29750d9486434d4c2fea75ede7e18672c9e9fd36bf1f611674e0ae0cb46616fe

Analysis

max time kernel
43s
max time network
23s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-02-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CristalixLauncher.exe
Size

6.8MB
MD5

193bf9df72716b53f91091865ad95a3d
SHA1

fbe2127ccf12d1fa2d5d2fd38920c767b9595648
SHA256

29750d9486434d4c2fea75ede7e18672c9e9fd36bf1f611674e0ae0cb46616fe
SHA512

7df422bc34c2312b0e539f2574278047123d0f3915b435c453cfe70e6e5452728f7ce6c54fafc453774080f0cda18cb2db2edbdbea8629a3a5346483835b1335
SSDEEP

196608:Zn3JrwbTDBDkmWt7i8heVQzSjVpAK/IpjIAUPC:Z3xw3NDkmieVQzyYjWPC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E17C9A11-D58B-11EE-8414-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ab5db99869da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000002bfa927794d77ad16e232c9c77e80024befb9a7f97dabf9b745a0ea378040740000000000e8000000002000020000000122a2fc5661b49738dd584848488b4b1412836c0e84977b6f15f01003f4d0e5d20000000e4a2c4759482af37db2313832b97766eac07c1c66927d8cf22508bd425236b414000000087811e2db2b1467d9a2f04b5fadaaf701a04410cce1abeb33f0554e303da26af0eafbf2ed3e88bf3225935ac4dec8338bd1169349980bb631d5d6607b4fab180	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000007513521fe4caf04f8dde7cf27125fb14684c16cd484af8d36a1077bf28b4f392000000000e800000000200002000000016b322337d9c2dcce26658915bd1f0a382c593aa4e22d7d2f230d828591dfcc790000000897ae2c86bb15cd1abfe3371138b5029670684f038f115fea7c26821e200be481ef8110a79a2553d15ba2250dfbd1d15c021a98f71f9cf4b87f2046cc7516649ae54a5c2abbb452aaec46f9b0b1073f05775c856005e6f628e70b39566d46fbefaf3bed724560eea5991cba9f70790a3aafad47711b3ea43f19a48cbd0bdec52abfb1e39fb3800d79cc58e5db427932d400000002a801087311bfc2f69a858fd83e38a6aef9c4b6af2f95130378516b101bd3eec3395cd1bfa417af8e9262efd0cda34fc084327dfba8271e926f34df9b588da0d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2172	2904	CristalixLauncher.exe	28
PID 2904 wrote to memory of 2172	2904	CristalixLauncher.exe	28
PID 2904 wrote to memory of 2172	2904	CristalixLauncher.exe	28
PID 2904 wrote to memory of 2172	2904	CristalixLauncher.exe	28
PID 2172 wrote to memory of 1340	2172	iexplore.exe	30
PID 2172 wrote to memory of 1340	2172	iexplore.exe	30
PID 2172 wrote to memory of 1340	2172	iexplore.exe	30
PID 2172 wrote to memory of 1340	2172	iexplore.exe	30
PID 2172 wrote to memory of 1340	2172	iexplore.exe	30
PID 2172 wrote to memory of 1340	2172	iexplore.exe	30
PID 2172 wrote to memory of 1340	2172	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\CristalixLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\CristalixLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/download-jdk/microsoft-jdk-17-windows-x64.msi
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da8e0902730de173b9753ab85d6ae020

SHA1
b6ed3c2167b9a032f3318e0009a561258d830622

SHA256
0f43f4283c39e4b2f99938e1bff0f9c835682336700cfe147a648587341f1f90

SHA512
0b0011ae0d6c0c29d9ba093e0a9ef06f343f608832def3c22f7133bc933a50cd066cd5e08ce79bd39c4cbf1fa80342e32bc4502f164c7939a858fc30aed8f4ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2d661d34369a6cac61337abaa245f2f

SHA1
cbafa173139bf5066199eb4e76983fa6aa04a53b

SHA256
5b0685df9469974eb35bf2572893d855077f8dde5f61ac38129bb2df1c81fcec

SHA512
b8c93b4bbdcd65f7a0063d6c2e7e435c7b460850c2b8a392a09cc7967a4b48d48e48ebe8d973c745db43c21e1fc81b44fd0563ffe42dcc6315b04ee17a83d079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9a28404636897bfd1d778c264fb2e70

SHA1
bf9e298f50a330010a9374f3af95005fcf9dbb4b

SHA256
fae5fa9f806e8c8246f79de9d35442256fa73b1310db1ba6cf107ddbf878e1fc

SHA512
98a13da26070ea35affb387c0a66b85c8f8c192ef4ad01eb054f1f486af187495220a2aa15da17b720c2939ff034ce5535320e39506ee9a4a055e548cc0b0039

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d66bf095b618f23e450a064014864f18

SHA1
7a66e65c4f593930bbbc5c38c1ca9fec9afdc78f

SHA256
1a5c5dceb17aee5328aec043abbee468b6ada3e628cb905872c4db3c5c0c8220

SHA512
75ff08d7fa9ae6c7c09be23b1a88af294fe5f8677dda59a9fa3c097bb0441c879393fe407797acb71838287fba2fd8efe4295c5e7c9e7f6db500c1e9c244a795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c91db03fa5207014a15ec4afe2b343c6

SHA1
f1531d08f36f14b41bee64d97001a36bccd4a774

SHA256
1fa7ea54bb02b1683942bca2c3ffb85fcfd9e23572882162a9519518b09fc702

SHA512
f6e681b2ef3647fea828b539c0b663953f390e5c25b5ab7fb395c8352ee572a10e973bd1ce75b672667764f379a264fe3d9eb19366eb3059849eeeb627a3690e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a10a34b6af096a71579dcec5d1855a1b

SHA1
d53016e93db812ef2ffa098eee6454106b7f2195

SHA256
29740305d8961e24a7517608a7c95a1ddedaf5fec9e419b20a66ecfbb941b663

SHA512
15eb190f2d1b7832a918e41d11749a48573d8333d4d02d8137763a1a245aafa76176c450ecd6f96d00d5fee7e880d7997af9006f9544232b763947e014532a22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a280e60f1e29a1005f912a9acac33e06

SHA1
18b279e873210484b2f61b422e53152cdabdc2cc

SHA256
11aa4ff352bb6995903a91601ea5b92fd3bf6afe07e1de9a966073915d91aeb6

SHA512
ac68f9ab51d9ac6395923fba273a2828ccf533c5b6d28c9b5dcbc8ca6e615e75638df1c9c5f9de6174c3ad41256cc00552aa86393fd397a9ec8a59df239e1385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba37a768f8e06156d0c65d54dccc746a

SHA1
a888216b43714737adc7932a1e03eabf119774ea

SHA256
7184136427d6e03d507e201d22bc724f72885b979f1b18c17ed921e9092186bf

SHA512
9ea9e0402ae7cb3d85e22f768b0bed20fb45c7fc36e1ba52ddde8731b467d3fb3d984cd468c9864fb08a143ce052a74af0f697af3428021d208071274e07a777

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15aa01a792892230b699506e875b1881

SHA1
0c77ba073e040a78976498ce8599517f86b6acc2

SHA256
9db99007fe1b0a3dceb4414623ceeaa5d64a4821ee46bc2eae307c3cf59a533b

SHA512
e5d7b254542f31eb46076b41dc6e381d834d3fd91181e10466b036b6e7d80e8f5e7b8a45e440ecc4706c74bd7b99bce7226faec62f915ffa57c60e2b36687b7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aa6da29aab27b8108a72c04190ebcf4

SHA1
9c1bb14bd5126acaa162dcd65a2b77ae33cb61d5

SHA256
4cd1f20f454e53e51ed857ec41f2618b4d4de9e5c9241a01997681be59abb150

SHA512
186d1e525a31fb2894ec2ac8bb2528d0b111432b5d712e0de0fcd246ad1a4c4451460a18b2731fa88c60e43665f1c8cf2f039f09c255b031652738c4af698650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
976a514895e5900428744df2f702f73f

SHA1
86bc3b022414b7cc750f2dab481ba904c29718f6

SHA256
ae685ec4802755a0098665f419bfe320827f8b0f2d6c494d9bbcb946ce84d337

SHA512
df6dc0c1c30850347d6aba48de28ab177bc0ec3d79e8bc094df6533768a3597269025171a6c90512122eec220004c9d7e8c580d84414de7b2649179c22bc7255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f195f4d966deec38de280a3206e78c50

SHA1
f15d47ea572388d781fb1e09f2c709a0cbc3c761

SHA256
5429a1e16fef308530161b63c28104ae0168bb8fcede0f618c665cd36d7a8a33

SHA512
9f4dfc6fcf58f93b7cd0b1ec708fb2f8b1388f44fa5e3e9a65f6c8e607826750f827260e83067ea5da9fe616e760eed85617364b768719438680a76fe8383543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfacbeb9aaa468426f531e3e4bd806d2

SHA1
981c66181a61143480e1fc6d60c4b9342888e9cf

SHA256
1984e1a3e32843229a9384ba26a4d4e0a9c3d9e6471073d60035c2f63a041ff6

SHA512
b5b969122ebaad3252a537d13b452edbb72057395e0544f2da6e51aac87e18b88f54df24f1336f91d4d583519f1972f025bc3c43b1b9731d5d1c9ca2e4e446c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c6d54ab24fa2d6fd8b077803223a90d

SHA1
6f5823591e743a09b689f11752be79265e5d3a18

SHA256
453155a9f67ccb2678e33e892a71000627a5e9680a17110ad007ef256852724b

SHA512
2c3dc0f542fb91db6aba822ae5b6c3c3af2d7e64e08b2edc5fcdf500707e602d0da3ed41a6cf0d91e1d991b39e7077f7a296ed70761eb0c6068c1bbe617b3b92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6004c12a0586675fc5fa51e6e8ac0d4

SHA1
1b0265f07772fd07efec42909843715e8d0848e3

SHA256
09b429fb1c602c5bc7520f4861c35c01fa5c84b0e29f6596bd1ee5b195c68e49

SHA512
10a40cb7a2183dd9eadf5186de32f8ec2f6f4f5a3fcb52936db6abbdaadd23155bb1397670536275f36556e92f52ac2ebaae7b291b91200a4e59cbe34f7e9c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ec20446ad2975a0c9b708b0d57db795

SHA1
129cd9380de132d37abb10359560f79cef8da583

SHA256
0780476db19f4935351268ea889de7f86305468e3814f24c3aea648f9424e9ed

SHA512
86149b62b505e3527971ee39eb232e6c7cfc8eca4a9b1fe8c5557d21c6016240de9af90b9c013da072b3a7afe7e81523abbf78b0b7ae639581e9c5d361825db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e9846475212fa3df151a2c6855b1825

SHA1
7e58f95bef78ba7f05acfd4bb7d2a2bd1ab1a393

SHA256
82eb58ec818fa8f7c1c3b013dbb504fee3a09e3690f838bbef8953e28cd45c8d

SHA512
c7db37fa8fd3fefa054368c74f92baa2a87e64719bf64cc59929cc958043f8b67513aa42c154feb3c00c289c498c4e5b2fd80077a22d45941a0d6a8369bb433a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99a8b04937c0a83e866f65f39e6d1d4f

SHA1
e06e8b900e02aeb8d587549905bbe53fd96a78dc

SHA256
ca3a73161d36c69759973b3706dfeefd93cecc4f85f3401e6bbe7935c70c035e

SHA512
e0a840d5c62635f45ca2861769cef9a17a2262a7fb9e9d12521c32845cb8b84a1304fb855992b5b3e56509320c7d37077bd0eb3115e1ec412b818e370367abc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4127.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A10.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit