hxxps://survey[.]porsline[.]com/s/wI72R5MH

Analysis

max time kernel
148s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://survey.porsline.com/s/wI72R5MH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372543154"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4077862820"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{15150A4E-4BFC-11ED-B696-EE6CABA3804C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000184a83db900ed59246d0c21ea8868aff771ea9c5960a654696b06a2953509b3c000000000e800000000200002000000085e6602a68a9d0ff043cf8b863a6084fdf7e5b2a8c2bdd86d366a337ad305c4b200000000681bb0145e524fbe24c137c67fa408fcb54af729868876626026d7e3fcdd5c3400000009412e5181f632ca5fb7d6511e94bc0121d7089c3cd13cdc9298b6f374ba3825037136daf85416bcb81af0e3d88f65da8884d71d838c12391c51eb7552ac0ffc4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c090daf208e0d801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3926762360"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000511a079831f8546943cdce64b06709f12d082f838024d93a551b8e3c896efdc6000000000e800000000200002000000090b803f20fc93559efc4068d5aead2f21194e0edbbb533553adfb86ee5d1234d200000001a3498ed49cf367a763542993cf04db6a8f140de0b57a26f7566ad859900f958400000002dde26eab136f5c380a5b487ab4fd4d7361ec308730c0d559a26e9bc143f13aa4f14beedcf9dbd211b9d9e67023cfa3c796b4d39b8c8c3ed683a3235b1a04a9d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6015faf408e0d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3926915852"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30990344"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30990344"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30990344"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1196	chrome.exe
1196	chrome.exe
5184	chrome.exe
5184	chrome.exe
5192	chrome.exe
5192	chrome.exe
3256	chrome.exe
3256	chrome.exe
4008	chrome.exe
4008	chrome.exe
5412	chrome.exe
5412	chrome.exe
3692	chrome.exe
4620	chrome.exe
3692	chrome.exe
4620	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4884	iexplore.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4884	iexplore.exe
4884	iexplore.exe
3748	IEXPLORE.EXE
3748	IEXPLORE.EXE
3748	IEXPLORE.EXE
3748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 3748	4884	iexplore.exe	83
PID 4884 wrote to memory of 3748	4884	iexplore.exe	83
PID 4884 wrote to memory of 3748	4884	iexplore.exe	83
PID 4008 wrote to memory of 2280	4008	chrome.exe	102
PID 4008 wrote to memory of 2280	4008	chrome.exe	102
PID 1688 wrote to memory of 4604	1688	chrome.exe	103
PID 1688 wrote to memory of 4604	1688	chrome.exe	103
PID 2208 wrote to memory of 744	2208	chrome.exe	104
PID 2208 wrote to memory of 744	2208	chrome.exe	104
PID 504 wrote to memory of 2124	504	chrome.exe	105
PID 504 wrote to memory of 2124	504	chrome.exe	105
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1748	4008	chrome.exe	108
PID 4008 wrote to memory of 1196	4008	chrome.exe	107
PID 4008 wrote to memory of 1196	4008	chrome.exe	107
PID 504 wrote to memory of 4420	504	chrome.exe	115
PID 504 wrote to memory of 4420	504	chrome.exe	115
PID 504 wrote to memory of 4420	504	chrome.exe	115
PID 504 wrote to memory of 4420	504	chrome.exe	115
PID 504 wrote to memory of 4420	504	chrome.exe	115
PID 504 wrote to memory of 4420	504	chrome.exe	115
PID 504 wrote to memory of 4420	504	chrome.exe	115
PID 504 wrote to memory of 4420	504	chrome.exe	115
PID 504 wrote to memory of 4420	504	chrome.exe	115
PID 504 wrote to memory of 4420	504	chrome.exe	115
PID 504 wrote to memory of 4420	504	chrome.exe	115

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://survey.porsline.com/s/wI72R5MH
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4884 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffeccd64f50,0x7ffeccd64f60,0x7ffeccd64f70
  2⤵
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1744,5060245633106566214,12737456686969361116,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1744,5060245633106566214,12737456686969361116,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1756 /prefetch:2
  2⤵
  PID:756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeccd64f50,0x7ffeccd64f60,0x7ffeccd64f70
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1736,14262201979976442284,960035181060639226,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1736,14262201979976442284,960035181060639226,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeccd64f50,0x7ffeccd64f60,0x7ffeccd64f70
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2484 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1704,15785095566647083278,3170344090107598664,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeccd64f50,0x7ffeccd64f60,0x7ffeccd64f70
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1768,16960368281954978945,15817605268407214709,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1768,16960368281954978945,15817605268407214709,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
e4d9c797e3f735c8688663ad90c3f16a

