Analysis
-
max time kernel
129s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05-06-2024 17:03
General
-
Target
VirusShare_8ec363843a850f67ebad036bb4d18efd.exe
-
Size
186KB
-
MD5
8ec363843a850f67ebad036bb4d18efd
-
SHA1
ac856eb04ca1665b10bed5a1757f193ff56aca02
-
SHA256
27233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
-
SHA512
800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
SSDEEP
3072:TFFzdn1bwoWwW8BplOd4G5ts0RTy/L1yib5icNisjx3jUiXy:TFFzvwoWw3BXOdl5Ts1yw0s13jU5
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.zmvirj.top/97B6-A7B0-FA94-029E-D3C4
http://cerberhhyed5frqa.qor499.top/97B6-A7B0-FA94-029E-D3C4
http://cerberhhyed5frqa.gkfit9.win/97B6-A7B0-FA94-029E-D3C4
http://cerberhhyed5frqa.305iot.win/97B6-A7B0-FA94-029E-D3C4
http://cerberhhyed5frqa.dkrti5.win/97B6-A7B0-FA94-029E-D3C4
http://cerberhhyed5frqa.onion/97B6-A7B0-FA94-029E-D3C4
Extracted
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 4 IoCs
-
Suspicious use of WriteProcessMemory 58 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{C3E8D47C-9F43-BB75-694C-C844176198A5}\RMActivate_isv.exe"C:\Users\Admin\AppData\Roaming\{C3E8D47C-9F43-BB75-694C-C844176198A5}\RMActivate_isv.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:406530 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "RMActivate_isv.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{C3E8D47C-9F43-BB75-694C-C844176198A5}\RMActivate_isv.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "RMActivate_isv.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {3BD9B5B2-D606-4DB0-8A0F-4EA8C9406861} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{C3E8D47C-9F43-BB75-694C-C844176198A5}\RMActivate_isv.exeC:\Users\Admin\AppData\Roaming\{C3E8D47C-9F43-BB75-694C-C844176198A5}\RMActivate_isv.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Users\Admin\AppData\Roaming\{C3E8D47C-9F43-BB75-694C-C844176198A5}\RMActivate_isv.exeC:\Users\Admin\AppData\Roaming\{C3E8D47C-9F43-BB75-694C-C844176198A5}\RMActivate_isv.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD589272bb583df201b132284be53506fa9
SHA1823ecc3458132fb981db8bf2712c6ce9ff618fad
SHA256b3b25e5754043bf1e8c757ba8ded4e1eafd060ca6d9a59db1238fd0745c8d934
SHA5126670951a3c3ce166cdbf259d6a5ca75a6bfca1d87285549da4b4f8d045ad89ed7e912fcdda323eb824fe16702ffa10b2d4fd03e2c934294944115c36d72b2a32
-
Filesize
10KB
MD5645d6b350e9bcb643cda96b86effedf2
SHA1cc82f30ba336f1d47e02ae9003ad7f59feb695f1
SHA2561b90ef35ebbf4a0fd5495da975fe0c564b7e355e17853d951b43ef28efbacd87
SHA512e62422baa37b6f58c76bf3f84a20f117fb34abcab0a6fddcee3054ddf499183294b6627c29efdf78e5462e2d327894c93cde83c8693953b7d6f0b38c0e531248
-
Filesize
85B
MD5bf7da1aa8466264bca07031edc171e01
SHA115f39e9f701f285c5e6033e8e78d06ffa4a76071
SHA256c9d6b9612db2be306e18cb4a4c3f0da47417403a2593c33f8d27ea27d5d1288c
SHA51226c027705814e3e4a9bb8040f4fb599a10d18204f134f269a6e18f838e107545e84b63870e401d7ede34da4c200b5094ac4fa509e0110cb9ee567635ede1b613
-
Filesize
225B
MD5f6d629f2a4c0815f005230185bd892fe
SHA11572070cf8773883a6fd5f5d1eb51ec724bbf708
SHA256ff1de66f8a5386adc3363ee5e5f5ead298104d47de1db67941dcbfc0c4e7781f
SHA512b63ecf71f48394df16ef117750ed8608cc6fd45a621796478390a5d8e614255d12c96881811de1fd687985839d7401efb89b956bb4ea7c8af00c406d51afbc7c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD59e189816dc90a76c5720af67366fdceb
SHA1079e740397be202f8952cde60bfb6f0b774b41cd
SHA2563d089718ffd5079258971520a10e4acadedb606bd7aef3f54e1d4fcaed143ef3
SHA5125e3ba9ff6ccf4148b17a1500d4d7e5c8503cb9fac07a0ffeb963ea6682dbda4bbf9a898f4c806397d60b536bb7f755c97459b8971f7e9ae9c1e5d28620c060bc
-
Filesize
342B
MD593b40221dd1600deb20a215b5a04c650
SHA15f58cb37bf9daae354ff65c6a9d9aa5556af2340
SHA2567c61758c28bdacdc68740ac91cb4c92971aa582e747baa6fa37d8be1c55eeb11
SHA512787d5adf0b93fd03976bdafe85d6cf31c6b64b6e16db8987ec7993f1ed778baf7356755761b12de8c2982c4e0153114ce20a9b0c532d972e65e565269359254e
-
Filesize
342B
MD595ebf1afc4dc06576d36a2e6888ae4d6
SHA1cac72b9998488471b543abfaa400cf740afa754e
SHA2561b1d2da841890ad065e2267d5a0a161572e941addedf6ac90b5e10ac748b2e9a
SHA512b644be7335ee0708e26274001355a8b34cd202c04c896ba84342bff87b8ef9d8ee0079f5b55d7444e12982bbc1e4f51b9730db4d37539c34d995abfa03578570
-
Filesize
342B
MD5ce8882c772cb2f12ab825120c13bc471
SHA1ded2e509253a299baf380567126e1eb32fe62f25
SHA256a4fbc458c12ce0b113c3cc8fe6c8fa9c5d722eecc3952f4a2147f30667587d81
SHA512ffc6b38426fd2e487899cd621e105ba3184fc163d70ea29f0225e16d68e45b52846226dc0312a3fea7addd96499251eeeda40aa4a005b035a99ccb5196017026
-
Filesize
342B
MD5c769851f8ac7396abb90a6b8e910476b
SHA11885c9776cf2768be63a621070e9dabc9205be00
SHA2565e4199989892360397fe04d9b63c1d59d3d9d0487c1ae65e96d8f6765e792e9c
SHA5125b24dcbdbd8aff5f9fb2602dc876397282a510ef8f5fd7dff70d12fc87006e09d79847d0f5750d8d2eb041da5825cc7b540af54586cf693416ecbe451352d5e6
-
Filesize
342B
MD52ca55bcc5fde64784a80d89256288d59
SHA187b35c914b20f069e14296b845a817b9f50436f1
SHA256adf372b5a5069fb4a51fa6a356250f788c3d827f0ec6d44880921bc11576c4fe
SHA512a35289927b1f9677ac1227e0b5938e22cc38ec23b78919f72a83457b41e1360640bc0f6fcbed9f000a300cbdd748a566d8cddbb7f267fab6bc785482e6b6cf2e
-
Filesize
342B
MD55f3aecfa8520f1010b93a9b471e8b7f2
SHA19918f80625114b7078c87ad5a7e5489438f040a9
SHA256be7e8119e7e5353e58ff386c65a261b46df81229713f0a12ea78104e87dc094a
SHA512e348756adaa7546bc10a79bbd426fd83955bb5c786ede97dfe318a095ff69a561717d3a29e4d60b1427a6693efd445e0f13ca79b39ff3fba2b1dfed86de1cb63
-
Filesize
342B
MD55ca2623bb4fb63b63fd8256805572841
SHA186e63cefa5a9b7bc4117dfc06b178be82c5ceebf
SHA256cd6d709fb33eb88153074aa3beb939f7a55054c6a77fb0a32c0b7df0796253ec
SHA51237fcbcd3f7968e3727e94079d79a554cb97ba4e0feba08cb640a5b3983835f24f9f5585e80504d06003446628c29ff991861ea47bf5a42f6872ab0ea0115e9c4
-
Filesize
342B
MD54c14823bd024694769c5fc083887d42c
SHA1af5b1c51f690ffed881e300e6632129eee5b86e2
SHA25632358846d3a5ab906c24abf8b0a678b2e175eeec80a704fb537ebae20be11add
SHA51291435de78d0d841efc887108cc3fbd47f7a3c9c481a2da696d88f793bc809b6f63994e3e71709eff895f91eef117207d5086316e293c35a569f82a0550057c10
-
Filesize
342B
MD595e8b07c34c4a4074841cd6b8afc7108
SHA134345e1c1cf137d63d4e4d0b2f1ed9cf870b4cd8
SHA25671275b8bc7fb388b12bb3304c76aec40f5e46b97a2009e5a5b30b4798dca1f2b
SHA51299cb5d9a96198c53fb087b8efcbe29d9733298878edbe65fcc98334d3b2bd3878409bc231bfe760c1cca008357a4a3facd696f0dc2ca61f4f3ba3797fe4f9a16
-
Filesize
342B
MD5bdb30bfe1e90e4b3329d62b32c4f3fae
SHA18954cde353420eaae6f8212ad3ad8c63318ad153
SHA2566ea861e2518e4b283272783fdd0b5e8b66ded185d9873e37fbb0dbe01f99c8a1
SHA512c2583cebf56ce250de95c28ea5fd207be420ecc19222fc26ce4f5fd4a8abac2eb9724da9ea6d90f34cbcf7f5847a8230ca38cf9b7b9c6ebba7defe9879fbd2e2
-
Filesize
342B
MD517466cb9916798be419fae945e629bc0
