lumma | 1013ad1290523f5417ed789d11900f8ae804c0d81ed60af75684039fb06223b8

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe
Size

1.8MB
MD5

f9bb522ae0a4aa47a6d94bc99e215bb6
SHA1

665c41342fa5b963bb29fc78b27fd6798ceb3f4f
SHA256

1013ad1290523f5417ed789d11900f8ae804c0d81ed60af75684039fb06223b8
SHA512

6a16c60bb872ddfca4d522bd87ebee7010a135287923081a7bf93c3bd3e0805353c241f13634c86523a8e19958a4dd63c81bbbfa63b6a7ec33f67b949415ef8d
SSDEEP

49152:pJ2G79v/xSHzBJ6WC+j2bpW+6Q4GIPs7eBl3au:pJ2G7J/xSKWmbp9F4Gr

Score

10^/10

lumma metasploit backdoor evasion stealer themida trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

Detect Lumma Stealer payload V4 22 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3048-122-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/3048-163-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/1584-167-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/1584-170-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/1584-181-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/1300-190-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/1300-301-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/1300-308-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/1968-430-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/1968-435-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/1968-445-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/2632-454-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/2632-564-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/2632-570-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/2480-585-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/2480-695-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/2004-831-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/2132-953-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/2132-964-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/1624-1084-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/1624-1094-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4
behavioral1/memory/988-1212-0x0000000000400000-0x00000000007D4000-memory.dmp	family_lumma_v4

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies security service 2 TTPs 20 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

regedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe

Executes dropped EXE 11 IoCs

Processes:

MINE.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exe

pid	process
3048	MINE.exe
1584	windows_update.exe
1300	windows_update.exe
1968	windows_update.exe
2632	windows_update.exe
2480	windows_update.exe
2004	windows_update.exe
2132	windows_update.exe
1624	windows_update.exe
988	windows_update.exe
2836	windows_update.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

windows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exeMINE.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	windows_update.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	windows_update.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	windows_update.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	windows_update.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	windows_update.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	windows_update.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	MINE.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	windows_update.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	windows_update.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	windows_update.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	windows_update.exe

Loads dropped DLL 42 IoCs

Processes:

f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exeMINE.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exe

pid	process
2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe
2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe
3048	MINE.exe
1584	windows_update.exe
1584	windows_update.exe
1584	windows_update.exe
1584	windows_update.exe
1300	windows_update.exe
1300	windows_update.exe
1300	windows_update.exe
1300	windows_update.exe
1968	windows_update.exe
1968	windows_update.exe
1968	windows_update.exe
1968	windows_update.exe
2632	windows_update.exe
2632	windows_update.exe
2632	windows_update.exe
2632	windows_update.exe
2480	windows_update.exe
2480	windows_update.exe
2480	windows_update.exe
2480	windows_update.exe
2004	windows_update.exe
2004	windows_update.exe
2004	windows_update.exe
2004	windows_update.exe
2132	windows_update.exe
2132	windows_update.exe
2132	windows_update.exe
2132	windows_update.exe
1624	windows_update.exe
1624	windows_update.exe
1624	windows_update.exe
1624	windows_update.exe
988	windows_update.exe
988	windows_update.exe
988	windows_update.exe
988	windows_update.exe
2836	windows_update.exe
2836	windows_update.exe
2836	windows_update.exe

Themida packer 29 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MINE.exe	themida
behavioral1/memory/3048-16-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/3048-122-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1584-164-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/3048-163-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1584-167-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1584-170-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1300-177-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1584-181-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1300-190-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1300-301-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1300-308-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1968-310-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1968-430-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1968-435-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/2632-441-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1968-445-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/2632-454-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/2632-564-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/2632-570-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/2480-573-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/2480-585-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/2480-695-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/2004-831-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/2132-953-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/2132-964-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1624-1084-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/1624-1094-0x0000000000400000-0x00000000007D4000-memory.dmp	themida
behavioral1/memory/988-1212-0x0000000000400000-0x00000000007D4000-memory.dmp	themida

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in System32 directory 22 IoCs

Processes:

MINE.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exe

description	ioc	process
File created	C:\Windows\SysWOW64\windows_update.exe	MINE.exe
File opened for modification	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File opened for modification	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File created	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File created	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File opened for modification	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File created	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File opened for modification	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File opened for modification	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File opened for modification	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File opened for modification	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File created	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File created	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File opened for modification	C:\Windows\SysWOW64\windows_update.exe	MINE.exe
File created	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File created	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File created	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File created	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File opened for modification	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File created	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File opened for modification	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe
File opened for modification	C:\Windows\SysWOW64\windows_update.exe	windows_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs .reg file with regedit 10 IoCs

Processes:

regedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exe

pid	process
2460	regedit.exe
2748	regedit.exe
2760	regedit.exe
1360	regedit.exe
1868	regedit.exe
540	regedit.exe
2968	regedit.exe
832	regedit.exe
2656	regedit.exe
712	regedit.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

MINE.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exewindows_update.exe

pid	process
3048	MINE.exe
1584	windows_update.exe
1300	windows_update.exe
1968	windows_update.exe
2632	windows_update.exe
2480	windows_update.exe
2004	windows_update.exe
2132	windows_update.exe
1624	windows_update.exe
988	windows_update.exe
2836	windows_update.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msiexec.exe

pid process

1756 msiexec.exe

pid	process
1756	msiexec.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1756	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	2564	msiexec.exe
Token: SeTakeOwnershipPrivilege	2564	msiexec.exe
Token: SeSecurityPrivilege	2564	msiexec.exe
Token: SeCreateTokenPrivilege	1756	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1756	msiexec.exe
Token: SeLockMemoryPrivilege	1756	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1756	msiexec.exe
Token: SeMachineAccountPrivilege	1756	msiexec.exe
Token: SeTcbPrivilege	1756	msiexec.exe
Token: SeSecurityPrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeLoadDriverPrivilege	1756	msiexec.exe
Token: SeSystemProfilePrivilege	1756	msiexec.exe
Token: SeSystemtimePrivilege	1756	msiexec.exe
Token: SeProfSingleProcessPrivilege	1756	msiexec.exe
Token: SeIncBasePriorityPrivilege	1756	msiexec.exe
Token: SeCreatePagefilePrivilege	1756	msiexec.exe
Token: SeCreatePermanentPrivilege	1756	msiexec.exe
Token: SeBackupPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeShutdownPrivilege	1756	msiexec.exe
Token: SeDebugPrivilege	1756	msiexec.exe
Token: SeAuditPrivilege	1756	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1756	msiexec.exe
Token: SeChangeNotifyPrivilege	1756	msiexec.exe
Token: SeRemoteShutdownPrivilege	1756	msiexec.exe
Token: SeUndockPrivilege	1756	msiexec.exe
Token: SeSyncAgentPrivilege	1756	msiexec.exe
Token: SeEnableDelegationPrivilege	1756	msiexec.exe
Token: SeManageVolumePrivilege	1756	msiexec.exe
Token: SeImpersonatePrivilege	1756	msiexec.exe
Token: SeCreateGlobalPrivilege	1756	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

1756 msiexec.exe

pid	process
1756	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exeMINE.execmd.exewindows_update.exewindows_update.execmd.exewindows_update.execmd.exe

description	pid	process	target process
PID 2852 wrote to memory of 1756	2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe	msiexec.exe
PID 2852 wrote to memory of 1756	2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe	msiexec.exe
PID 2852 wrote to memory of 1756	2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe	msiexec.exe
PID 2852 wrote to memory of 1756	2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe	msiexec.exe
PID 2852 wrote to memory of 1756	2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe	msiexec.exe
PID 2852 wrote to memory of 1756	2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe	msiexec.exe
PID 2852 wrote to memory of 1756	2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe	msiexec.exe
PID 2852 wrote to memory of 3048	2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe	MINE.exe
PID 2852 wrote to memory of 3048	2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe	MINE.exe
PID 2852 wrote to memory of 3048	2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe	MINE.exe
PID 2852 wrote to memory of 3048	2852	f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe	MINE.exe
PID 3048 wrote to memory of 2776	3048	MINE.exe	cmd.exe
PID 3048 wrote to memory of 2776	3048	MINE.exe	cmd.exe
PID 3048 wrote to memory of 2776	3048	MINE.exe	cmd.exe
PID 3048 wrote to memory of 2776	3048	MINE.exe	cmd.exe
PID 2776 wrote to memory of 540	2776	cmd.exe	regedit.exe
PID 2776 wrote to memory of 540	2776	cmd.exe	regedit.exe
PID 2776 wrote to memory of 540	2776	cmd.exe	regedit.exe
PID 2776 wrote to memory of 540	2776	cmd.exe	regedit.exe
PID 3048 wrote to memory of 1584	3048	MINE.exe	windows_update.exe
PID 3048 wrote to memory of 1584	3048	MINE.exe	windows_update.exe
PID 3048 wrote to memory of 1584	3048	MINE.exe	windows_update.exe
PID 3048 wrote to memory of 1584	3048	MINE.exe	windows_update.exe
PID 3048 wrote to memory of 1584	3048	MINE.exe	windows_update.exe
PID 3048 wrote to memory of 1584	3048	MINE.exe	windows_update.exe
PID 3048 wrote to memory of 1584	3048	MINE.exe	windows_update.exe
PID 1584 wrote to memory of 1300	1584	windows_update.exe	windows_update.exe
PID 1584 wrote to memory of 1300	1584	windows_update.exe	windows_update.exe
PID 1584 wrote to memory of 1300	1584	windows_update.exe	windows_update.exe
PID 1584 wrote to memory of 1300	1584	windows_update.exe	windows_update.exe
PID 1584 wrote to memory of 1300	1584	windows_update.exe	windows_update.exe
PID 1584 wrote to memory of 1300	1584	windows_update.exe	windows_update.exe
PID 1584 wrote to memory of 1300	1584	windows_update.exe	windows_update.exe
PID 1300 wrote to memory of 3008	1300	windows_update.exe	cmd.exe
PID 1300 wrote to memory of 3008	1300	windows_update.exe	cmd.exe
PID 1300 wrote to memory of 3008	1300	windows_update.exe	cmd.exe
PID 1300 wrote to memory of 3008	1300	windows_update.exe	cmd.exe
PID 1300 wrote to memory of 3008	1300	windows_update.exe	cmd.exe
PID 1300 wrote to memory of 3008	1300	windows_update.exe	cmd.exe
PID 1300 wrote to memory of 3008	1300	windows_update.exe	cmd.exe
PID 3008 wrote to memory of 2460	3008	cmd.exe	regedit.exe
PID 3008 wrote to memory of 2460	3008	cmd.exe	regedit.exe
PID 3008 wrote to memory of 2460	3008	cmd.exe	regedit.exe
PID 3008 wrote to memory of 2460	3008	cmd.exe	regedit.exe
PID 3008 wrote to memory of 2460	3008	cmd.exe	regedit.exe
PID 3008 wrote to memory of 2460	3008	cmd.exe	regedit.exe
PID 3008 wrote to memory of 2460	3008	cmd.exe	regedit.exe
PID 1300 wrote to memory of 1968	1300	windows_update.exe	windows_update.exe
PID 1300 wrote to memory of 1968	1300	windows_update.exe	windows_update.exe
PID 1300 wrote to memory of 1968	1300	windows_update.exe	windows_update.exe
PID 1300 wrote to memory of 1968	1300	windows_update.exe	windows_update.exe
PID 1300 wrote to memory of 1968	1300	windows_update.exe	windows_update.exe
PID 1300 wrote to memory of 1968	1300	windows_update.exe	windows_update.exe
PID 1300 wrote to memory of 1968	1300	windows_update.exe	windows_update.exe
PID 1968 wrote to memory of 1652	1968	windows_update.exe	cmd.exe
PID 1968 wrote to memory of 1652	1968	windows_update.exe	cmd.exe
PID 1968 wrote to memory of 1652	1968	windows_update.exe	cmd.exe
PID 1968 wrote to memory of 1652	1968	windows_update.exe	cmd.exe
PID 1968 wrote to memory of 1652	1968	windows_update.exe	cmd.exe
PID 1968 wrote to memory of 1652	1968	windows_update.exe	cmd.exe
PID 1968 wrote to memory of 1652	1968	windows_update.exe	cmd.exe
PID 1652 wrote to memory of 2748	1652	cmd.exe	regedit.exe
PID 1652 wrote to memory of 2748	1652	cmd.exe	regedit.exe
PID 1652 wrote to memory of 2748	1652	cmd.exe	regedit.exe

C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Mayoko110.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1756
- C:\Users\Admin\AppData\Local\Temp\MINE.exe
  "C:\Users\Admin\AppData\Local\Temp\MINE.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\a.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SysWOW64\regedit.exe
      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
      4⤵
      Modifies security service
      Runs .reg file with regedit
      PID:540
- - C:\Windows\SysWOW64\windows_update.exe
    C:\Windows\system32\windows_update.exe 668 "C:\Users\Admin\AppData\Local\Temp\MINE.exe"
    3⤵
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\SysWOW64\windows_update.exe
      C:\Windows\system32\windows_update.exe 768 "C:\Windows\SysWOW64\windows_update.exe"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1300
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3008
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2460
    - - C:\Windows\SysWOW64\windows_update.exe
        
        C:\Windows\system32\windows_update.exe 784 "C:\Windows\SysWOW64\windows_update.exe"
        5⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1968
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2748
      - C:\Windows\SysWOW64\windows_update.exe
        
        C:\Windows\system32\windows_update.exe 792 "C:\Windows\SysWOW64\windows_update.exe"
        6⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2632
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        7⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2968
        
        C:\Windows\SysWOW64\windows_update.exe
        
        C:\Windows\system32\windows_update.exe 788 "C:\Windows\SysWOW64\windows_update.exe"
        7⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2480
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        8⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2760
        
        C:\Windows\SysWOW64\windows_update.exe
        
        C:\Windows\system32\windows_update.exe 800 "C:\Windows\SysWOW64\windows_update.exe"
        8⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        9⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:832
        
        C:\Windows\SysWOW64\windows_update.exe
        
        C:\Windows\system32\windows_update.exe 796 "C:\Windows\SysWOW64\windows_update.exe"
        9⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        10⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2656
        
        C:\Windows\SysWOW64\windows_update.exe
        
        C:\Windows\system32\windows_update.exe 808 "C:\Windows\SysWOW64\windows_update.exe"
        10⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        11⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:712
        
        C:\Windows\SysWOW64\windows_update.exe
        
        C:\Windows\system32\windows_update.exe 812 "C:\Windows\SysWOW64\windows_update.exe"
        11⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        12⤵
        
        PID:320
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1868
        
        C:\Windows\SysWOW64\windows_update.exe
        
        C:\Windows\system32\windows_update.exe 816 "C:\Windows\SysWOW64\windows_update.exe"
        12⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        13⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        14⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1360

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mayoko110.msi

Filesize
331KB

MD5
c6b2b9d56db7b703f815cfb6c3afe15f

SHA1
755374a9e93762d5cc954b9ac8b7806b0350f5e9

SHA256
f5d26026febd4fb52b651fd2cb0677289a32db2dda7a76fa161a0f72f3e1f7b4

SHA512
a1e92ff0aec339275747f86c6261a2e78bd4511b406fd90e22e8514a76bf161c4758135e2142ccc472e4d4d04c9911853d17e27272c6c389e9bea6c01debcdd7

Download Submit
C:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\Users\Admin\AppData\Local\Temp\MINE.exe

Filesize
1.4MB

MD5
9c0595fe4367e61e2e578ef6fa5e3d0f

SHA1
99a64947b86b69e2dda873076e18433a63338729

SHA256
60591d011a090da281ada86b6b9d505e7faa491ce23304b74f7e243a973d5714

SHA512
898712fa3192ccdfbb0346119357bada0839d58d095c18099ac839778b10eb13372618bf0ad0187b4a4526f95a6058bb5bbcd137046bbfb7ef19c60fa0417c85

Download Submit
memory/988-1212-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1300-300-0x00000000049E0000-0x00000000049E2000-memory.dmp

Filesize
8KB

Download
memory/1300-180-0x0000000000E60000-0x0000000001234000-memory.dmp

Filesize
3.8MB

Download
memory/1300-308-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1300-301-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1300-177-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1300-178-0x0000000000E60000-0x0000000001234000-memory.dmp

Filesize
3.8MB

Download
memory/1300-190-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1300-179-0x0000000000E60000-0x0000000001234000-memory.dmp

Filesize
3.8MB

Download
memory/1300-298-0x0000000004A70000-0x0000000004A72000-memory.dmp

Filesize
8KB

Download
memory/1300-182-0x0000000004AA0000-0x0000000004AA2000-memory.dmp

Filesize
8KB

Download
memory/1300-309-0x0000000000E60000-0x0000000001234000-memory.dmp

Filesize
3.8MB

Download
memory/1584-181-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1584-164-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1584-176-0x0000000000D70000-0x0000000001144000-memory.dmp

Filesize
3.8MB

Download
memory/1584-170-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1584-168-0x0000000004A70000-0x0000000004A72000-memory.dmp

Filesize
8KB

Download
memory/1584-169-0x00000000049F0000-0x00000000049F2000-memory.dmp

Filesize
8KB

Download
memory/1584-167-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1584-166-0x0000000004AA0000-0x0000000004AA2000-memory.dmp

Filesize
8KB

Download
memory/1584-165-0x0000000000D70000-0x0000000001144000-memory.dmp

Filesize
3.8MB

Download
memory/1624-1094-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1624-1084-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1968-430-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1968-431-0x0000000004A70000-0x0000000004A72000-memory.dmp

Filesize
8KB

Download
memory/1968-311-0x0000000000D40000-0x0000000001114000-memory.dmp

Filesize
3.8MB

Download
memory/1968-313-0x0000000000D40000-0x0000000001114000-memory.dmp

Filesize
3.8MB

Download
memory/1968-322-0x0000000004AA0000-0x0000000004AA2000-memory.dmp

Filesize
8KB

Download
memory/1968-310-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1968-433-0x0000000004A10000-0x0000000004A12000-memory.dmp

Filesize
8KB

Download
memory/1968-314-0x0000000000D40000-0x0000000001114000-memory.dmp

Filesize
3.8MB

Download
memory/1968-434-0x00000000049F0000-0x00000000049F2000-memory.dmp

Filesize
8KB

Download
memory/1968-435-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1968-445-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/2004-831-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/2132-964-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/2132-953-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/2480-571-0x0000000001020000-0x00000000013F4000-memory.dmp

Filesize
3.8MB

Download
memory/2480-583-0x0000000004AB0000-0x0000000004AB2000-memory.dmp

Filesize
8KB

Download
memory/2480-693-0x0000000004A80000-0x0000000004A82000-memory.dmp

Filesize
8KB

Download
memory/2480-585-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/2480-695-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/2480-575-0x0000000001020000-0x00000000013F4000-memory.dmp

Filesize
3.8MB

Download
memory/2480-573-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/2480-572-0x0000000001020000-0x00000000013F4000-memory.dmp

Filesize
3.8MB

Download
memory/2632-442-0x0000000000E50000-0x0000000001224000-memory.dmp

Filesize
3.8MB

Download
memory/2632-443-0x0000000000E50000-0x0000000001224000-memory.dmp

Filesize
3.8MB

Download
memory/2632-570-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/2632-564-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/2632-470-0x0000000004A90000-0x0000000004A92000-memory.dmp

Filesize
8KB

Download
memory/2632-454-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/2632-447-0x0000000004AC0000-0x0000000004AC2000-memory.dmp

Filesize
8KB

Download
memory/2632-444-0x0000000000E50000-0x0000000001224000-memory.dmp

Filesize
3.8MB

Download
memory/2632-441-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/2852-13-0x0000000003010000-0x00000000033E4000-memory.dmp

Filesize
3.8MB

Download
memory/2852-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2852-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3048-143-0x0000000004500000-0x0000000004501000-memory.dmp

Filesize
4KB

Download
memory/3048-139-0x0000000004540000-0x0000000004542000-memory.dmp

Filesize
8KB

Download
memory/3048-142-0x00000000044E0000-0x00000000044E1000-memory.dmp

Filesize
4KB

Download
memory/3048-144-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/3048-145-0x0000000004470000-0x0000000004471000-memory.dmp

Filesize
4KB

Download
memory/3048-149-0x0000000004510000-0x0000000004511000-memory.dmp

Filesize
4KB

Download
memory/3048-150-0x00000000044B0000-0x00000000044B1000-memory.dmp

Filesize
4KB

Download
memory/3048-152-0x0000000004550000-0x0000000004551000-memory.dmp

Filesize
4KB

Download
memory/3048-137-0x0000000004430000-0x0000000004431000-memory.dmp

Filesize
4KB

Download
memory/3048-140-0x0000000004460000-0x0000000004461000-memory.dmp

Filesize
4KB

Download
memory/3048-141-0x0000000004480000-0x0000000004481000-memory.dmp

Filesize
4KB

Download
memory/3048-163-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/3048-135-0x00000000044F0000-0x00000000044F1000-memory.dmp

Filesize
4KB

Download
memory/3048-136-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/3048-134-0x0000000004530000-0x0000000004531000-memory.dmp

Filesize
4KB

Download
memory/3048-122-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/3048-25-0x0000000004570000-0x0000000004572000-memory.dmp

Filesize
8KB

Download
memory/3048-16-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/3048-17-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/3048-15-0x00000000007E0000-0x00000000008DF000-memory.dmp

Filesize
1020KB

Download
memory/3048-151-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/3048-162-0x0000000004C40000-0x0000000005014000-memory.dmp

Filesize
3.8MB

Download