Overview

overview

10

Static

static

Restr.exe

windows7_x64

10

Restr.exe

windows10-2004_x64

10

Resubmissions

15-03-2022 08:05

220315-jy3feaahdk 10

15-03-2022 07:24

220315-h8lpzaghf8 10

Analysis

  • max time kernel
    1696s
  • max time network
    1776s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    15-03-2022 08:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Restr.exe

  • Size

    252KB

  • MD5

    16959900ff34c0ba60fe2a4d9f1242c5

  • SHA1

    888148f1b31355192e26ea4fc97c91f4c4defe9e

  • SHA256

    0f4395c5cdee1c9fe28ef9a63355594f0f7a23aa41e52b8085a0bda8715da13f

  • SHA512

    a2b7a74fdc6525c5b8ecafc66706136e1e3996e28ebb3b1d8e236b120e59f8c4e85165f385365d706a8391ae2a5f30530a086c7820e26d1a6cd2f19a44da5d54

Score
10/10
gozi_rm3bankertrojan

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300994

rsa_pubkey.plain

Signatures

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

    bankertrojangozi_rm3
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Program crash 1 IoCs
  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SetWindowsHookEx 44 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:656
      • C:\Users\Admin\AppData\Local\Temp\Restr.exe
        "C:\Users\Admin\AppData\Local\Temp\Restr.exe"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4376
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 964
          3⤵
          • Program crash
          PID:3316
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /min forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAVgBlAHIAcwBpAG8AbgBkAGEAeQAnACkALgBCAA== & exit" /p C:\Windows\system32 /s /m po*l.e*e
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Windows\system32\forfiles.exe
          forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAVgBlAHIAcwBpAG8AbgBkAGEAeQAnACkALgBCAA== & exit" /p C:\Windows\system32 /s /m po*l.e*e
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3268
          • C:\Windows\system32\cmd.exe
            /k "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAVgBlAHIAcwBpAG8AbgBkAGEAeQAnACkALgBCAA== & exit
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1184
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAVgBlAHIAcwBpAG8AbgBkAGEAeQAnACkALgBCAA==
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3884
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAG8AdgB0AHMAbAB5ACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABvAHYAdABzAGwAeQApACcA
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3896
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApACcA
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2864
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q2nnynnq\q2nnynnq.cmdline"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:212
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC14A.tmp" "c:\Users\Admin\AppData\Local\Temp\q2nnynnq\CSCB276EDCFA1D54AF48A876186B9A9B79.TMP"
                  7⤵
                    PID:204
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gx2uheqz\gx2uheqz.cmdline"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3596
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC215.tmp" "c:\Users\Admin\AppData\Local\Temp\gx2uheqz\CSCE43D2439906A4DEB84F6BE8B83451D.TMP"
                    7⤵
                      PID:1380
          • C:\Windows\system32\cmd.exe
            cmd /C "net session" >> C:\Users\Admin\AppData\Local\Temp\5B1B.bin0
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5016
            • C:\Windows\system32\net.exe
              net session
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3344
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 session
                4⤵
                  PID:1704
            • C:\Windows\system32\cmd.exe
              cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\5B1B.bin0 > C:\Users\Admin\AppData\Local\Temp\5B1B.bin & del C:\Users\Admin\AppData\Local\Temp\5B1B.bin0"
              2⤵
                PID:1144
              • C:\Windows\system32\cmd.exe
                cmd /C "systeminfo.exe" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3084
                • C:\Windows\system32\systeminfo.exe
                  systeminfo.exe
                  3⤵
                  • Gathers system information
                  PID:5076
              • C:\Windows\system32\cmd.exe
                cmd /C "echo -------- 1" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                2⤵
                  PID:796
                • C:\Windows\system32\cmd.exe
                  cmd /C "net view" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4912
                  • C:\Windows\system32\net.exe
                    net view
                    3⤵
                    • Discovers systems in the same network
                    PID:4768
                • C:\Windows\system32\cmd.exe
                  cmd /C "echo -------- 2" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                  2⤵
                    PID:5108
                  • C:\Windows\system32\cmd.exe
                    cmd /C "nslookup 127.0.0.1" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1808
                    • C:\Windows\system32\nslookup.exe
                      nslookup 127.0.0.1
                      3⤵
                        PID:3824
                    • C:\Windows\system32\cmd.exe
                      cmd /C "echo -------- 3" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                      2⤵
                        PID:5112
                      • C:\Windows\system32\cmd.exe
                        cmd /C "whoami /all" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2968
                        • C:\Windows\system32\whoami.exe
                          whoami /all
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4132
                      • C:\Windows\system32\cmd.exe
                        cmd /C "echo -------- 4" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                        2⤵
                          PID:852
                        • C:\Windows\system32\cmd.exe
                          cmd /C "net localgroup administrators" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                          2⤵
                            PID:2588
                            • C:\Windows\system32\net.exe
                              net localgroup administrators
                              3⤵
                                PID:4336
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 localgroup administrators
                                  4⤵
                                    PID:376
                              • C:\Windows\system32\cmd.exe
                                cmd /C "echo -------- 5" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                2⤵
                                  PID:3840
                                • C:\Windows\system32\cmd.exe
                                  cmd /C "net group "domain computers" /domain" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                  2⤵
                                    PID:548
                                    • C:\Windows\system32\net.exe
                                      net group "domain computers" /domain
                                      3⤵
                                        PID:3492
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 group "domain computers" /domain
                                          4⤵
                                            PID:3156
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C "echo -------- 6" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                        2⤵
                                          PID:4576
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C "tasklist.exe /SVC" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                          2⤵
                                            PID:1528
                                            • C:\Windows\system32\tasklist.exe
                                              tasklist.exe /SVC
                                              3⤵
                                              • Enumerates processes with tasklist
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1436
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C "echo -------- 7" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                            2⤵
                                              PID:2052
                                            • C:\Windows\system32\cmd.exe
                                              cmd /C "driverquery.exe" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                              2⤵
                                                PID:3484
                                                • C:\Windows\system32\driverquery.exe
                                                  driverquery.exe
                                                  3⤵
                                                    PID:3396
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C "echo -------- 8" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                                  2⤵
                                                    PID:1276
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                                    2⤵
                                                      PID:3912
                                                      • C:\Windows\system32\reg.exe
                                                        reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                                        3⤵
                                                          PID:764
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C "echo -------- 9" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                                        2⤵
                                                          PID:3804
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /C "wmic computersystem get domain |more" >> C:\Users\Admin\AppData\Local\Temp\8482.bin0
                                                          2⤵
                                                            PID:2296
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic computersystem get domain
                                                              3⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:504
                                                            • C:\Windows\system32\more.com
                                                              more
                                                              3⤵
                                                                PID:4068
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\8482.bin0 > C:\Users\Admin\AppData\Local\Temp\8482.bin & del C:\Users\Admin\AppData\Local\Temp\8482.bin0"
                                                              2⤵
                                                                PID:4160
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C "net group "domain computers" /domain" >> C:\Users\Admin\AppData\Local\Temp\268A.bin0
                                                                2⤵
                                                                  PID:1132
                                                                  • C:\Windows\system32\net.exe
                                                                    net group "domain computers" /domain
                                                                    3⤵
                                                                      PID:396
                                                                      • C:\Windows\system32\net1.exe
                                                                        C:\Windows\system32\net1 group "domain computers" /domain
                                                                        4⤵
                                                                          PID:1356
                                                                    • C:\Windows\syswow64\svchost.exe
                                                                      C:\Windows\syswow64\svchost.exe
                                                                      2⤵
                                                                        PID:808
                                                                    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
                                                                      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
                                                                      1⤵
                                                                        PID:2192
                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                        1⤵
                                                                        • Modifies Internet Explorer settings
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2420
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:17410 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2728
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82950 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1748
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82954 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4592
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:17412 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:3596
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82960 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2180
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82964 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4732
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82968 /prefetch:2
                                                                          2⤵
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1564
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82972 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2320
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82976 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4184
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82980 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2012
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82984 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:3344
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4376 -ip 4376
                                                                        1⤵
                                                                          PID:2580