SHA1
4520c07e358dfb72657a4f840440dd89be30ff92

SHA256
8770a1f915af942b04a0a92a60b466724daf3ed11fbd825bf7c931705acb3243

SHA512
d787211a3d5d3f3579d7b7ed1cc29b63718c1ede6391ca6d37164cd8633b207031a0e6b9ccf01c8b985f348e9276c9d87e8ff880d5c91c07fdbd0ba107858a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
d4d443a25ea0e792142718c16af91a0f

SHA1
26548c59a5086269e51679a3dca3e7bd83daea28

SHA256
b0f96f3b571b7eff330f0109ab82447af0108562bf3937e530028d429adfd3b5

SHA512
7f49020d73b47a57fc14e4e3f2346b4b7595070fded5fbce9768310c8ab32837b3a4621f51d36798059df56317aca3e36ff4bbdffaaebb4dd921be5c9239848a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
438B

MD5
cd0d6fcb7cd9a0386aa908bfcacf7691

SHA1
5dfaf529b7a341d0d6606186cf0d730d542acba7

SHA256
1f8a0943f2d23737955a5c3ad5783dc244e7b24331510ef8534ee92b6a4b2b17

SHA512
c1a617931617e4f68651f48fcdb871ffeca7970577d75018b024239fb1ce961a0c55db27415260d09bc12ebb5ffb3aa4784c9d35b132cc65f8e0c6b5983c3c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
44368fd4a933e7b7139a0d869f2a586c

SHA1
458e91a305a4835426004e6ce7c905b20d9c828b

SHA256
d62e2b80b9be659cce2ddcfee82168cb94581b56b5e1d7db7446900262d38de7

SHA512
e10e537ddd59c0262ab0a53cf344680e37a80ac1956ea72209eb0911029c61b3c6165d89c9e7c1342e6625195485c5ea6fd87b7db4b2dfed9322aeb0f9352ab0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
f9117eef265e523cfb5089ab5388e102

SHA1
13da751278466c6af5b00499ddc8f4cc129a6056

SHA256
97625a9a59a2481937e156777eb38537f212ad290e3c9d974f5c558ddd490268

SHA512
14fb42f95120fefe78ad63945521cbef00ddbeec7619b08855b580eef59769d051ccdd05a7409347bdbb0c85c1f934f4dc91928f9122ad12bd66dbb97934f6fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
f9117eef265e523cfb5089ab5388e102

SHA1
13da751278466c6af5b00499ddc8f4cc129a6056

SHA256
97625a9a59a2481937e156777eb38537f212ad290e3c9d974f5c558ddd490268

SHA512
14fb42f95120fefe78ad63945521cbef00ddbeec7619b08855b580eef59769d051ccdd05a7409347bdbb0c85c1f934f4dc91928f9122ad12bd66dbb97934f6fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
f9117eef265e523cfb5089ab5388e102

SHA1
13da751278466c6af5b00499ddc8f4cc129a6056

SHA256
97625a9a59a2481937e156777eb38537f212ad290e3c9d974f5c558ddd490268

SHA512
14fb42f95120fefe78ad63945521cbef00ddbeec7619b08855b580eef59769d051ccdd05a7409347bdbb0c85c1f934f4dc91928f9122ad12bd66dbb97934f6fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
f9117eef265e523cfb5089ab5388e102

SHA1
13da751278466c6af5b00499ddc8f4cc129a6056

SHA256
97625a9a59a2481937e156777eb38537f212ad290e3c9d974f5c558ddd490268

SHA512
14fb42f95120fefe78ad63945521cbef00ddbeec7619b08855b580eef59769d051ccdd05a7409347bdbb0c85c1f934f4dc91928f9122ad12bd66dbb97934f6fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
f9117eef265e523cfb5089ab5388e102

SHA1
13da751278466c6af5b00499ddc8f4cc129a6056

SHA256
97625a9a59a2481937e156777eb38537f212ad290e3c9d974f5c558ddd490268

SHA512
14fb42f95120fefe78ad63945521cbef00ddbeec7619b08855b580eef59769d051ccdd05a7409347bdbb0c85c1f934f4dc91928f9122ad12bd66dbb97934f6fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
f9117eef265e523cfb5089ab5388e102

SHA1
13da751278466c6af5b00499ddc8f4cc129a6056

SHA256
97625a9a59a2481937e156777eb38537f212ad290e3c9d974f5c558ddd490268

SHA512
14fb42f95120fefe78ad63945521cbef00ddbeec7619b08855b580eef59769d051ccdd05a7409347bdbb0c85c1f934f4dc91928f9122ad12bd66dbb97934f6fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
f9117eef265e523cfb5089ab5388e102

SHA1
13da751278466c6af5b00499ddc8f4cc129a6056

SHA256
97625a9a59a2481937e156777eb38537f212ad290e3c9d974f5c558ddd490268

SHA512
14fb42f95120fefe78ad63945521cbef00ddbeec7619b08855b580eef59769d051ccdd05a7409347bdbb0c85c1f934f4dc91928f9122ad12bd66dbb97934f6fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
f9117eef265e523cfb5089ab5388e102

SHA1
13da751278466c6af5b00499ddc8f4cc129a6056

SHA256
97625a9a59a2481937e156777eb38537f212ad290e3c9d974f5c558ddd490268

SHA512
14fb42f95120fefe78ad63945521cbef00ddbeec7619b08855b580eef59769d051ccdd05a7409347bdbb0c85c1f934f4dc91928f9122ad12bd66dbb97934f6fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
2KB

MD5
d124595bdcc848ca39ded7c607b928a1

SHA1
14bc42cedc6dc69151b98d01733e02ce68a5bcb5

SHA256
558c5884a24e437266d67e7a1eeecc04a23bf79c7aa5c84eb4e8637e04162bc7

SHA512
b3fbbea2a21742ecd2d4b8ba6eedd599f8db59a68a7a2a9c0bf36f57ffcba6f06f8e394cce16640bac7012d55b49f7b759efcdf5b4f18f5065683a3aabdda4d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
2KB

MD5
d124595bdcc848ca39ded7c607b928a1

SHA1
14bc42cedc6dc69151b98d01733e02ce68a5bcb5

SHA256
558c5884a24e437266d67e7a1eeecc04a23bf79c7aa5c84eb4e8637e04162bc7

SHA512
b3fbbea2a21742ecd2d4b8ba6eedd599f8db59a68a7a2a9c0bf36f57ffcba6f06f8e394cce16640bac7012d55b49f7b759efcdf5b4f18f5065683a3aabdda4d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
2KB

MD5
e09345c640b664a92d1a116be1c8a5e8

SHA1
6956d87707204f81631ad36327dc4194a1965da3

SHA256
bfc686f27e09f52ec046ab22f11157ae24d5c37aa51560b24c524b57733521cf

SHA512
b782fd29a767d524475b1662f4a23ad3c1814cc6ba0e86a32c98019f51771ae4f3c13756e25d8db1b9fe142b4907d424df441b9f7325004db4ab9cee2a6bbfe5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
2KB

MD5
7f222c8f10785f37e37788eb0d15d62f

SHA1
e5d6a9cc3600806a780b848e27fce50b52ef03e6

SHA256
4feefe44ed7741b7a5c1180d5fc0137ea43d0c0e4c527baffc16488d217ea393

SHA512
6a80858b0ccc4aca00cb5c1f3e8bcb53d268b96f59fc6faf7e9494ee35bfeca8617a03302f5401b6a2b9618e890f010e6c54ab06a7d5d3fd1f54b27982703e48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
2KB

MD5
7f222c8f10785f37e37788eb0d15d62f

SHA1
e5d6a9cc3600806a780b848e27fce50b52ef03e6

SHA256
4feefe44ed7741b7a5c1180d5fc0137ea43d0c0e4c527baffc16488d217ea393

SHA512
6a80858b0ccc4aca00cb5c1f3e8bcb53d268b96f59fc6faf7e9494ee35bfeca8617a03302f5401b6a2b9618e890f010e6c54ab06a7d5d3fd1f54b27982703e48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
2KB

MD5
e09345c640b664a92d1a116be1c8a5e8

SHA1
6956d87707204f81631ad36327dc4194a1965da3

SHA256
bfc686f27e09f52ec046ab22f11157ae24d5c37aa51560b24c524b57733521cf

SHA512
b782fd29a767d524475b1662f4a23ad3c1814cc6ba0e86a32c98019f51771ae4f3c13756e25d8db1b9fe142b4907d424df441b9f7325004db4ab9cee2a6bbfe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dqptnfu\imagestore.dat

Filesize
980B

MD5
9f2086a1f562b5ffe0be86ec8e99a534

SHA1
4cc8459d8eed79d16ac280e31accaaa0f2a63f04

SHA256
dced945c9a81adf3e500055ec91843de405bcd17a763e8c64d41e5d59b273e47

SHA512
526b6b0f23cd872f866d9df97ddd9e104451d43a2314604567a02b4a83b07b232c74edb5a47b5ebb330710695d60123320ef50270bb8993c87a8991ebe3296b5

Download Submit