gh0strat | 593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe
Size

480KB
MD5

6f50e2b491285314dffbdf495c20b1e0
SHA1

12f3bc625b8cde134da267ddbaa70df9ad49848b
SHA256

593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41
SHA512

ddd629e0c8136b3de43ed7a000caa268e3f65c6e6fe01eb3987cf848ea1841136fec129e49762ea2b6a48ffa87ee44a24d34c639fb8e4f75b47838cd4093edb0
SSDEEP

12288:R1DYr96WUZOMwO5eTV38FRCXUq89H8I/mVOQiXpuUUM:RdY5TMwseTvXUq89cYmQz5uUUM

Score

10^/10

gh0strat joker aspackv2 bootkit infostealer persistence rat trojan

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0009000000022eb9-141.dat	family_gh0strat
behavioral2/files/0x0009000000022eb9-142.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0006000000022f5c-134.dat	aspack_v212_v242
behavioral2/files/0x0006000000022f5c-133.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe
1616	ÊµÃ÷ÈÏÖ¤.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe

Loads dropped DLL 1 IoCs

pid	Process
3724	svchost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xmwdfbfkpe	svchost.exe
File created	C:\Windows\SysWOW64\xeijwxdmdj	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{73B172C1-428A-11ED-AECB-4A8324823CC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\lbxywl.com\Total = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987927"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1224884776"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1224884776"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987927"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00be274f97d6d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\lbxywl.com\Total = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1262541954"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987927"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987927"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.lbxywl.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987927"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1224884776"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987927"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\lbxywl.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mgy5.tv\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371504773"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1224884776"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987927"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1225041525"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1225041525"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987927"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1224884776"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3724	svchost.exe
3724	svchost.exe
3724	svchost.exe
3724	svchost.exe
3724	svchost.exe
3724	svchost.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeBackupPrivilege	1616	ÊµÃ÷ÈÏÖ¤.exe
Token: SeRestorePrivilege	1616	ÊµÃ÷ÈÏÖ¤.exe
Token: SeBackupPrivilege	1616	ÊµÃ÷ÈÏÖ¤.exe
Token: SeRestorePrivilege	1616	ÊµÃ÷ÈÏÖ¤.exe
Token: SeBackupPrivilege	3724	svchost.exe
Token: SeRestorePrivilege	3724	svchost.exe
Token: SeBackupPrivilege	3724	svchost.exe
Token: SeBackupPrivilege	3724	svchost.exe
Token: SeSecurityPrivilege	3724	svchost.exe
Token: SeSecurityPrivilege	3724	svchost.exe
Token: SeBackupPrivilege	3724	svchost.exe
Token: SeBackupPrivilege	3724	svchost.exe
Token: SeSecurityPrivilege	3724	svchost.exe
Token: SeBackupPrivilege	3724	svchost.exe
Token: SeBackupPrivilege	3724	svchost.exe
Token: SeSecurityPrivilege	3724	svchost.exe
Token: SeBackupPrivilege	3724	svchost.exe
Token: SeRestorePrivilege	3724	svchost.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5116	iexplore.exe
4028	iexplore.exe
1924	iexplore.exe
3564	iexplore.exe
3644	iexplore.exe
3760	iexplore.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
4028	iexplore.exe
4028	iexplore.exe
1924	iexplore.exe
1924	iexplore.exe
3760	iexplore.exe
3760	iexplore.exe
3644	iexplore.exe
3644	iexplore.exe
3564	iexplore.exe
3564	iexplore.exe
5116	iexplore.exe
5116	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2880	IEXPLORE.EXE
1184	IEXPLORE.EXE
2880	IEXPLORE.EXE
1184	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
756	IEXPLORE.EXE
756	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4952	4768	593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe	82
PID 4768 wrote to memory of 4952	4768	593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe	82
PID 4768 wrote to memory of 4952	4768	593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe	82
PID 4768 wrote to memory of 1616	4768	593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe	83
PID 4768 wrote to memory of 1616	4768	593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe	83
PID 4768 wrote to memory of 1616	4768	593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe	83
PID 4952 wrote to memory of 4028	4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe	85
PID 4952 wrote to memory of 4028	4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe	85
PID 4952 wrote to memory of 1924	4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe	86
PID 4952 wrote to memory of 1924	4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe	86
PID 4952 wrote to memory of 5116	4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe	87
PID 4952 wrote to memory of 5116	4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe	87
PID 4952 wrote to memory of 3564	4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe	88
PID 4952 wrote to memory of 3564	4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe	88
PID 4952 wrote to memory of 3760	4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe	89
PID 4952 wrote to memory of 3760	4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe	89
PID 4952 wrote to memory of 3644	4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe	91
PID 4952 wrote to memory of 3644	4952	ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe	91
PID 4028 wrote to memory of 2440	4028	iexplore.exe	97
PID 4028 wrote to memory of 2440	4028	iexplore.exe	97
PID 4028 wrote to memory of 2440	4028	iexplore.exe	97
PID 1924 wrote to memory of 3000	1924	iexplore.exe	92
PID 1924 wrote to memory of 3000	1924	iexplore.exe	92
PID 1924 wrote to memory of 3000	1924	iexplore.exe	92
PID 3760 wrote to memory of 3024	3760	iexplore.exe	96
PID 3760 wrote to memory of 3024	3760	iexplore.exe	96
PID 3760 wrote to memory of 3024	3760	iexplore.exe	96
PID 3644 wrote to memory of 2880	3644	iexplore.exe	95
PID 3644 wrote to memory of 2880	3644	iexplore.exe	95
PID 3644 wrote to memory of 2880	3644	iexplore.exe	95
PID 3564 wrote to memory of 756	3564	iexplore.exe	94
PID 3564 wrote to memory of 756	3564	iexplore.exe	94
PID 3564 wrote to memory of 756	3564	iexplore.exe	94
PID 5116 wrote to memory of 1184	5116	iexplore.exe	93
PID 5116 wrote to memory of 1184	5116	iexplore.exe	93
PID 5116 wrote to memory of 1184	5116	iexplore.exe	93

C:\Users\Admin\AppData\Local\Temp\593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe
"C:\Users\Admin\AppData\Local\Temp\593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.lbxywl.com
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4028 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2440
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" Http://wb.lbxywl.com/Ad/1.asp
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3000
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" Http://wb.lbxywl.com/Ad/2.asp
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5116 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1184
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" Http://wb.lbxywl.com/Ad/3.asp
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3564 CREDAT:17410 /prefetch:2
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:756
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" Http://wb.lbxywl.com/Ad/4.asp
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3760 CREDAT:17410 /prefetch:2
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3024
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" Http://wb.lbxywl.com/Ad/5.asp
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3644 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2880
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ÊµÃ÷ÈÏÖ¤.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ÊµÃ÷ÈÏÖ¤.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1616

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "netsvcs" -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
fd70739fca5345a28f924f9102ae10ee

SHA1
6ce3f92183544f3bf52cb76364591589cb940a19

SHA256
f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7

SHA512
a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
fd70739fca5345a28f924f9102ae10ee

SHA1
6ce3f92183544f3bf52cb76364591589cb940a19

SHA256
f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7

SHA512
a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
fd70739fca5345a28f924f9102ae10ee

SHA1
6ce3f92183544f3bf52cb76364591589cb940a19

SHA256
f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7

SHA512
a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
fd70739fca5345a28f924f9102ae10ee

SHA1
6ce3f92183544f3bf52cb76364591589cb940a19

SHA256
f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7

SHA512
a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
fd70739fca5345a28f924f9102ae10ee

SHA1
6ce3f92183544f3bf52cb76364591589cb940a19

SHA256
f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7

SHA512
a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
fd70739fca5345a28f924f9102ae10ee

SHA1
6ce3f92183544f3bf52cb76364591589cb940a19

SHA256
f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7

SHA512
a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
8656f34f3a7779daf590fdeb33617cd3

SHA1
e84ea556aa2fe49cedbb88635ea1b3cb78f8a018

SHA256
83b669f0f60eb7f66e726fedd126a651b1a977cde64d75dedbb9387cbc594f8d

SHA512
e953b3c5906ae8599282a3cdfdaf792be80ba3e8ce25edd38192992617e22d39ce44a1fda74a7f2430bd7f65a391ece54546dbec19a6b314d1f53869a3e621f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
b28e5b4d9c66d91bcab8774316af12c4

SHA1
82105cce6fb037e186abe519029d8ca363555ec8

SHA256
85a1474536815a9765e76f20455d2400531a2aa6345797ca2d5b52d86b368966

SHA512
41a1bf8224aad3f262ea9077557ee556e0da0e7ae36ca16439712ee937be960f7df27687e5a01db811ae0d889415fd074e63811ae237729aa5f5365655c4aae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
a2b2efe4ee769f57018c45e6b9f2781e

SHA1
d1b95904cc6254e064272d73de58e95bab370403

SHA256
ae325ff70bf267f7ae73a4371668125f385ccdab986e6c49fa97afbc06b2085c

SHA512
cdfee64d7ca71715f7abd52ef009ca256e362e802867a6b1ca2d4148806d6461da5f0e8cd8f4e59c3c0fcc00076b267f8fa101e6b0821305c9acdc6e123edb21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
698a0b3503c68e9787e353951f246d0b

SHA1
90ed96bb20acfa75c263d65b0e073ee70a24a610

SHA256
e9a092f8339a081bdc93e1319608d6b14e7f07ed7837e4fa81ebd2a6d18b1197

SHA512
0b8fc0b12d8807636c93c74de744fd67838a8efc7bd9250610654c3a804c0077ae5557339ce01df67e8af5d82962405436568db1435dd76db7567bdb61d0cfd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
698a0b3503c68e9787e353951f246d0b

SHA1
90ed96bb20acfa75c263d65b0e073ee70a24a610

SHA256
e9a092f8339a081bdc93e1319608d6b14e7f07ed7837e4fa81ebd2a6d18b1197

SHA512
0b8fc0b12d8807636c93c74de744fd67838a8efc7bd9250610654c3a804c0077ae5557339ce01df67e8af5d82962405436568db1435dd76db7567bdb61d0cfd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
698a0b3503c68e9787e353951f246d0b

SHA1
90ed96bb20acfa75c263d65b0e073ee70a24a610

SHA256
e9a092f8339a081bdc93e1319608d6b14e7f07ed7837e4fa81ebd2a6d18b1197

SHA512
0b8fc0b12d8807636c93c74de744fd67838a8efc7bd9250610654c3a804c0077ae5557339ce01df67e8af5d82962405436568db1435dd76db7567bdb61d0cfd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
7279b3103b46ca5a00f9e18859cb172e

SHA1
7c2abf9e395fd287de07526925929b84da0e2fd2

SHA256
8df4ba3a1f4099c01f7865e46554745574763a98a3af205d6b413b5f8697a97c

SHA512
632d986452b74b72a0e076f64c327cb073b16aa4fc8e56d7509cd220b7e1de73f9c008fa8011b0699d86f10e693b78330ae8731078e959e143b52b28befde491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
7279b3103b46ca5a00f9e18859cb172e

SHA1
7c2abf9e395fd287de07526925929b84da0e2fd2

SHA256
8df4ba3a1f4099c01f7865e46554745574763a98a3af205d6b413b5f8697a97c

SHA512
632d986452b74b72a0e076f64c327cb073b16aa4fc8e56d7509cd220b7e1de73f9c008fa8011b0699d86f10e693b78330ae8731078e959e143b52b28befde491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{73A8110E-428A-11ED-AECB-4A8324823CC0}.dat

Filesize
4KB

MD5
6cc0675b917fdff6aaecccfe1b4ea814

SHA1
9fc0ef8a24ddfdc78c4094c10c4ebff9b38c2c3a

SHA256
fc6eb9b824f8cf2a615271828200404768a3264c64e2f725c4637ca12ebc584d

SHA512
ffca4d12e3b31136233fe6b0e2c001e07e6f298b2e01cf21ea6201a46691d038cd2fa798fdf1e4a4302fe0ee8abbf0465fceaf7cf4fee6b0ea5bc66ae2038c90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{73AF5D98-428A-11ED-AECB-4A8324823CC0}.dat

Filesize
4KB

MD5
9ed325ba101ec0342f9d4e5e9d7fa0a9

SHA1
1b6ea153c9ee549c99f8f7f708be80a4b326f0ee

SHA256
3bda82648a0e8fcda3db6c125a45ec309fe2ed9a50a40977b7cabc73dfd1ece2

SHA512
92c8932c5da72e8e5395e5430228e26f9241fe7d26f0c0c0596d48fa5099b4b9620b4cb111a576fa7cfc7cb3f171eb0f9e59f492b0c98f6ad6e41263be5f23cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z2evvp3\imagestore.dat