SHA1a5472f5a6e01eb3b9110c3b47028aea4bd5f0334
SHA256cb43bf89d5aedb2c46e831e4b21ea158a6f406cdc31fce20b39c646a83158ba3
SHA5128b8bba46a1af5ea1c5dbdee89dab9b79ab69e79fac3ee0ec934613fc87635e1a1a85333c9c5693e371d4d1561a8d17af1c5ec15f1fd8749f8dbeea0f0cc7cffa
-
Filesize
342B
MD587902c997634f39adbe258aee9500ef3
SHA109cc5ed5fd0e94fcf301a1641f778f3392e4c5d1
SHA256000a4058255bbaa22eeeed93ab183d6d329d62249c3585a0fd9141e3e2bfba9e
SHA5121a966a33eafd87230f5949f9c7cca625d155c795369d1480bf581f96cad5c82a8d93b5a1f2063c1d1ab99623ba5d9675db9601b8208c993c125a0da059e2843a
-
Filesize
342B
MD5b06e7f0712fafd2c1b9fdda288a4ecba
SHA15b22d8cfe3da43768004c1d103ed7f0443c4d719
SHA256ec203b6d2a3266380575eff2f4874a6d3030f020e2acbbf9798e29c0adc1ecf8
SHA512ce7cbc4831a81911fa5287eff14229bd0b4212b757d3c3fb8b2ca7a0c82069457a61a7f1938344fa7409a66a0251023b53bf5210bf21b68a473e5986e26b3244
-
Filesize
342B
MD51c5e11c22be5b6eb6a1b5127f897e734
SHA12949706f9d6858032d1ddf619310f009204ee8c5
SHA25650a3d56f30a0ab407ff0eaf56fa9c352ae4fb7eb70f8f54f5125486c940e43aa
SHA5129c829c0a3ed0d6a54664f169f0aac88f456504dcf1ece3e2da7e3d4916270e59cfeb9b71a04694af55535d5030b8694bfffff67aa25772f8726c5e9f53cc55f5
-
Filesize
342B
MD5c12e38c675a70bb44e6de26e8ac58dfb
SHA11941a859716e0f04e419fff0384cdd8a6e7e1fac
SHA256d0f35bdaffba52bdde164d86b98ce42c29e642b6fb842ca392b9c22df1add103
SHA512f73ef4009bb9b8b091c65c11380a9f372c7775d140dc0341a92386236545cf243b75790b9f4ce1af233fcdcfd232fe49ca017a01118d19a9fec178c190c3620c
-
Filesize
342B
MD5aa9230c12b7b4feb4fe6b6ca8645a0af
SHA10d503392bf708d2f0801e57358fc23acc51ecd2b
SHA256eff73c8f7dc19af96be46f7df355300bd270739533f86c03f00e9bed1b8f63a7
SHA512cc48b86d73e2dcfc77895c7f21553106f839dffbe1dbb51ac697e6c918820a9391d20198b9fbea0ef0cb62fbcf2e89c33d8c3afa4d6a601f0224b6bc3d93f0f8
-
Filesize
342B
MD541f230f943c431e4bc033502cea7eb19
SHA1219749b1414847c5e97317bbce7242b4a3a86980
SHA256c5de9694513f984689ae130b3649d708448a2362e88e194457a4dddefa112d40
SHA5122e5ec1f4e77b463619425c0b6a5b05bc1e411fc33ef7b2370d4210fc60f3ffe9d92d0c5855d21fc15c3b1ed7860f4441f804036bec237235860311c7442006b6
-
Filesize
342B
MD52458418a270c876e69f777c481e3dde6
SHA1238e40667a1ba9219d0e7d917ff816b1b205d00a
SHA256a7cb2d7835a9f117eb9e17b2ba43cd4fc0ed98a78158018bd09a4e3c74839ed7
SHA5129f7f2ced442b710a2ed90e497d3cfdb544d0f61ee57b6bf782b003304edc722a17dff418875d194f324bff9132675033f6f5f4e16b588679a99bc95a0f4c9716
-
Filesize
5KB
MD50b09d31375df00c6339ac0cd2a7f4218
SHA19a474e5afb303fbc135178545db503d68c79f84c
SHA256136e563e539eda439f1fe234bdc61a1db4e234ce907bdaf4fe63e79240d2c294
SHA512c3b53a8e80c8870f32f14032e2827d595ef548327eda90d0dc9f17ce1356167ca657567370fb8557ca3379ba3779d3a53e8e5d271b00dabcabe6c30065a16cfb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD51bd48263c359baf1306bb4a5297519c9
SHA1ac3bf062002a82e9ce95c5e2d9f947e9a4be618b
SHA256d969f46161b796ae02e30c145c722a3bab585ad007f399a5cf9b5f32d10c9a3b
SHA5128b56bf4b4960362c00195a76f08d07d4270d570484bbf68cbc3e92c4a4315e901280fa6f4cf1906f4931881147ed1d2a5f955cf8674fc33745d7d3f572ede551
-
Filesize
186KB
MD58ec363843a850f67ebad036bb4d18efd
SHA1ac856eb04ca1665b10bed5a1757f193ff56aca02
SHA25627233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
SHA512800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
132KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
8KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB