hxxp://mygovernmentbenefits[.]com

Resubmissions

30/11/2022, 23:03

221130-21yjcach97 7

30/11/2022, 22:58

221130-2x47qafh81 7

Analysis

max time kernel
152s
max time network
149s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
30/11/2022, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://mygovernmentbenefits.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "376662802"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376614217"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2743807386"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999823"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2743807386"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999823"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE66FE21-7102-11ED-9424-DE2FAD8CE486} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10635caa0f05d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2775369971"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08d19aa0f05d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999823"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000820e49497394a545b26c09278fbdcbe90000000002000000000010660000000100002000000077aa409b7ece236cba5b77d69ab4d3441f0e2c9a04a1e20f7264eb39620b2376000000000e80000000020000200000005c93b5f23d4988fffb02955a3ac24092e80456ffc0d4c0d08eed62fb94323a5a20000000e449d6bcb2366d7f55ec0030ee98368f50c667664fd731b46683c0bce63b2a9140000000faee1b0bdbc1ee9ff03830f636912244d2ab0fb1b38e26f108ba223b342e41441e8a1b0758d22c69e51cb0f12a6c3b13c8da73c5fbb2505f7c4210b96ae465e3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000820e49497394a545b26c09278fbdcbe900000000020000000000106600000001000020000000b10b031178ef92c0cb9574193c03657fe0644bf0ac21aea5763d898208a48450000000000e80000000020000200000008698e8ac1ec3cff2c581d44ed809ab897517b6d9a9fd4752725719da45fbec14200000006456c9e42273eadac3c40aa714de521f80d6d95fc22e9d66303f9b74c09c3cb740000000d28842d3c42ac7a8807581a8e0d7d3ac17c3ba8fa963d16bdb9e13b620dc8f227ebcbabf04b6bd249415bd1a16137d5bfe21ec499d03607ba5daaf25a67dab63	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "376630810"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4944	iexplore.exe
4944	iexplore.exe
392	IEXPLORE.EXE
392	IEXPLORE.EXE
392	IEXPLORE.EXE
392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 392	4944	iexplore.exe	66
PID 4944 wrote to memory of 392	4944	iexplore.exe	66
PID 4944 wrote to memory of 392	4944	iexplore.exe	66

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://mygovernmentbenefits.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4944 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
1KB

MD5
8603d07167cb03d1a558ad02c3b72f65

SHA1
b5b0719c3b104690fa7848b65c87de81d17318e3

SHA256
47a0091f4e37f15b301d05271e744cf9a65d3bac6c8695f7e9218fa620ca51ba

SHA512
a547c95a7b2f9a8865b47a7940a7c503a3e29d2dfbe0d95d394ca50b245029bea7816ea77bc1a737f038c7d70774fca94f867c108d4f2621798429da1afb4f71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
2385a464e17980d978246b6b59a60697

SHA1
ee57c16c00972abbea042066dbdd769fdb89571b

SHA256
88dabd9b9c2183dd69b01146358783b0dc0e24faf044331be565cfd26e1dee2a

SHA512
d85eaa2a9a0a4523eb87bd43bbe995d8658dce705024c316de12c9f9be0277ded1646a6667bd47eed337e2b790aab9760ddf2e501242c42f3d66f40c23042d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
1KB

MD5
b2fa1f6b12496e2db3920327c6d4ff54

SHA1
b68aa390157852b54c7a324b246db73fe75f1315

SHA256
6674960527964e0d5a63ffe9b1f7e2075ccbce43e783c3224934d7dc72134b2f

SHA512
e26dd63f8fbf67bec3a8c027bd60ff811e03c521aa892702fe4631326718c027ddd1c9dc094406a2c8d598ce65ae38e4e46e15cb1ebb40fdc60d1cf5f1ca00bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
1KB

MD5
b030634c10eca29b73ef40aca12eddea

SHA1
93b55dde086a4432739922faac32217887fd1ad6

SHA256
626355139a6471a48e14d183cbdb82b9159d065ec5bea1ce34d1c99843d2596b

SHA512
ce477b53aa2c5a05f26e3e8e96785a07de089a5272112a22d100ba7bdc57ac6607bb4626cb4d8e5b33133c3dc0f43ce4c34dd6db749f8a7335ac0cbc01d2aac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C2394E300A9641F32DDA73219CAE7756_44CDF8BF72E45F865B080FCB8A52F8BA

Filesize
1KB

MD5
a83c8e10b66071dd957a3ba97e2fb0b6

SHA1
1e62802a90e9d7d3de78a6ed2d76da0bc8016531

SHA256
b43f53c1c1281d2a4a0932d174062bf13c7a60bfd548a65185a6c78ecc41562c

SHA512
bc7717147fb368d0bdc0a2425a3b492e89634fa6de096491332bfd6d08d5cb22cc5886976fbd80ef8e947d352c72509d454e12ed2c3a436ca45200b27fb9a767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F13EABFF7BFA9B94A3085F4F98231E5F_ABE5B3F389155F7F8950F714E6E2F218

Filesize
1KB

MD5
d1767ea286217441fedc7618bda6a6e0

SHA1
84e4bd58b1d60ba2308bc90a63b0e222263017ae

SHA256
6a1521ec1c741419c2e32d6b97504e54fb1169e3827eb0154844675d18540f59

SHA512
186850c938b0b0efba0c768afd343df0a06b568cf67241d18ab77e4d57578ba5b417c2f2d181754518122104d7a89ec73fe95d53caa2874dc0eadc8a620a4b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
13cafd9401ac2f93b20dbe1802dae328

SHA1
6b0dfda6eb1280967f73c14a07162d2f929b9566

SHA256
555ecdb94d3bec715ac512352cc77e6217f90b032f2b2ec4e41f8410c29f6f53

SHA512
b65236974b31c42f98542b1433d8afe8a9a06f4ff9f94530ab45f9a065252647f1d3c40526367a68e7c63498e59429d5f7680197ba57b58f460c1af6cfbb9b2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
6f2984b1c6107daf9db819bd70403635

SHA1
ac3060a4724295c498458130f9ef0812b055c72b

SHA256
eb96b102eec28e0e03a73de21e91ed6b3dd0f37012378d41e423b9dd0228e363

SHA512
b6ff665310eb0f6d2b91c0242424a3c2217bc35d4cb61e7792b59823e28d47d3b4674dbe03e0e0c901328a7306dbb93e602fa84a66cf59ba1c1453172ecefc93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562

Filesize
466B

MD5
4acbfc78f492d67726a7bb0519821e92

SHA1
e6ef69855f6d8dd64bd35ce6feffb2ba85e0c54b

SHA256
52e143170c8c4ca4bc8165cbaafbfbe2f13f5e51a5f9659d67d35b3bf0d405eb

SHA512
ccbb9ce53bbe81ad7a73599e476e0edb1b300de384eeb5fc94a6b27fc1ef40925a1baa743841fbebfb3a62e1e5394c0e308e53e360ada864ea4b42c601806f5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26

Filesize
470B

MD5
4420699955a9ff56324de57bae5737a5

SHA1
785e7e3dbe6c9cb73b9429198324ffbf154ebf00

SHA256
dc685916c332dca16b91e542129b60c92016cd8986b005962fdd5b163887aa63

SHA512
c66f4b6631e50197fde4a11c5ab74f627e8c2fe1e7bf62b8de2948ed92271dc2d98e1e0cf700db192814ceac7e79b38cd528b57cdb638fccc7fb572bb877c17b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C2394E300A9641F32DDA73219CAE7756_44CDF8BF72E45F865B080FCB8A52F8BA

Filesize
458B

MD5
f316a518a594b5e2096f2de9f7d70db3

SHA1
d7c1c3089c634c052f68ca269852771ee66cd1bd

SHA256
b4b6b5c811b2b2e6c098d5a8e1c30223f433c6b485a97a021066540235c80181

SHA512
a9188e599c6fc4d8536057a871b7b4e9890536245c0d8f3f5d315d9b83ef9a4ac6725bcd4a1d13a83e34cf26bbb9043679a45288752df03e23eaea5e66dd533b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F13EABFF7BFA9B94A3085F4F98231E5F_ABE5B3F389155F7F8950F714E6E2F218

Filesize
474B

MD5
101a2f84c88c77122e0469f9b66f12fe

SHA1
16f07b8f06d8fa0306f4ec84f39dca9c2ca4f58a

SHA256
6a56b08b70dc7905df0c14382827a84b39393e02ed087ccda3fdc6f1461181ac

SHA512
8128950e5fcda137afe3bcc7fd3da1018d90c83cbb03d8e3e1cafb660ed26e7d2f19ec4a44212def77c346890fd419ccbb7e6584473d9f8efc3f283072afa21f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\7JNI044U.cookie

Filesize
545B

MD5
7882373e3fecb4418dd9d711b28ddc64

SHA1
33fc3921a5f79540ddb15f6018cbb9c6f2444205

SHA256
84aab86cb1011d6dffbe5113ceddd43a77f0335d030eff9ce70ab4fc85c13ca4

SHA512
d477a6c0b649df7ff7cc1550dc6eab50f2a6314974b6a8948e1d7dce2681cf0023907d6a02002aae03b4029fa3c696f427ccb7f304acc628b771e59099496349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\J3BL65I4.cookie

Filesize
545B

MD5
80ac6d7509244f6d49bc148f8eb87638

SHA1
8d8217917b05a5423cd3770a00176f52a1b5e3c7

SHA256
bc8f6db972780f5cac0875704f15a2fae150583a9e42d4cfee836ade99cba973

SHA512
7b585c333a01d126067a939ac50631d2f74a8b73e614e8023fbe638c5678e4a3ad866c4d99127381b1d0655b6710412e1b003a598cb1ea14102c252d3c17f50d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\SI4CDBZ5.cookie

Filesize
247B

MD5
01aa966d83a1f29f31927d6fec1f1c76

SHA1
c2fb38f01cdbf214f873683ddba0332d122e2efd

SHA256
ba1e741dedf3ca72b151c8e626e604bc6558c1841f7aa529ba2f0eaaa8d37dbc

SHA512
d061bd4ece39a7220d8d3c6484f36dcb6e1c794b48b8597e897c8fa589778a47a3cc2dd62da394affb737ca9b8a93153edff49403ddc725b115abdb00b9ddb5f

Download Submit