hxxps://wirtgen-group[.]s[.]xtrf[.]eu/vendors/#/ajob/yV-_ENqjeGA7EyIBR7A7orPyx6IKmi3XU2Mm3Q1gdxl_kwQD5n8WROrhiszkqKT4v_VnJvpPBbtq--OdsVqINDAVqFAxk-jcOU7J-qXQOag=

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wirtgen-group.s.xtrf.eu/vendors/#/ajob/yV-_ENqjeGA7EyIBR7A7orPyx6IKmi3XU2Mm3Q1gdxl_kwQD5n8WROrhiszkqKT4v_VnJvpPBbtq--OdsVqINDAVqFAxk-jcOU7J-qXQOag=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608225622705209"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

3052 chrome.exe
3052 chrome.exe
4916 chrome.exe
4916 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

3052 chrome.exe
3052 chrome.exe
3052 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3052 wrote to memory of 4716	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 4716	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3372	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2788	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2788	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2360	3052	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wirtgen-group.s.xtrf.eu/vendors/#/ajob/yV-_ENqjeGA7EyIBR7A7orPyx6IKmi3XU2Mm3Q1gdxl_kwQD5n8WROrhiszkqKT4v_VnJvpPBbtq--OdsVqINDAVqFAxk-jcOU7J-qXQOag=
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc778ab58,0x7ffcc778ab68,0x7ffcc778ab78
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1896,i,5371257930392953911,14413417969755239126,131072 /prefetch:2
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1896,i,5371257930392953911,14413417969755239126,131072 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2192 --field-trial-handle=1896,i,5371257930392953911,14413417969755239126,131072 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1896,i,5371257930392953911,14413417969755239126,131072 /prefetch:1
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1896,i,5371257930392953911,14413417969755239126,131072 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4308 --field-trial-handle=1896,i,5371257930392953911,14413417969755239126,131072 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1896,i,5371257930392953911,14413417969755239126,131072 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 --field-trial-handle=1896,i,5371257930392953911,14413417969755239126,131072 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1896,i,5371257930392953911,14413417969755239126,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
4ecbe5f0d7ff916ee0eaf3beda001826

SHA1
acf860d122523912fc80ade3888e0a9eeed22a62

SHA256
c5e1a451364bdf821184af3f51f90232c81e9299e58f89b6cdf7ef0e54a438c6

SHA512
e2cdcad9bed98bc84b8f0833ab2372a02132b9998ed9d52b6f1eb8a893559c0b5e6eed42eb66b2300487a5849b9c98904ed8f264608ac8cb4146af5f6a6c1da5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
42cd20382b9907a1b68dbfd3f46bd156

SHA1
9e3b48b84e03878f314043c794564e94bc15f1aa

SHA256
b7667ef7061223aa14aa661453e7729cd450aa6bd6ea0f2ebb878cc630047fdc

SHA512
a0fc26531532995f76bd416f70ac912e176402e1500f6f982db03aaac0110524dd012ca336e837ef102cce4ad8cb795b4f39a6e5aa2993c4d0ac0b1ea8a01fa1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
686B

MD5
8198f2c1b92cd69b4d2802e8193e441d

SHA1
15160ac5803e81a8ceb45aeed06f23e250e20036

SHA256
e281508d73eb3cc48bf7be4531b59096a497e941d0a6f4df554d5501519c90c5

SHA512
d600049307e3cc7765f757cb522f2c673593a4d4fba4541485d30af10ede88bed0170a291727cf6e59a76dccc484a9e0673edb701663d2b769cac4f23348b5a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
ce046681b15403c72aa39426a02f48db

SHA1
ec0d64cfd65c72545bd75aceac1a214e7b5dc588

SHA256
30c298e8b64e4cd910f49344214ac8232c7db9d8b0d3dd4b16dc3efecc050d12

SHA512
da00f6c5b0d47a4bd5d98f5d3bd1f5dcd895d199c0784d508899582192b375275bcb255dc9ee94ebdefbba813ea987f350ca85a1427e4d9e7dea90ac8c2a6d56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
7476bdd8abe0539db76ad6e3d8866e57

SHA1
96cab1528463b39d1969e09c0f59868710ff3cd1

SHA256
3963bfacfc747ec850406a6615ca367a51f6705bbb242922c056767a2d243bf7

SHA512
ad64777ec0444ca43fa58424d46840adefa702bf9cbba649d698ddbd88dc82183b80b498c33957ee387dd68b7c582913effa44aabcea6ac22ad2fd045d4daf87

Download Submit
\??\pipe\crashpad_3052_ABKHOXDVNLUSFKDV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit