7a59ec6c3da318c541e0fc5dd03835e7d585368ea0b5dad669a651adc5ded051

Analysis

max time kernel
72s
max time network
73s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.msi
Size

3.9MB
MD5

5628e49ed65da4f44f032d8189b71187
SHA1

88107d305f06a5bc627329d5c0901ec395b1cbb8
SHA256

7a59ec6c3da318c541e0fc5dd03835e7d585368ea0b5dad669a651adc5ded051
SHA512

3267a9ea88aea8d0fd9cd3c1fcbbccc28bf932134f5f55939e45bfc6b9c75d02d48446805dadfa6160bd4b7033995ae3b089fd38f826cf6b98f115be4c11c21d
SSDEEP

49152:gKAzc/f9r84jEHYDgS5u7v/ycFTzn795k0zjjZdlPjgzixI+vGYRnAWNCWw50Qbj:AVHYDgrryclt0iuWYyGI4

Score

6^/10

evasion trojan

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	2872	msiexec.exe
5	2872	msiexec.exe
6	2460	msiexec.exe
14	2620	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MSI23B0.tmp

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI1E57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E87.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D1E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EB7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20BC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI214B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21F7.tmp	msiexec.exe
File created	C:\Windows\Installer\f761ae3.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f761ae3.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2547.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1FE0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI202F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI210B.tmp	msiexec.exe
File created	C:\Windows\Installer\f761ae5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23B0.tmp	msiexec.exe
File created	C:\Windows\Installer\f761ae0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f761ae0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2330.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
2600	MSI23B0.tmp

Loads dropped DLL 11 IoCs

pid	Process
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000f574d6ef483a2c092b90142465238ef6b34061ecae1304719b695c3e9304eb7e000000000e80000000020000200000000cbd58db793ad1148552c75269883cea7a56f6ae6435660960117a609c03c8d590000000544fd6c539d3c77445f88de9fae640fe390dc078c91c91b45a52757059d4b5e9734978b6a84a4580b8c236c02b665b2743bb217e7fcad45079d8e788c3e6240b744fc4b2b6f42da5f690927d55b9a35daaa68c7b251b2d35d5d8e5dc0e284a655b455d91655986e66ff0e195cabb659b7c1a6754aa1ff58ab8dfcfda2d6411370079922f0c6eaf9af342631c1eb8bcf74000000002985828071966979152fe2ace0f3b20df1047f1d7aac4331bb68d788b0105e942f02d6c32dc4739258d95ab106ad2047d8588a85e5e8fb850ff0ecb1639022a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c071d297ed9eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421076461"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2825C51-0AE0-11EF-A965-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000bb9f4a19b7c82e4e4280b2138f3247073762f84430d1042e510e3640c43b5ac6000000000e8000000002000020000000affb6c9b1a105db904af38a462ba7ea65ade860af502a25c890ee90dbfffd15820000000b4afabdef699c2cb510644fcc6d4bebba0ca5af7d27454128dcec2713d3f08a14000000065e2a7e1b02e6d851498edf418bacdfde76e317e304a2c0b5d4eab2756f923fa1e514c599485fc87c34aea1a6967ba720d677c5f44084b1e2813114135a9627a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8AC080072DCA20A47B60923ADC2160B3\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9D7FD07C719F7FA4FAE4F79047425E51	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\PackageCode = "BE5755C97CF78D4439BDC9BEB15E8F3D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\SourceList\PackageName = "setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\ProductName = "Ai"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9D7FD07C719F7FA4FAE4F79047425E51\8AC080072DCA20A47B60923ADC2160B3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8AC080072DCA20A47B60923ADC2160B3	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8AC080072DCA20A47B60923ADC2160B3\InstanceType = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2620	MsiExec.exe
2460	msiexec.exe
2460	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2872	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2872	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeSecurityPrivilege	2460	msiexec.exe
Token: SeCreateTokenPrivilege	2872	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2872	msiexec.exe
Token: SeLockMemoryPrivilege	2872	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2872	msiexec.exe
Token: SeMachineAccountPrivilege	2872	msiexec.exe
Token: SeTcbPrivilege	2872	msiexec.exe
Token: SeSecurityPrivilege	2872	msiexec.exe
Token: SeTakeOwnershipPrivilege	2872	msiexec.exe
Token: SeLoadDriverPrivilege	2872	msiexec.exe
Token: SeSystemProfilePrivilege	2872	msiexec.exe
Token: SeSystemtimePrivilege	2872	msiexec.exe
Token: SeProfSingleProcessPrivilege	2872	msiexec.exe
Token: SeIncBasePriorityPrivilege	2872	msiexec.exe
Token: SeCreatePagefilePrivilege	2872	msiexec.exe
Token: SeCreatePermanentPrivilege	2872	msiexec.exe
Token: SeBackupPrivilege	2872	msiexec.exe
Token: SeRestorePrivilege	2872	msiexec.exe
Token: SeShutdownPrivilege	2872	msiexec.exe
Token: SeDebugPrivilege	2872	msiexec.exe
Token: SeAuditPrivilege	2872	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2872	msiexec.exe
Token: SeChangeNotifyPrivilege	2872	msiexec.exe
Token: SeRemoteShutdownPrivilege	2872	msiexec.exe
Token: SeUndockPrivilege	2872	msiexec.exe
Token: SeSyncAgentPrivilege	2872	msiexec.exe
Token: SeEnableDelegationPrivilege	2872	msiexec.exe
Token: SeManageVolumePrivilege	2872	msiexec.exe
Token: SeImpersonatePrivilege	2872	msiexec.exe
Token: SeCreateGlobalPrivilege	2872	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2872	msiexec.exe
2636	iexplore.exe
2872	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2636	iexplore.exe
2636	iexplore.exe
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2620	2460	msiexec.exe	29
PID 2460 wrote to memory of 2620	2460	msiexec.exe	29
PID 2460 wrote to memory of 2620	2460	msiexec.exe	29
PID 2460 wrote to memory of 2620	2460	msiexec.exe	29
PID 2460 wrote to memory of 2620	2460	msiexec.exe	29
PID 2460 wrote to memory of 2620	2460	msiexec.exe	29
PID 2460 wrote to memory of 2620	2460	msiexec.exe	29
PID 2460 wrote to memory of 2600	2460	msiexec.exe	31
PID 2460 wrote to memory of 2600	2460	msiexec.exe	31
PID 2460 wrote to memory of 2600	2460	msiexec.exe	31
PID 2460 wrote to memory of 2600	2460	msiexec.exe	31
PID 2460 wrote to memory of 2600	2460	msiexec.exe	31
PID 2460 wrote to memory of 2600	2460	msiexec.exe	31
PID 2460 wrote to memory of 2600	2460	msiexec.exe	31
PID 2636 wrote to memory of 2608	2636	iexplore.exe	33
PID 2636 wrote to memory of 2608	2636	iexplore.exe	33
PID 2636 wrote to memory of 2608	2636	iexplore.exe	33
PID 2636 wrote to memory of 2608	2636	iexplore.exe	33

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2872

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C7E1C229C1B7D00EC1ADB2813C03FC86
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Windows\Installer\MSI23B0.tmp
  "C:\Windows\Installer\MSI23B0.tmp" https://telixsearch.com/tyy
  2⤵
  - Checks whether UAC is enabled
  - Executes dropped EXE
  PID:2600

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f761ae4.rbs

Filesize
11KB

MD5
f312af3cd920508db0a0a5a198ef801e

SHA1
9a69a651d09f6c662637c3f5bef567e238594f78

SHA256
53811def8d19ba18717947b655a8cd2be8c453e025fab14ca120f9986a0b7840

SHA512
deb9cd31256761e9fc5430c0578798c0aa0c57129810d8b1270b633a3cb79d8be1b13828710a9d6bf59350977b80d0d9ced38b803d4bc0fb84c91936180563c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\538F535B7FBDE384E456CC9F5DA5FBAB

Filesize
1KB

MD5
6d469ed9256d08235b5e747d1e27dbf2

SHA1
d3dd483e2bbf4c05e8af10f5fa7626cfd3dc3092

SHA256
b676f2eddae8775cd36cb0f63cd1d4603961f49e6265ba013a2f0307b6d0b804

SHA512
04cbf2a5f740d030208136b0ee1db38299943c74efa55045f564268246a929018fcaf26aa02768bb20321aa3f70c4609c163c75a3929ef8da016de000566a74c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c4bfb3c90c8bc8560789771f7c409bfd

SHA1
91e4b991bbff5ee5952ad8f45537791d3a08051a

SHA256
22c7faa63b42c9f18a9cfa7f8dc777fe7caf229d2c687ac97fb363c92f58dcce

SHA512
b5783db0254ace962b6120be3c55eef0ea6ae31da1e63f059cb3016f5720f206c2d7d1c16b4f38babf1a47548888f34bad457d1807b7a322a19bd4c26e965550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\538F535B7FBDE384E456CC9F5DA5FBAB

Filesize
194B

MD5
f37d14578ebe15bd617096bc2c0f21ee

SHA1
6ee9a68972fa87c6d110b7cfed80215405ee5178

SHA256
6039625fd32fb88eb4d9e58aa668f7e45f3489202b3700bf7ee3f693f6a398bf

SHA512
8198296b19c1eb361d56cec66b576f8b001d9f44bb776d805da5b7c17ebe2c3bb46c668fd66a7860eaa9f36caed232d7c22ee91b5a20849f705b5f3af238acb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd3e908b1b279dcf15c5591c093f71ce

SHA1
34c4dc579d26c7dd9c78fecc190d9772a4315d87

SHA256
dcfe2b4040012015d7b2d82139ec67bbb90563ee060c03d610ed7bd1c20c4e04

SHA512
867ce96c9d32d83576b9691aee8ba13c4855b2c57d7a330902aa2a98764c6f54dcf9becc1d9147adcdc0e09607a432da0c1e3acc49b6cb9aec8aa894185690dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ee52f6f90d15f7e4b928c79fb5cfee7

SHA1
f2c18d81167786105ce27c015d2735bc24519827

SHA256
b43b3f8fe2cdc86692821c682f3a9e66d49709fa3f5fefe2dc45a571d2dceaf6

SHA512
2eefec05db07f156345c12b53f7e57d77954d83be9f7a11e8ca2900c590f4b9d522d1edd6dd5a3b13ce9c7f302cc18f82ee2dd8420d42cddc5fb8d66854cd63d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e50e8621e1e1e0261d99cb48b54fc7a

SHA1
2f99deeb89b1d89cf8d4c2282485aac819135547

SHA256
e3bd4d273cd4b9579a11c7177ff5646f1419d8be325d050d6fc7e7b6d1156f85

SHA512
32368625b269a950d756c046dca9836ce43d813d040c29a0b2769594e74d48de900a3ab5f34fee8f7924cd18ee5ff22e8b7583ed2aa84925312ef351f0fcfdfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee681e81f3dd808d249dbde322ca181b

SHA1
a7e99c85dac875a4981e6204dcb11c12e22c167c

SHA256
045dc5fe5d14f94b4681d9f90aa17b36abe115aa60e86b0080328da516908b67

SHA512
481ed884ea7d7c00245f4bbc48b8648d0e499075eec5325c8f1e7a42b9eb31d2d07c76b0fc6304663a2764fc20a937ff773d80a4be3ffca8106d2c5712848fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78f03bdb2101e28391744b6dad2d6680

SHA1
a846f08d825a60b7dd3baf1cd703fea8ee40eab1

SHA256
73c1be355b74471406115552cdb8932b8c95f0e3ac320f8feed06e946e1a9609

SHA512
abcf72e69c8cf91d1bb6bec45b6cd661c360546567bc8b4296ee4380f39049daeae259da2fd8083a30f94a4bc4fb554350065459982417f29fceb9c1dfd9ccaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ccb5fd66bba06824a3c9b935c60fbc3

SHA1
3458b3c90bb6090158791e4c303843ce5046f032

SHA256
98efe8c3e2c3dec5c30802fb40d81c787c2e49a4e93d3a76c4d6fe35594865cf

SHA512
ba255813007b0faf41f2ff8fdddcac1d4fba259e805323741bcd500eb65939a895995e09a789f0a9c356548ce15ec11baf224d6d4c4a5fed6a6a0c194ab43738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c8bbf59d811c4ed15831fb8ac07dad0