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v6

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • memory/656-168-0x00000000010F0000-0x0000000001105000-memory.dmp

                                                                          Filesize

                                                                          84KB

                                                                          Download

                                                                        • memory/656-169-0x00000000010D0000-0x00000000010E5000-memory.dmp

                                                                          Filesize

                                                                          84KB

                                                                          Download

                                                                        • memory/2864-154-0x00007FFF88360000-0x00007FFF88E21000-memory.dmp

                                                                          Filesize

                                                                          10.8MB

                                                                          Download

                                                                        • memory/3884-146-0x000001EA31680000-0x000001EA31690000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/3884-144-0x000001EA332D0000-0x000001EA332F2000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                          Download

                                                                        • memory/3884-145-0x00007FFF88360000-0x00007FFF88E21000-memory.dmp

                                                                          Filesize

                                                                          10.8MB

                                                                          Download

                                                                        • memory/3884-165-0x000001EA4B7A0000-0x000001EA4B7B3000-memory.dmp

                                                                          Filesize

                                                                          76KB

                                                                          Download

                                                                        • memory/3884-147-0x000001EA31680000-0x000001EA31690000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/3884-148-0x000001EA31680000-0x000001EA31690000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/3896-151-0x000002644EAD3000-0x000002644EAD5000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/3896-150-0x00007FFF88360000-0x00007FFF88E21000-memory.dmp

                                                                          Filesize

                                                                          10.8MB

                                                                          Download

                                                                        • memory/3896-149-0x000002644EAD0000-0x000002644EAD2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/4376-167-0x00000000001C0000-0x00000000001CE000-memory.dmp

                                                                          Filesize

                                                                          56KB

                                                                          Download

                                                                        • memory/4376-130-0x00000000004AE000-0x00000000004BA000-memory.dmp

                                                                          Filesize

                                                                          48KB

                                                                          Download

                                                                        • memory/4376-134-0x0000000000D40000-0x0000000000D50000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/4376-133-0x0000000001000000-0x000000000106F000-memory.dmp

                                                                          Filesize

                                                                          444KB

                                                                          Download

                                                                        • memory/4376-132-0x00000000005B0000-0x00000000005BC000-memory.dmp

                                                                          Filesize

                                                                          48KB

                                                                          Download

                                                                        • memory/4376-131-0x00000000004AE000-0x00000000004BA000-memory.dmp

                                                                          Filesize

                                                                          48KB

                                                                          Download