hxxp://debrauwblackstone[.]westbroek[.]com

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://debrauwblackstone.westbroek.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000067797fa46f4c7bb956439c7994da6c7b205a8afd19fe1b5a1667b9f19353ada000000000e80000000020000200000009ab073f5201769e1fe617e9daf54b800246edb90ccdeea07bd65540bf705c29d90000000f5d5d71754a384a4d100637f9637e78b26cfa3269080d6dc18d2bea54aebf50eb8c91d726b5086a5fa1601b720063492fa086caa5c438e59bbfba4358438fff62a0c5caa45e9aeb9adf3265e9d4a84d1c9fe8e0c133bcbe46d4a5300493d60f616d18392368b60c7670867be5d98151dfa7b91182e6baf69e17c897183750cebc014c726f32ffdd41b500ed76fd8f685400000003af46638120023cc5d104b610dabc7adafa2e69f1ce2864d8f443ce9cae57860bb6859707e11e0e8538a0427aeeaa8199b9141b3ab67c3c36e259067d00aeb51	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B6309E1-AE38-11EE-8232-4E2C21FEB07B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410888572"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108a1f104542da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000099333a4430e8f9d9fb24cd51c57b9c8fa55bb69a98231b682a01ffdf1520bd57000000000e80000000020000200000006069ceb8a56fa29e61b39a1c5462bb6392a32e53d2f6a2fd707da7462ad62dc320000000e2dafe0d9a42e1ef084b3d1fbf64b86ece846efaa082629398d19cc0a1ed51bd40000000ee0d7d3868ef1e47721971b5196277467d7e2fa211d7b9b098dfa858f4f91117439d6868bda84b9102ea4eac510cfd2aca29b928470ae49a6e3d867d470b8a55	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2828	2124	iexplore.exe	28
PID 2124 wrote to memory of 2828	2124	iexplore.exe	28
PID 2124 wrote to memory of 2828	2124	iexplore.exe	28
PID 2124 wrote to memory of 2828	2124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://debrauwblackstone.westbroek.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ba6193c6b7b394e85d8f55d491031af8

SHA1
610d5a2a1b00084df6f9ecafe215a0622f05fa9b

SHA256
65c5f0d029fcef150c4180e1097be6b35d5cabefa3af343745e94da13615572f

SHA512
0672fc10aa8faed9c122dc24bdc868c3a97b2cefbeda31749eec7330f4d450b2951c160b6f701695f9b415572a7fd83784c346d6f58bf719705b464396b348ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76e3445193d966c211bf92523ecc6514

SHA1
4b797852ffb63fd533915f905272885cca5e1a91

SHA256
f1cadc506f93b65f0ae88e71f45f488327706dcca8d0f8cb9f3ec8f4b9e3b032

SHA512
ef5fa041835c80179efaa9381d9959408eecaac48adfb998229a386ed8d44027af1fbd86f841f5ce438a8720d1b55cf4fbd96e33427e2bf459c7e92885959dd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2c0f53696e901b253bddb5b2ba0a373

SHA1
d8be788db52439220312a8e2635f2064867550a4

SHA256
c481d9da40b176378603b56f51a5f64a66bf536bb95b4db047df67a8bcc4a873

SHA512
49bdd58c196ddb11fb3885b23f90497d0d9b19fbe93ec2a27133b9582931827fffb8816b9ce88b294d8bafe0a775b394f3e2efdf01058b8399320990cf9f630e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48891be3628efa76870031f66ae4dda3

SHA1
d60cffec4ec2dda25b62a1f48c9eda59e7071785

SHA256
9ca68c887cb6024986ccd78f9bd00cefff586f299ea2cd51a35d4c29b4538330

SHA512
fbcc113a3fd8d1ad9cfc2659041d59e03f957ca4477d8a10054fe5a9ebf0e31239b86dacb850020e6bead448dec13e83d31fecd61f09933a0c511b308e3546c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7eb7ac76e22cc2c9c92704503f06a06

SHA1
53737e238f5f23b42edbaad2c8713b6dfb6d1f37

SHA256
a2b63d040cdf8e00c087ef19c69267d387dd8b3075ace2fd0315923628cab2ac

SHA512
82cdf1e8c8edc3972848bbde03f774c53db001a5b6c62ad8a7eec684cb92eb805189cb77ebf5fc56eba8704c121adfc010dabf3b1e51bebaaf7be481fee4d07a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13e6e2e1b4186daa9c581d64723b1ce6

SHA1
9a78c5161de8b0fdbe871cd92e4eb705b1a90b6c

SHA256
e9bb020d27bef69fda2d2e44ab06f75248adce2ab4212a90a2d32332566a13ed

SHA512
01f8fc232172a84a96bf800e60410a46a3f14353544d168a62a349c2193bf8dcd2870669a9536067f5a68dc3fa93b52bfc3a72fc38733ef197abf236b449fdca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22bbe09e6949ff4af292cbbb4fc05c80

SHA1
bbd0d702e107b1fabc24ed974597842a1fa2e682

SHA256
a8712d9cf49d5437cccacc07a3e5519d990b969f505b12b95730ea999900a07e

SHA512
bce474466723370c1dbe81d06fa12e2b07f59bce409216f2c4bb00db23bad211ace3f879ccfe2f396c1fb5299f5659e739e826ff5754bab1287a2aecde321877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0feeb867606bb15cc6ddd24ac7136858

SHA1
134ac7b332896c51c3c38633ccbfe66d9d1f54ae

SHA256
cf93cfc9431ffa029d7a6a4eb8e417aedf95665cdfa5fb5671294c62b9c88ff2

SHA512
a46bbb31fa0343e00184a76fa0f2e23be2c9538344029f15e0bdb4aeaddd4e4b6c99296a352a84bae91488ad2ac536d45c35021e96000cb553a2f460f64be0ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8349cff515212b904239f75c49361097

SHA1
39bd9caeea729f6ef9cb086108820310b0bb6b05

SHA256
824aef778c56ee925123fbc1b71ce124581152558f064c115c19ebe3a5469420

SHA512
5ed176b7a38218517a7af67655025f0a9a021aafa0e7f4b1d0177eeceb26a452bc03457042c17ccdbef0888a353f8322cfc7a8fec5600e83744312dc69dbc891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ff1a6750c310d9bf00ab7cad6ebd3e9

SHA1
cb17ec543dda3e01d89eecddc3922573a07b445a

SHA256
57d8b958861fc1275788b5a00eb9500bfe3410aaf3d8434e86b935ed57b0929e

SHA512
ffe6e787ddf16d6e7de5aa942ee591c9112860083fc4d7db023e15e27fcba53fd6b02a7142e637675f3c3899104a703d635b974cec218c7b813b7dcd223b0a27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c62f70f802f3ccb0428e580ecb66107d

SHA1
6258fb76331015293b455af654d241f62349514d

SHA256
0ac76f5f54bc1444eafaba25c4d0119c3aa17814872e34d2a263c157fd85168f

SHA512
1360d1a449a21851d2df2b9e7450d76ea0c15a0c453d601f3f699c24c1d79ea9672e3b81af33b26e8cdcc8dc94cc9f085d28af6a71b95f1762bbc74f936d9f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86feb971ec3a5c717efaa3dc337fb44e

SHA1
f48f89fa660ce7ff60cd9054a7af9cb3cd4ac36b

SHA256
0bd32c8a21f0330126e9ac60888643efecafe1e06d8fea7f6f14bee6b0a12ea9

SHA512
a991274678702577bde682198edb1f341dd42b576c6c6ab950a5474250795340f22dfdf17aff8873339b46c5afc82cacbc681a2d9a1736d837ded136878712f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ca55d3dbc83896d8c623df204205202

SHA1
06114803d24d9bbed0983efeb3d34179702a8a28

SHA256
045912dc30ebd234f070ed97e63e8695026583c97909a873a42b02c4d7d738e9

SHA512
8dcb828135ef339bb517c520b7f7f1d720dc40c7a643007a2603eadf4132432a428d3833662538d458f8f5f556b4df7732a0eff191ee5269bbfa0564e6bf8e86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58f25c413fe1c6a54bdf9336e488384f

SHA1
09628ba615c69a629ba31b991b187753935fbc19

SHA256
58431c099623555e4cd19b38a63469a8fee89c00ab49df193294efda6136627c

SHA512
7efbf86a7982f100629967f708854f4a2c65c5f682d83401e4860a429b6d4d6f988385d38233d233b57b6168ad1c3b264d3bbd84c1ce410a6bff500b75f424e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b44128e985916a65e11bb973b52d4c48

SHA1
7f9b04cd19c9fbaa8acaeefb6cf9a1bfcfcc34d5

SHA256
f3253a98b1bc461652e82887fc276f4e9435e1c81156fa3632bad15c91c4bbbb

SHA512
4f53ece6567b9ca4584bf886a21dca2c95b6f8845b17b2867ce6ee64a8511d60fa22af0025e423984e5af1f6ff4983fa9a33d285723d51b631a78768c0b62b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar393F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit