hxxp://url9011[.]excesspickup[.]com/ls/click?upn=kyzYPXkwVTVBxiFy8NLOAiyMpzr5ddZLcFdbyBa6PrpVDfB5bJcjhLfPBdoZcTSMSykjwYrqXiMLasc0mwPlfLcs7Xv-2BNLS93OZXXqHyaNWsuGBZdDwTTS606duuuqK1isAG_YqVc2Q6TaxfIVY64HpFtF17-2B0m4jIHGhN4vSZoWPwA0n1vP3S7coF1W27s32GSg-2F0fzbLnoII8W7ZmpMwaz5tMaMSxMKSY9w5pk1y45KDbvPrEHkwxjyh9spErV85U-2BhBu7gHpm5eeGa-2BUc8SoPKLvh1qSqMSp8uVYc502SNSe9O0ZA2dwRbfGVbAPIvKW78gmXLBnzzOQhG1wUZ7T39i9nahwU84HvVGFjq8MUg8Mha2jmEy1AIFj1W9gbFk8xJAtFccGNd7U4-2BVFs18Nfq7lDWDPTtC-2F25AGJpQnOxoaTaWJTN9H2cz9tI-2FI2p-2F-2FsnfZqIyEGaWZzjYsA4Axa1U-2Bxfjdatkm3kiyyMBAafe0okYR0-2BQJ2WSIGIjyuo6oBONNBsqgceiD72GYyiQI1443xdJyWJhzb3U-2Fsp-2BUpc1JW6XZlyflKhQgjFFj-2Bj-2FST-2F

Analysis

max time kernel
59s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2023, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://url9011.excesspickup.com/ls/click?upn=kyzYPXkwVTVBxiFy8NLOAiyMpzr5ddZLcFdbyBa6PrpVDfB5bJcjhLfPBdoZcTSMSykjwYrqXiMLasc0mwPlfLcs7Xv-2BNLS93OZXXqHyaNWsuGBZdDwTTS606duuuqK1isAG_YqVc2Q6TaxfIVY64HpFtF17-2B0m4jIHGhN4vSZoWPwA0n1vP3S7coF1W27s32GSg-2F0fzbLnoII8W7ZmpMwaz5tMaMSxMKSY9w5pk1y45KDbvPrEHkwxjyh9spErV85U-2BhBu7gHpm5eeGa-2BUc8SoPKLvh1qSqMSp8uVYc502SNSe9O0ZA2dwRbfGVbAPIvKW78gmXLBnzzOQhG1wUZ7T39i9nahwU84HvVGFjq8MUg8Mha2jmEy1AIFj1W9gbFk8xJAtFccGNd7U4-2BVFs18Nfq7lDWDPTtC-2F25AGJpQnOxoaTaWJTN9H2cz9tI-2FI2p-2F-2FsnfZqIyEGaWZzjYsA4Axa1U-2Bxfjdatkm3kiyyMBAafe0okYR0-2BQJ2WSIGIjyuo6oBONNBsqgceiD72GYyiQI1443xdJyWJhzb3U-2Fsp-2BUpc1JW6XZlyflKhQgjFFj-2Bj-2FST-2F

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133256970678357232"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5044	chrome.exe
5044	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1884	5044	chrome.exe	85
PID 5044 wrote to memory of 1884	5044	chrome.exe	85
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 312	5044	chrome.exe	87
PID 5044 wrote to memory of 3340	5044	chrome.exe	88
PID 5044 wrote to memory of 3340	5044	chrome.exe	88
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89
PID 5044 wrote to memory of 1300	5044	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://url9011.excesspickup.com/ls/click?upn=kyzYPXkwVTVBxiFy8NLOAiyMpzr5ddZLcFdbyBa6PrpVDfB5bJcjhLfPBdoZcTSMSykjwYrqXiMLasc0mwPlfLcs7Xv-2BNLS93OZXXqHyaNWsuGBZdDwTTS606duuuqK1isAG_YqVc2Q6TaxfIVY64HpFtF17-2B0m4jIHGhN4vSZoWPwA0n1vP3S7coF1W27s32GSg-2F0fzbLnoII8W7ZmpMwaz5tMaMSxMKSY9w5pk1y45KDbvPrEHkwxjyh9spErV85U-2BhBu7gHpm5eeGa-2BUc8SoPKLvh1qSqMSp8uVYc502SNSe9O0ZA2dwRbfGVbAPIvKW78gmXLBnzzOQhG1wUZ7T39i9nahwU84HvVGFjq8MUg8Mha2jmEy1AIFj1W9gbFk8xJAtFccGNd7U4-2BVFs18Nfq7lDWDPTtC-2F25AGJpQnOxoaTaWJTN9H2cz9tI-2FI2p-2F-2FsnfZqIyEGaWZzjYsA4Axa1U-2Bxfjdatkm3kiyyMBAafe0okYR0-2BQJ2WSIGIjyuo6oBONNBsqgceiD72GYyiQI1443xdJyWJhzb3U-2Fsp-2BUpc1JW6XZlyflKhQgjFFj-2Bj-2FST-2F
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87f589758,0x7ff87f589768,0x7ff87f589778
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1852,i,12801417290992635123,4903565962225708167,131072 /prefetch:2
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1852,i,12801417290992635123,4903565962225708167,131072 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1852,i,12801417290992635123,4903565962225708167,131072 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1852,i,12801417290992635123,4903565962225708167,131072 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1852,i,12801417290992635123,4903565962225708167,131072 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4640 --field-trial-handle=1852,i,12801417290992635123,4903565962225708167,131072 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1852,i,12801417290992635123,4903565962225708167,131072 /prefetch:8
  2⤵
  PID:316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1852,i,12801417290992635123,4903565962225708167,131072 /prefetch:8
  2⤵
  PID:2776

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
c9693d81270095966c0d610f2577b056

SHA1
03aef11acaefac60c6deacba0a9271fd3a407fe0

SHA256
d3f8f3956df5a9de22e628bdcb3e8c8bcf04173df8f561ce0f1060ca22fe927b

SHA512
51b903c4245364a619f67092a49c7728209b00c7abe1ade1557f99fd286b8f7adad0a8fae80a54e7e3d6e1e72d2de908649743a03e7180b37d1c3fb82f2644da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0d70404e132fbb5217e5d15a2e1e9b7a

SHA1
cb58aa59b553b0a330ec01693607ef8336d4c1e7

SHA256
8cf3b67cc4bb8fb656da02e98495beffb445340c19bdb899e3c365c61c45c83d

SHA512
20489bb76052317934d8d2adbeb169b863e1bf2fc260408a9f6d45752739167e71984755e2ed4f3b65d829bca5740e337b67940c930e804e8a396b67bcfd3bd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
050243605a326eac4ce701c0f308b569

SHA1
9f83cbda1aa13f68b6ea588a22b43072a113992d

SHA256
6e9e97e286bce6fc299c3c8b9341e8607bc14cb082b44d81e7888c7649820673

SHA512
7d0e65a524891cd49c72917296ee03f818ccf07192f072942cdb0f8ea78675dbd46c4807322a3c9cf607dab39e32df7c6ce60aa44ac0d3c2433352fe5c5cb42f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
199KB

MD5
249192ce79d040a44f6e225c13cd4763

SHA1
72364fb31546615917aae0ca6c61dcdd2dec8206

SHA256
42b000f95009becc6697436d990c8d8d895843ff190f0d2ebd6afaa568c9b0cc

SHA512
ad01b7bea4941d1e7c7e96b27ed5b91777c576acc84181282cc27bf0a25aafd0e09a379737392a61f61b9aee1e65f5072ec8b40c06fdda25c6473728ab576348

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit