hxxps://esss[.]com[.]co

Analysis

max time kernel
840s
max time network
845s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://esss.com.co

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4984	msedge.exe
4984	msedge.exe
2816	identity_helper.exe
2816	identity_helper.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4744	4984	msedge.exe	85
PID 4984 wrote to memory of 4744	4984	msedge.exe	85
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 2200	4984	msedge.exe	86
PID 4984 wrote to memory of 4428	4984	msedge.exe	87
PID 4984 wrote to memory of 4428	4984	msedge.exe	87
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88
PID 4984 wrote to memory of 3900	4984	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://esss.com.co
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7aef46f8,0x7fff7aef4708,0x7fff7aef4718
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10343742243466111044,854943927881331295,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3464 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
249B

MD5
4b5b5af9fd66938d7cc4bbd779ffa926

SHA1
41213d850dc537e9a6e30c7343f360e962e4e6e7

SHA256
f25414ed7f82aad95a6e2ec75c8b6cda525e190ffccf0f5f28a48565483370b0

SHA512
249f43c66c6ccf73ddb305832c9eccf544647df00021f67b0d86f5f5a43c8fd94a91b7069910c14ae5ff990e4f7db61602c3c4e963c6e205ed960ffa3267dddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
df280ddb2ca3051bd41a38cdef881c1a

SHA1
9c5760eb76ec88cb1a5abef76bf8263690e59372

SHA256
7c7f1a12a74b3c76e2f179437d3677fdda3f38db50a43dd8b58f72b0f6290de3

SHA512
3430dd2920547414ed5c7ff4283c0bdec4b048326b471e81d222402efc2086c0e0edb66a20eb71cad78929db1f255252464961edd4338518f8921a8d7e4dc2b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
abf24828f06a8ba6cfb2ade7b3b6bced

SHA1
1b11a50a2a9e121541010cdbc0f795acc8fb4ae1

SHA256
161f001563c1c14b9147b6d2c00521677b1465452cf394ed0a813055bf7e0286

SHA512
54e4e24169e1f2b0aa32337262ff3f34cdeca1e5ff41d66b59231b2dc20e799dca07fc98a0e45580866dfd3c7fa7977e27202ed2ce8f30b25dc999df4ddeb7ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6465c5ba2e09dc3307b78e547aa8c849

SHA1
ae5fe6821bb670f58671ac314002041ad2d94d71

SHA256
238f99869ebee975711da1b049c84e9e22aa918f8b0d86d95339534f70f89be4

SHA512
effc604a75c848384ee334c015480fb6582fbe3633a18bb18ef06e07d6066885a71f613ceaefbf332ad2e591787710670c92d9deced0e4a16bbb9764101d9e7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
09584190a7d30f3cc1b581f89c471c35

SHA1
4c5925538823b7dde420e6f353b3a65862d6876b

SHA256
b065d68bcd4fea02c3dec362a908b58cd005d784204c42d4d86356f6a0477dc8

SHA512
2806407ee915b1c208b379b2a1d29f900871e14d3e018646d8eaf7fc8fc61597ef62846230fd0dc88ad1e5e42e74bbca51b01f2e9e0b16d80eb17e0cce3c5587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a623a9ab007fe40b6772238a21961ee4

SHA1
99201751862fc618ba7d98859b085cceec180383

SHA256
1e6221b256a01a2077425733c47890eb0d102f472cc342d66f581c156658debf

SHA512
4fde1a8467b21095fc0162ea56d86c13cff380e9e71c28e52a934171236735f487df5ff7eee9cc75d862d30bd3fdbe82376ea8f23da3ff2916f95aee34aa0400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0e8ad6a9f2d204b425d0dc5d72e9eec7

SHA1
71c1942f13616611d349e6a7f45041e331ad29c1

SHA256
cb4e85d66cf3da35304df40c7e0ccb38db2600ce98b029bab2c8316169b3a8ea

SHA512
146a812d14ec9593ab5e0932b917a162128a061fa7b80734e2f7274f629ae13428c69e488d64b63e47117105237b8d6580eb21eb01789e9e089823b34d108d94

Download Submit