97a88acadfd9c243e5c047612fd02153e7e0130db31c672f94855ea576ab45dd

Analysis

max time kernel
86s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PAGO FACTURAS.pdf
Size

80KB
MD5

014adba57b2d1ca0e4a5742fd9fbc69a
SHA1

3e374b1feae0cbb82d8e27f44a26c9ff40f86888
SHA256

97a88acadfd9c243e5c047612fd02153e7e0130db31c672f94855ea576ab45dd
SHA512

586263c1fe84f9d1c5617174045aa76d8327c6cf88aca95ecfab384b469dc57f4adb79c539c0e899edceed9a3507e0d619e5dc532b932dd415f78ba0f5f4f829
SSDEEP

1536:dTXsAUjqyAmEECe5xGargdW0vPpVN+htruDJdmb:FXU9A7EL5pTJraPM

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983843758-932321429-1636175382-1000\{3FFC5A5B-285C-4CDB-870C-C0E3835E902C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
2272	msedge.exe
2272	msedge.exe
1564	msedge.exe
1564	msedge.exe
4384	identity_helper.exe
4384	identity_helper.exe
2092	msedge.exe
2092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
5104	AcroRd32.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 268	5104	AcroRd32.exe	83
PID 5104 wrote to memory of 268	5104	AcroRd32.exe	83
PID 5104 wrote to memory of 268	5104	AcroRd32.exe	83
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 3940	268	RdrCEF.exe	84
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85
PID 268 wrote to memory of 1168	268	RdrCEF.exe	85

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PAGO FACTURAS.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E3C3A87D2A798A7A1ED18FCF37F109B5 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3940
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EF95D01249799B0CB28E3E5C5FE255CA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EF95D01249799B0CB28E3E5C5FE255CA --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1168
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=68A45A82DAA6694B62DC89E3D230961E --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2028
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=35FFCC46052C55A2CA30192E67832597 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=35FFCC46052C55A2CA30192E67832597 --renderer-client-id=5 --mojo-platform-channel-handle=1964 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2472
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D2E794D0049D9796C239EB7770CCF3CF --mojo-platform-channel-handle=2576 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4188
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0AC9607DBB219B424B6335A1CC347E3C --mojo-platform-channel-handle=2732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ver-archivos.online/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a91146f8,0x7ff9a9114708,0x7ff9a9114718
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5208 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3940 /prefetch:8
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,16209730816306085436,165065457738819548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
    3⤵
    PID:3984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
e6c0c3715757a84802b41fab28ee5506

SHA1
e84d81c35f72e824f0e2b864bd695082b59a7591

SHA256
a875044a2e9eb0a5675a17d5eeae2345c4a1f779a6b20ddb1cdc7903cfff2b18

SHA512
32b262e1e131900845ce1592d1d4307d5d9d5dbbc668f5db15271745a04a7ca5e7d5555837d3191519523a109ff455537e92df14588355c5b68e5a4e7e9d638a

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
011193d03a2492ca44f9a78bdfb8caa5

SHA1
71c9ead344657b55b635898851385b5de45c7604

SHA256
d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

SHA512
239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
cfaacb1e3e17a5f31eb03b9bec457080

SHA1
0ae058ee20ffde36f1138d9e7242940fcaa7af0e

SHA256
51e4a67d03eea42179d247925116fe05b24adb6cd120c2269d32cae5795f4484

SHA512
23d2cd78da410fcc6cedc645b8c37449c5de0a7c93dada6f4556178e98dfeced2f0985115471b69bd631f3d993cab61daef1c6c263f134a9874dd4316eadf6dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
2988b6fca58423e186242c5be8e2fa1f

SHA1
a804ed14bb84ca415d452dbe37cee841635b8ef8

SHA256
494521e187808429b67b3cb41f093726f29361db8ae39859625671a466d2d2d1

SHA512
9e85d9638ce04c650a83279593ac3541484afa3222b410f0da974540e800a6dc7f1f03dd9366a14716e11927f19b26e2b5f61b276f37a9235bd28dd5897cd83c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
744be1c0063b9c0d12e7cd085670d283

SHA1
5e9667f1bb60a04a58f81709721191175f3e0662

SHA256
1dd2a4c49cd84633a5d18aed30eefe33ed92c7054361b983d9797d8d06f89f78

SHA512
23b17d0d83ff47731fc72290038c8c4d4986f5c258767b7116a9abfebb42c14d627f8380b4da7371e98a804cc74fba030fb8b7d9c3111286238120f7e7204098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4c5c4f53e03c47b87729411bcc25abfb

SHA1
81e1e8ef9db44640f714420efff7e97d1c222365

SHA256
4a1e0706a321ef4372b28811a6333c8fd1e4bfe5a8f4786491279959d600bf25

SHA512
94b01333e7ee09a855bf65f4822711622c92bb6e157a62142a82a19348f3890816d4db34ce6bab0bcd4d704a11c0c1a7f01f7fdb4e9d351abf8bbb0efc8b7005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5b4f60708a8e503b93af4455366046d1

SHA1
64ff738a386913e50ddd118c3fa9a04d50b1e046

SHA256
c325e47f12370d021f37380c7835855ff291b8565fbe3dd31f66a76a9e68a612

SHA512
5377bbc5c71494c942f1e1f453fcf6c5763056f7632c93f6a9accb31ecf60188f510747022c72a2b4805e6559494addb54fc5ec8c157ca2d9dd831befeee1177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b5b1f37f7644a36ed925a1b60c3e626c

SHA1
08899d54ddf2eab6a332e5a94be24241e2c16af5

SHA256
340c7fb651b90aae0b26b65326ef7ec2813d482c8df976aaac65ce44f5c59f8f

SHA512
85567d310f63fe1a581702c6ead834524220af5eee0f485692680dad82122f90189fae2f11333ad85e01322511b7ac2972dd28704ef66b83f7882b59631c7294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8277d1af2c6ae27c53ea8eb1c697c28e

SHA1
07af4650451a6611f4859aae143a4d226e30d509

SHA256
e5e7a256b37bfd133da16330c967c7912166c13a65e933366a2bb625bf833823

SHA512
9282dc5a373cc2d2436e65735837b080cfc615881d475facdfe3da88236fc971f99618e58b46cac42b48b50697c876bb5916a1aea3c4c93771ebb3644807c706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8a7e61837290e1c1e25a28c5ee4f6fd

SHA1
1b45af838f54d639e86a0f006d82d5a7b7686772

SHA256
ce027c5afff34d7dbecd2a9c85674ea39d13b3a8b7eb6c39923cdc6509cbcd7f

SHA512
23574818a48b66c3994d9fbad5d4156a9d863169da1bef6915bf4b065d2a00a15ea7b335d59fd729c2e0f10d77dc0f6cb0285dd8d611f88973464db29c6c7c4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eced787e10f91ca68e35caef74fc04ca

SHA1
7ca9597846968e8d450bb8f1e8b8c4fec48c0b67

SHA256
a82174e8c9080a4c13c6836808f3ce37661b9441da1b47b3ec38141bdf3ca297

SHA512
6e629e98cba8547c55c70d870f75b2e5e440e31442860ad4ffded28db68eb56fc6cd1e47587a83a8e506c5942f6d3d9c2241248c6680a20e90e928c0690f181d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f5b764fa779a5880b1fbe26496fe2448

SHA1
aa46339e9208e7218fb66b15e62324eb1c0722e8

SHA256
97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d

SHA512
5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
535f28574415612c8ab58de388506271

SHA1
8bf48307ab454957d99dddda25ca5fb694584ed9

SHA256
63972353508fe063189ebd28686a8fdf1ab0674f3fd4d2c6c2720f44b3a4e5af

SHA512
5d29370ced4605772619579635e2f62f05280ea30dcd2e47b6d1300042593f86ca48474682220385b1798fb07f1baa4bc016e38855a94334b74871747ed30d67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fabc468a836cd9936077f552cbeb42a5

SHA1
9285eb90b192695f1facd2cf0c0a2692da1fd3d9

SHA256
ae5527498574d347446a3ea19f560154a73a7781af127c7006e5d379597866dd

SHA512
6b2ef3b1d04401d51176267ba65dd03191034e095eb29abd6f13ada56a7bdd200c4de801ea5956660c660b108c0aa8b4f75545a3b084458670b87716e7c147b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
184c83070ea6ced62bd9f3a914917abd

SHA1
0e800bd457e753b5b822f690e12f32bf13359932

SHA256
5a6b0bbe7e481806e39207528bfc8c87e558c8e98cf14bdde2237f00cedd0da5

SHA512
7478f4a961f52a40aa30356b58e6956fdc5147a57fbbf4634efc7423b03413919971876fb8649ca3ba222fb4e3629f95bc126bc038b94c1a96377ead0782c668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5857df.TMP

Filesize
372B

MD5
d49686d7902ba6e2d3dec7c7868a45ad

SHA1
fa6eae29e680b293389d14f861387b45016facec

SHA256
e4bf0b52b6cd924d71136ed742b438dae17e4cae8aa789b38dd682598c8c83c6

SHA512
2cc27873abfed774ac65b56ed49afb981f4429934091b78b2390407d7a1c4335aa06856e0f4ef4d7533611a5377b807c581a99b8324146c3bcdc138182cb7bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
860876c6a9a1240d32e8e2a8368202b9

SHA1
586c57a6ecf248176143fc4ddbf534c2b11c8e38

SHA256
4c76c327e4c49af440c77fd3ecc4ae45140c110851b5b96529e5a8cbacacc810

SHA512
3311652bc9668042457d9b1fa4f3762c4e0aa55563e6f2d2ec1ebb3d2e55e2cfb91ae4de7388a55590667f46dfd31dd3c6791a7ce4e9d1a2f8d1abc806fcc35f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6f9b7148c66bc20b6b7ce19d01e29f04

SHA1
41dd34f8d5c187f2f779fdbeb0d7c67bfb4a6d44

SHA256
941bc5ad51671ee9bdbedcd46e595b34903431eb088a51235f584d1c0dcbca2c

SHA512
3001dc0730cd720736b1b3284391f53e5f72e583ff4696d6ecc175c8876899a78566a08db6198be524f463962d81e4af95c433d01a6a0be0336d343cecad8e22

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit