c290c23603f87fbe231893280e241d256314577cd475f2c5667a6f49b9ec61b4

Analysis

max time kernel
1785s
max time network
1685s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

solaris.html
Size

189KB
MD5

5f111671956a9103ec0dd79cacb900b1
SHA1

66cae627732e3b9ca5629c6602cbb0008d2f060a
SHA256

c290c23603f87fbe231893280e241d256314577cd475f2c5667a6f49b9ec61b4
SHA512

0e4a94c5f3515c19f8e3b190e9ae73bf935c2828a3a119640f72d051acb5457f49fba024f175368f21b9c365765068b27363407de5ae366601250f73d6f65669
SSDEEP

1536:8KeWraVN5d8LbnVJoqYVrK4DsYCgmyyp7MPuAPV5SPz8P4QPfrPa8P8R4DJFPWTh:8KeunLM+NVllTrHy5dLKR

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3476	msedge.exe
3476	msedge.exe
4748	msedge.exe
4748	msedge.exe
4588	identity_helper.exe
4588	identity_helper.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4748 msedge.exe
4748 msedge.exe
4748 msedge.exe
4748 msedge.exe
4748 msedge.exe
4748 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4748 wrote to memory of 3980	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 3980	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2460	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 3476	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 3476	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe
PID 4748 wrote to memory of 2132	4748	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\solaris.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9af7846f8,0x7ff9af784708,0x7ff9af784718
2⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12705743762944269081,10624171321753908949,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
2⤵
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,12705743762944269081,10624171321753908949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,12705743762944269081,10624171321753908949,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
2⤵
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12705743762944269081,10624171321753908949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12705743762944269081,10624171321753908949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12705743762944269081,10624171321753908949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
2⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12705743762944269081,10624171321753908949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12705743762944269081,10624171321753908949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
2⤵
PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12705743762944269081,10624171321753908949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
2⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12705743762944269081,10624171321753908949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
2⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12705743762944269081,10624171321753908949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
2⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12705743762944269081,10624171321753908949,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
257B

MD5
a3302b80b2ce1805cdf6e1c58a4fdd35

SHA1
f13f3ceaf1e9b52f461ec33e7beab92b704c5cbc

SHA256
0fe499c642b673a60ddd7f0177abae212d8a17b9f31f0da33211f627b841daf7

SHA512
9f616bd7ce8b07b4c1b485b368dd9c4f05e6fe830ed62f48efaea0c2e1f42a9e2e64e2f290fe3ef9e6d725af80f5806274da819a352d38fd2ca95341b5331e94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
852d7c986e3c62bdc5047b3de4e98089

SHA1
568766a273bd8ec9bc648c4ac0f2e762356708cd

SHA256
11ae6a851f3179b254c81d24b0998bce34de0d9c3d8797c9feae1ce95fb2e4e5

SHA512
ba550f14bae5d16b4b3b15bfd8188644dc31656270187e332349bdbdd3683df1781f111a952cb572b0d0b70c85268231d214157a62f71442f4d374b43efe88b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a5f515f5e742f1d110ff698c6401e79e

SHA1
16bd408c31bb480a0ca79d1aaa8eea0bf5e5be30

SHA256
42e7947ffffe9b85b3706a7a79f54f0cf22dbf2fa7c147f0dc5b1151bf039f2a

SHA512
2d20c804688ea5e1c512b542978f08523008a05353627619346a94b6878cbc7b9e33ea47c72827dd9766deacaf1af28e842d157d0479ddd2bc0f09618c2a7469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
219a735f83db18797bb0c8dd4ba3d81e

SHA1
fcabf65a6005f51d8af9cda60c06d1fc1738f6d5

SHA256
975a783fde7a2187811bf00a47e5ef0216689c2577c395c861fd5477bdaea194

SHA512
bc0cd5e8597b029e26942af775dcee38e4b720451185e9821e6ea41f0ca4fa1ab6308f21169fb50fbc2833f8b5d754c1b12da63952c8feba2585aca64cc985d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e9dd6053c2341fd37427033fb7a15b7d

SHA1
22a2da29dbddf4eb6fb7d6a538072522b2d2e698

SHA256
a6ad6517032fad0a92ff11cbfff730a551061c8a36f19084e353959b73ac20a5

SHA512
253f7d1d0c349bf6decdfb589bf28b86950d18bbb6fc7d66412795b44678269a83d5e4ec1404628fe0c87a05b6227e2a22f2af50b198a4f770483cdb4e1ad910

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
dad38bf573873ab4ea2720f9a61a470c

SHA1
3780492e9f308cd70491d803b0324c9ac6176bc4

SHA256
8e039bda639e0fb91f44c9034b0507f84b1a1f61b13c5549e80ecbba6ea5f9e6

SHA512
cc6d1a354d3b684adb15f1ac5d247d7e962c6c0fa447c7f99fb05955fd6055edd82ac6acad8bce5222c5564e6c4a3a579ff6b3d4525361c559cce0de4d3ca36c

Download Submit
\??\pipe\LOCAL\crashpad_4748_RXSUUUFDOLYOJINW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit