hxxps://mettagpdisptratjan[.]tk/x9l4sdh46helpblackboardcom27mini4

Resubmissions

05/07/2023, 14:36

230705-ryq2daee5x1

05/07/2023, 14:35

230705-rx93vsee5t1

05/07/2023, 14:34

230705-rxhnlsee4x1

Analysis

max time kernel
150s
max time network
154s
platform
windows10-1703_x64
resource
win10-20230703-de
resource tags

arch:x64arch:x86image:win10-20230703-delocale:de-deos:windows10-1703-x64systemwindows
submitted
05/07/2023, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mettagpdisptratjan.tk/x9l4sdh46helpblackboardcom27mini4
Sample230705-ryq2daee5x

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133330414275975432"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1156	chrome.exe
1156	chrome.exe
4008	chrome.exe
4008	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeCreatePagefilePrivilege	1156	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1008	1156	chrome.exe	69
PID 1156 wrote to memory of 1008	1156	chrome.exe	69
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 3712	1156	chrome.exe	73
PID 1156 wrote to memory of 32	1156	chrome.exe	71
PID 1156 wrote to memory of 32	1156	chrome.exe	71
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72
PID 1156 wrote to memory of 4248	1156	chrome.exe	72

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://mettagpdisptratjan.tk/x9l4sdh46helpblackboardcom27mini4
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffda6b89758,0x7ffda6b89768,0x7ffda6b89778
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=1804,i,3661117921637170794,7351542752209699335,131072 /prefetch:8
  2⤵
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1804,i,3661117921637170794,7351542752209699335,131072 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1804,i,3661117921637170794,7351542752209699335,131072 /prefetch:2
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1804,i,3661117921637170794,7351542752209699335,131072 /prefetch:1
  2⤵
  PID:308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=1804,i,3661117921637170794,7351542752209699335,131072 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1804,i,3661117921637170794,7351542752209699335,131072 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1804,i,3661117921637170794,7351542752209699335,131072 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4756 --field-trial-handle=1804,i,3661117921637170794,7351542752209699335,131072 /prefetch:1
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3684 --field-trial-handle=1804,i,3661117921637170794,7351542752209699335,131072 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3852 --field-trial-handle=1804,i,3661117921637170794,7351542752209699335,131072 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2484 --field-trial-handle=1804,i,3661117921637170794,7351542752209699335,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4008

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1612

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c4
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 4cb432aeb244f3fd257f18136ec2a8db0597dcac4ea6a15241530ed2b6cd3b8c
MD5 40190101a42f7183d858885536ff72e0
SHA1 e0ea1b2c222f797c24070ff6cca30189de77fae2
SHA512 03d9e069ae53489f7010d80bd41173c79c6ed71add3b45750d45f171a545e59fbbc6e73d7c25c322f7fa15dcf732e5b83cf9e2d387b597675165910420618117
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 93a6c57f1bfe3e4f93edc2c51412a76a203a5f4bef151309e3932b3db4414115
MD5 d31885482143e28892be3dbed4c595d8
SHA1 4217dcf0108214383b46f08419b5d880f7a2b462
SHA512 03a8149edac85353caa13300f268b2d2942575dd6c1027c7377a24e14b742393d34377dee5d89270ffa0dc0afae84d3998514da2583d686a5a7131591da94c09
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 873B
SHA256 5d761ef9faa994de3b62cea161d83146221090a841a7cc6e38c5e6f60e434e2e
MD5 74ec07cd279d835a5ad2ee5bcf2abf4e
SHA1 c936035493dee0803dcf4f566d6d8fc993920964
SHA512 5fc895f15a0271b7b5ab0693af657fc9975bb025c763247a0c04c7e704352d5092fe11a50efd49cfb6971682e8499839e5cb331766f2fdc854056d2555f34389
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 f37fa2aa85b77ccdf5540f232b20feb8ffc4492d45eff00bd9dd1640631428b0
MD5 3e3c318dc0506a07f4c52a777ba90301
SHA1 1973deb4eb80223289a0797aba6eadef05300fc5
SHA512 4124a54c9b8b84df224fde88c26e1e1d48cf5282d8fde004c14605d78ddefc02cbbeaa51c09365cec1da81d776dd103ee2f7dc70f06a9cb9995809cf7cb67dbd
SSDEEP 96:naL6qXWKIg8U8iZRy7Di+6M9tRMeRgmde2xkx1Uf5OV/ejxjVhYtjEsXt0/cg2VI:nsWg8syy+FndpkxuotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 171KB
SHA256 f9008d6e2495fad1da19e39d7100ef5d7a33b972d1a79396372b28d104af08b1
MD5 95fe66309ab50dab35956184592d2163
SHA1 9c06e7e1b17e7483b5f566baf970ed59c4cef913
SHA512 29fef32481a8e258ad86663e19be4d4486c4487977a078a4f41cfb7ca81f13c60457e78e2f8ec13a8d2e5bcea3067b21eb85b1bf3c6b9601cb8daafe7b48b403
SSDEEP 3072:AyGozgjcgx4u44SGTwhuBjJ1XFHMrrQL/0FQ4Wl3/quHKvx1K2P9wjV3+:AVj9JTwUBjJ1XFHM34yQ4GGx11P8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download