Filesize
1KB

MD5
4cce401ef2e6558b5ae3d7bb8df8c32a

SHA1
4910804f0ac3fafa3995d15c7574d3652c54df56

SHA256
7ef800696ee66838d3d78a3242643804501693a8212d018ac442038b9e43b663

SHA512
6ea6005f74a6544155609b79be8ee4f71e998604e1d2635320aebc49be6bb4c852c00345836d8dcb5b37c4cf783f248507ac76b49920260269aeecf1126378f4

Download Submit
C:\Users\Admin\AppData\Roaming\ACD Systems\ACDSee\Imageiy.ddf

Filesize
768KB

MD5
f654b966fb49d9c94a7eb3344c8ac8c4

SHA1
be33808cd3938d9eac87d3ad05c202b88b34f8fd

SHA256
58a055b6a3126a43a6664567633c9b83f40106ac40464993d09a9c94c9c0f375

SHA512
e803abdbce4f64b0bde940e15311bc00997894dfb675366d8688f39ee084ba9bdbb1176474491ec9cc700bb76b3afb5e9e97f69422e9e328e69168450c5eeb63

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ÊµÃ÷ÈÏÖ¤.exe

Filesize
192KB

MD5
87c4f6ec9a137bea1f00052b438417e3

SHA1
3cd79dc0b335feb011902805c69f75b0a73f6455

SHA256
8bb2557b2a86bbf7b19a7ca20349e60726471151df575f4460d8608153632f19

SHA512
1e5831bd17f03d7bc01e7863784f5ebfb13de7fc09eb63dc23957fc8e296159ff80f7ea936e4fc85ff4f1cfbd117f60803dec769fc3ce83a6e5191fbbfd75b47

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ÊµÃ÷ÈÏÖ¤.exe

Filesize
192KB

MD5
87c4f6ec9a137bea1f00052b438417e3

SHA1
3cd79dc0b335feb011902805c69f75b0a73f6455

SHA256
8bb2557b2a86bbf7b19a7ca20349e60726471151df575f4460d8608153632f19

SHA512
1e5831bd17f03d7bc01e7863784f5ebfb13de7fc09eb63dc23957fc8e296159ff80f7ea936e4fc85ff4f1cfbd117f60803dec769fc3ce83a6e5191fbbfd75b47

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe

Filesize
287KB

MD5
f8c6fa7133ee1e2bd1941e5d12e0a48f

SHA1
797417d1e31f02b0ea0557b92300b3bd92a8be99

SHA256
0862fb9a6e5292ab10ae4a08817da2e80da960840adb2ea4cd6feb5a2198207e

SHA512
d84d50ba8c1e7acec14c419dd0669b259dac3e151558041be38936feab98b469401a3dc18cc0ad8d3833851157a9ddd16eb271f4ca5508ef34dacdc5b898ab04

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ÊµÃûË¢¿¨È«ÄÜ¸¨Öú.exe

Filesize
287KB

MD5
f8c6fa7133ee1e2bd1941e5d12e0a48f

SHA1
797417d1e31f02b0ea0557b92300b3bd92a8be99

SHA256
0862fb9a6e5292ab10ae4a08817da2e80da960840adb2ea4cd6feb5a2198207e

SHA512
d84d50ba8c1e7acec14c419dd0669b259dac3e151558041be38936feab98b469401a3dc18cc0ad8d3833851157a9ddd16eb271f4ca5508ef34dacdc5b898ab04

Download Submit
\??\c:\users\admin\application data\acd systems\acdsee\imageiy.ddf

Filesize
768KB

MD5
f654b966fb49d9c94a7eb3344c8ac8c4

SHA1
be33808cd3938d9eac87d3ad05c202b88b34f8fd

SHA256
58a055b6a3126a43a6664567633c9b83f40106ac40464993d09a9c94c9c0f375

SHA512
e803abdbce4f64b0bde940e15311bc00997894dfb675366d8688f39ee084ba9bdbb1176474491ec9cc700bb76b3afb5e9e97f69422e9e328e69168450c5eeb63

Download Submit
memory/4952-145-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4952-140-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4952-139-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4952-138-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download