SHA1
ab80083ccecde794b781ef7893380ae15e5496e6

SHA256
0dc065a1f7b5c9f4d5486355e7f291f1276126e90d076795806617197e6a3a99

SHA512
3fd58f5bca46a9487ef6d3f119ee09975a174c03dd0055bc71cc4ddbd1a54b6bf6d9ac479dd5ebe40c691d6e28d84a4d7b900424f32461b8d262b445ab2119e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f47a478c9155d139679daf4f4ef1914

SHA1
bf2c835154476d205b907ac97c8d380f1bc767f3

SHA256
81cbf30ab3407b342f0a8016a4373a951990ed5fa1d1d4e0cf1f14ef4bb30241

SHA512
320b7b948aa60a22bb13eb02e2f0de0a2b56b07b4cf673da51ec3f0d36cc506d4929368f8a4459395a7840c9b2a33b4e88c14f3eff8529611b454ac8b763d61a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21f72b73286a96025d88a8a489f8eb97

SHA1
3ac2122cc04713ab60dec2874e1038219ceae068

SHA256
3502e74917159dd9cb1d591d57e4051ff92625fdac3c33b52ae151932c749b4e

SHA512
5f77ae91ec5a9079eb844697b12b6350a73c401ca01dfdd8a51e0cb809825838a1fd5e8afcba0ab3e684350e9af577d09c77010d2b98fde6ac385408203ffd0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68bed927465951f6708d033ab7b4b27b

SHA1
46c6f3a0038a31e2863002277af2b1547049015f

SHA256
61e716b407691f04816f5daaf02f4e88bbaa9ab3db22c369d81108fb5bb21fe6

SHA512
f4335c7154903b3ca5652483114f07d7fb28837629b65226122283fc04721d8803ea2eec2c6fa08b42e210937512ce8103f15dacd21d27c259088601cf0b1d8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dddc238cb5dcebe07448767bb55eb3c

SHA1
684b243e93b775486f6ee77660d06d5fceaee9eb

SHA256
5898f7f12a2708c36da71a3ae60fd394b4123c9e2b2444bb5093c0662acebdc5

SHA512
170501318bd8ec80df13cd93e82b20e6078b41c2c4e8062296e1f12de2910e306a5cf13556060b68990aaedb2cc12ab4591e65bde7373305fca2049f629b15f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
329ac2a4bdfe81eb890507f04330d77a

SHA1
42a36442fa8a798ae9a8cd2b607cddf9be2e370b

SHA256
05e8117e70b196816b7af0b4b781c426c958dcd5a28eac5213ed03c11af11853

SHA512
7724570ec48ba5749bfed5f519654272b1125c591ec126dc0b9551bdde8733dd42fcef88d1b05aab6dbaf9ebe1dce62086fe96ce5bac27f917ae8927a4820a20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28bc9184896d81053d926905ebf365fa

SHA1
3d157fe12caf98b3d976c3cd44a9ffc831de0804

SHA256
371425b6d0bf0b640c8ec4df60f0d319a87a58ac92b0459a9a1700319e64e320

SHA512
142420c2063cfa28786a3541408215692802d06771842f0af0f28b97a245cb70d6ce89fb9fbb0309ed72fc2b318a74b4273cd29977500e8b0f356d905953f854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
aa93751a9f9166d69a118d86e79c23e3

SHA1
ab32fc7d3f5729c8006a41c59845c5ea958acb7c

SHA256
3391e1fed8f93c661af5db4e6613756a7580347d5b79e81220d683251ec183aa

SHA512
c0b738cfdae379c5734c49c13e62855a209087a0bbdded36737a5da6ec569e261465b795e9c31343babf614c8486ed478218e4b42eab8d5574c19eec66cfff56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
15cec13d827fcbd6e87fadd017153422

SHA1
1dcabce2a3b35ebc2261549e7005feb6d0b7e022

SHA256
832d6395c9afb2c2d251eb3ed1a8d649c6c35abd23089e022a28b649448c3cbd

SHA512
4819af43a556b49a3b7e6ef3ccfc842d0d8ac2cc556d4c64704281f9d9d15bf98979e40318795220ccadf274a4420b51692564e069a016964912e9c7fcfbca93

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\65b2e2115bc9fc7472607c90\1.0.0\tracking.ini

Filesize
84B

MD5
c6b8ef3de9f3cd8cacfd60e239e41d66

SHA1
87f34c229481fc4913c3d3f1afd644ba20e40aa8

SHA256
734ffb191cacf61d4dfb481e6378c93dc8b1d383913e0c5a7322b776f4162628

SHA512
00f715a2083b39a004272aa2a87b61893ff750e4ba53270a20af748be57140d40cf34a2451ce18735f77c521ecf808e9b0b65916b61544d2e409d10dd1b37b7f

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\65b2e2115bc9fc7472607c90\1.0.0\{F2F870EE-26D3-423A-8E26-112795B50E32}.session

Filesize
17KB

MD5
c67c30dd879d5c0c81f2209e80f576ff

SHA1
af10bdcfa734101534e43ee013b145dd7bb2257a

SHA256
c59a154ccbc9dcdfb244b8b458742eefd66ecf5aa00c5868b6cb577e78d6fde4

SHA512
5797c21572db08c43c137326915c5a852ddb6009ad4e9bc49748e1c3ff2d6434c5a7227c295a69b99ef51cccc2c3ffbc84c191e1b24e9d1b3a5ebab47f3dc1bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1844.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1902.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A23.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\URL23B6.url

Filesize
53B

MD5
f55413e1ba8c031cc52db905951a37d2

SHA1
62f6ef8f268fd5a7951980e2b20445b6a23b000c

SHA256
a2342cbf200f262c6b3a36da301d8ea540edd9f2627492032501679e54d01c55

SHA512
a18f615f8d2dab277ece0a85826168d8405e18f5f1aed725be77c847fbab9c40faed1cad9fdec8af6288d1fda15e51cb6bc9dd33648714cd51d1023d389757da

Download Submit
C:\Windows\Installer\MSI1D1E.tmp

Filesize
1.1MB

MD5
c6b7f525bebdce408cae137e6c82fa4c

SHA1
6b13d7b7e66c2c32815b98e33c95937f559e2cac

SHA256
e0ea63e00f640c74ddd0b51a46d4d0601acdebdc8b97957fed727f332a96dc90

SHA512
f1e330aad8bc2de79fbe7e7452148714d3f823450c5de039ccbc3690f523c55b240dca4e8d9a9ac83e7afcea6462950b4bc2cbcf52b4c959b9047660a6872a4f

Download Submit
C:\Windows\Installer\MSI1E57.tmp

Filesize
738KB

MD5
8d84543f774c6b280b32b24265e272e8

SHA1
cd3a0dbc06b9b4945f3a5d3b40972a0b5f66044b

SHA256
32b60176177d943df28f931828717f4b52b1434b8c0cd3ca8cc8a424b016b092

SHA512
247c5c3c4765e61b4d4b7514886e9eccb45746593b21a8dc8f718a224a1a0bc813fe227030738c3035cb9a9017ba53d7feff07cccb11407e9b22678af0c42056

Download Submit
C:\Windows\Installer\MSI1EB7.tmp

Filesize
1.1MB

MD5
9ac5da40be505273f6f1b48ce6d159be

SHA1
47d3fbb35dd5df773bb9cb523eaf063c40f52241

SHA256
6547bac5e0f08595325b769a6605a6c27b1eb2620a31dc9ecc4185b64882e837

SHA512
8826dc286b48b4008eff8e38f3ffe4519601f702bd9a6b71731e2ce929789f9ec92f4997fcd28930b91132df5053ffa4f276b5dcb2f8589b93befb805b4bad3b

Download Submit
C:\Windows\Installer\MSI23B0.tmp

Filesize
416KB

MD5
cc7f13bcdea835e2f397cb5339cd6ecd

SHA1
640ffb6817362e7199e3117347e60d85400d6da9

SHA256
b378e304ecb4117c180895ab2fd36dc13daa9ae946393d3c8ae0edb9742a72fb

SHA512
578d50a036c92659d3140ff7a41e2b1387f8202eb3f3eebcb4ecfe032b6b90672f54ea77ca395d675e3eba84b6117154a9146c7fe20e9b80d539638a57a4fe39

Download Submit
memory/2600-345-0x0000000000A30000-0x0000000000A32000-memory.dmp

Filesize
8KB

Download