be6b6e1e433f5a20b9cceba2b458f4ce91920ec204f158c8f4

SHA512
0ca472d96cf662c9aee9ef55f0214d8e1a8df0f56bad3c18499ce427e25db240907f2a44224b5cf340ca5f3350a5c1dc5e36ad092008ffe806d60bc483a05e30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f00e8252c7f7a8a1e0161b51a14f6086

SHA1
5435d92333b93fd808e16a5c86bde8d6ab18d8bc

SHA256
303c1f1740e616ae2700b239bab609696e894222b1441e318b5d426f39c4f908

SHA512
cd4d5b484da3cdf8f6d54b1c456adf42ca349be007467f9d661b3b105b91b01729116867703c5cebaa718308f7285d02a477e2c1ac74eefea68c0a2030d71999

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c74d1f3a-7b27-4909-adf5-4cfa14a32f17.tmp

Filesize
9KB

MD5
1cc1267c92fb60b23a490eeb621f2b21

SHA1
8aec41091e5701b159841833004c6d9c11004401

SHA256
bda486c34c387989b0d8d203b13b9c9496d614eda7e1e5e0e5c28957b2747dae

SHA512
d1ca9dc6273661ad639f2b9ca44f23237dc154d1add61ac86f0833a870a2aef289480090f9bd3b7bce1e52fac84ea8f9e37eef505d9d60c15bec7d8cda83ce2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
b60fb390d9179feb24ee67c10feb551f

SHA1
66988dca66ac16bdf3f7af3e2b5ede9610b2338b

SHA256
4c9bddeed14cee916966baacc4ccf3c87d50688899e3938a334d5d282a0461ba

SHA512
4bdec4a90cff680e1101e9281b997f101cba509e9317af83aa6497174ec50be5c6c013cfecae5e1f824e9722c5621dc2e9971d8e9441b0c4c1267f735977af64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
ac304ba5841b72864ed43029b9ebecce

SHA1
05e8e10752777a149abc2382744328c542e3adc1

SHA256
d35e89ffc8c982de02382a48797ae04e4c133fd3b87e0993214be7aceb4767ba

SHA512
384b2c1eec84a3d889262cae626e4716c3c51b04451f9b25a069ffa768914ef16bc689fc3af1cf4427244579309308e997569fdf6ac45947fab04e9ebe4cc129

Download Submit