428f189bfd902ac326313cbed6aaa9a9686393e62a1f8e0b2b0fae0fdb99c907

Analysis

max time kernel
1859s
max time network
1877s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
21-07-2024 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PolygonHack.exe
Size

609KB
MD5

52c2c76aa62ff77b0859f49ab3098fa3
SHA1

eee46837171761ff6c606e9d9d9b3af31f0232c1
SHA256

428f189bfd902ac326313cbed6aaa9a9686393e62a1f8e0b2b0fae0fdb99c907
SHA512

916fb1606a588ba376b61059b8f8e74a515faf829fd4f836c4c1c3e69c1718a5259f34cb358b7a86d099d50e0138cca5e34dbaa740548d390585fd8e88e135f7
SSDEEP

12288:jXNkMT0lw9fZhpudjjiCvTnYv9L/Z9w0QnTsv7WR:jXNdT0lwrudjjiCvTnq9LR9MTc7WR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4660	kdmapper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1492	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3004	PolygonHack.exe
3004	PolygonHack.exe
2712	msedge.exe
2712	msedge.exe
2136	msedge.exe
2136	msedge.exe
4936	msedge.exe
4936	msedge.exe
3704	identity_helper.exe
3704	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1864	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2788	OpenWith.exe
1864	OpenWith.exe
1864	OpenWith.exe
1864	OpenWith.exe
1864	OpenWith.exe
1864	OpenWith.exe
1864	OpenWith.exe
1864	OpenWith.exe
1864	OpenWith.exe
1864	OpenWith.exe
1864	OpenWith.exe
1864	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1172	3004	PolygonHack.exe	82
PID 3004 wrote to memory of 1172	3004	PolygonHack.exe	82
PID 1172 wrote to memory of 4660	1172	cmd.exe	83
PID 1172 wrote to memory of 4660	1172	cmd.exe	83
PID 2136 wrote to memory of 4852	2136	msedge.exe	102
PID 2136 wrote to memory of 4852	2136	msedge.exe	102
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 4428	2136	msedge.exe	103
PID 2136 wrote to memory of 2712	2136	msedge.exe	104
PID 2136 wrote to memory of 2712	2136	msedge.exe	104
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105
PID 2136 wrote to memory of 3196	2136	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\PolygonHack.exe
"C:\Users\Admin\AppData\Local\Temp\PolygonHack.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kdmapper.exe driver.sys
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
    C:\Users\Admin\AppData\Local\Temp\kdmapper.exe driver.sys
    3⤵
    - Executes dropped EXE
    PID:4660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2788

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1864

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SuspendTest.ps1xml
1⤵
- Opens file in notepad (likely ransom note)
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff98e0d3cb8,0x7ff98e0d3cc8,0x7ff98e0d3cd8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,11957359350549462010,7177145471082889559,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,11957359350549462010,7177145471082889559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,11957359350549462010,7177145471082889559,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11957359350549462010,7177145471082889559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11957359350549462010,7177145471082889559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11957359350549462010,7177145471082889559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11957359350549462010,7177145471082889559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,11957359350549462010,7177145471082889559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,11957359350549462010,7177145471082889559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1908,11957359350549462010,7177145471082889559,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3268 /prefetch:8
  2⤵
  PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
caaeb604a99d78c4a41140a3082ca660

SHA1
6d9cd8a52c0f2cd9b48b00f612ec33cd7ca0aa97

SHA256
75e15f595387aec18f164aa0d6573c1564aaa49074547a2d48a9908d22a3b5d6

SHA512
1091aa1e8bf74ed74ad8eb8fa25c4e24b6cfd0496482e526ef915c5a7d431f05360b87d07c11b93eb9296fe386d71e99d214afce163c2d01505349c52f2d5d66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fe10b6cb6b345a095320391bda78b22

SHA1
46c36ab1994b86094f34a0fbae3a3921d6690862

SHA256
85a627e9b109e179c49cf52420ad533db38e75bc131714a25c1ae92dd1d05239

SHA512
9f9d689662da014dfae3565806903de291c93b74d11b47a94e7e3846537e029e1b61ad2fad538b10344641003da4d7409c3dd834fed3a014c56328ae76983a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f2fe9771a4e52eca8d6a9d4debbaaf86

SHA1
5af39e9bb09eb421f4db51f9bdccc58aea752644

SHA256
3472db01191a4c0e9b480665243107d4147edda8bc1a86617dc22ac36dc62bfe

SHA512
390f62195bea64805efa217e3b185a5479273148ba60c422dc83073937cd27524f07afd9098030e4d04c64bc07a7aa4c741b07234f9a3b3ec563e616beb33177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
638835c06404e51d7bf0579064c503b3

SHA1
ec1ef27cc8ab09a8eca52e1b1f51d83766623fe8

SHA256
ecb9d0182464ad47c02677a179560c6b26ab803bdb6936c0644eb3d225d2db9f

SHA512
162e4c761ee2bcde8646e2b43b2d82f67d2f719f4e7674f1672b58762a878e46595cc1b4dfca20a404b3466afa15d0adf116c4bbd345241b5fbf2ca5bebef4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7049ae8780971e379dbc724d6034ebb7

SHA1
756f118ea7dce152185d4935d9589bb6602cb254

SHA256
04a25f275c01ecb0d3df02876d2415a6acb60c757534c6f6590506c677a25c69

SHA512
e56864ff782fc33b272af444c5083709ed1cfe41b5304593cc2f755403f831cb899369db74e38621a81c7ba529b8f45558949f6867b5e19f530d0f8047d5b712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a6dbb72c19100ad365906126e756373

SHA1
cda6a29b195a16ec15b08617f8f488b36065234b

SHA256
e52a0e6ac53e39dc67c0eeeb682df355700e329648b8b1466b0a9029e1450354

SHA512
74ff24944dd83b57dd5ab01665513b7de290399b4d2fd8aad5653bd42da3d643d1c87d183e11c04498dbc41911f360d9d123f67f7a5647ffac39da6927608d63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b3aad183f55fa76385f3886b51c3f39

SHA1
929bef0a0ff3f4ee10875c049d8d8047c016f089

SHA256
cf7fe038d5ca6ca66297ee0124583b95cd0776f749f3a287dbfc3f1356deb7ba

SHA512
b6c5716b120ca6582fb0592da80b6bbe9e801be3054420c82e1cbe4136bb6f5b905555024d853b08a52821fd3d08ea2a97d7539c6d2558b3f4e840369322f11e

Download Submit
C:\Users\Admin\AppData\Local\Temp\kdmapper.exe

Filesize
133KB

MD5
4da5a13241127d25bc89259af79d45a9

SHA1
32b53261f437aed23a6bb5799bfda0da2d5cc138

SHA256
ad1c5a790ad8d050aa293a25edcf6587da716ac13af096b6f3b7326f4d1ffe36

SHA512
a4dd3cc057a47d6c9a1f94178a42b78780e42f4e41be7e681e8983a129e02c139b13db65d2bb7c03a20bc58014eab4cca2ac5904233ca57881ecc657d9d550cd

Download Submit