cfeee34235a2945605a1ac5f98f51863e3d7c641294f0b6df5bd70284f670179

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe
Size

132KB
MD5

0ec6d61b12e3ff3ea863439cb4869887
SHA1

023200ebdf6c6e78b54ae545f5e4e4c7cc803b62
SHA256

cfeee34235a2945605a1ac5f98f51863e3d7c641294f0b6df5bd70284f670179
SHA512

36e677cd83df4b9e7ccf1bd601645c628cccff309bc282bdd0ec20f37bed95bf6f0496652dbaacb1f04f5513d2cc166b042de059b8f0af2c786e5984c1402fac
SSDEEP

768:h/raHM782f9rvs2Zg5nicskQzTGfxgzh3emu4v/eB4z7VP7LdGSu2HyTAzfMgTA1:h/roM7ZJfUQWgY54v

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	msng.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2272	msng.exe

Loads dropped DLL 2 IoCs

pid	Process
1884	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe
1884	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	msng.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	msng.exe
File opened (read-only)	\??\b:	msng.exe
File opened (read-only)	\??\e:	msng.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File opened for modification	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File created	C:\Windows\SysWOW64\rundll32.exe	msng.exe
File created	C:\Windows\SysWOW64\msng.exe	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msng.exe	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rundII32.exe	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rundll32.exe	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{648F52E1-8161-11EF-9F30-7694D31B45CA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000066316e3304c4573b20e9ec55ebf9da82703918ac27e35be23ee2b94e0a63fc92000000000e8000000002000020000000968b8b1a4edeec375bdc29b57185fb34d2c2fa32ce835d2a9138fcfd225777cc9000000030c4dee5ca8da90d479d04de6cb003083e0ef5bfb14c0f39d371892400b5f51e9508581ae50a840574677a5376e2443a0eba79fe9bdafd03d6678a34f3abb53ef8e2665095c619560d67cf0807416fb794154463c63f8b9ee716aa364758ecc104b35276a6bde35b56301b36c372c1f431896b52d50404826179d2f29f706eaba23b855127709c93f781813085353b47400000000486a1dfea82d2512eeaeeba8592003373da3cb75233c913d4e1017a6145df725da2b1b8fb02dad1bd1533a24ea6300a404264abf11faf80716ec741ffc19b37	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434105944"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000062bc907784ede48cc236f3f7b2605b8e6a634fd51a30c3f4495af2f579ede811000000000e8000000002000020000000e44e8a50751bb010e4ea41d0c48a3bf308ec4af6d42359cb972b4657760dc351200000002abda1758b3dd98aa990f937e5bdac04099e1777e9ea18d45db1b4759f3ba9f040000000807a374ebd6f5067993013b5f9163297ff43122ca9cc4bb1f959027a5ec69503a3db84e517c25a7b70e4a5717bd40bfc4c89936f3ee30a444e31c2c4b5e6c925	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5012763f6e15db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = a20031000000000043597d4310203045433644367e3100008a0008000400efbe43597d4343597d432a000000a75d0100000007000000000000000000000000000000300065006300360064003600310062003100320065003300660066003300650061003800360033003400330039006300620034003800360039003800380037005f004a006100660066006100430061006b0065007300310031003800000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c003100000000002359492e100041646d696e00380008000400efbe2359ac292359492e2a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000002359ac29122041707044617461003c0008000400efbe2359ac292359ac292a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a0031000000000043597d43102054656d700000360008000400efbe2359ac2943597d432a000000ff010000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000002359ac291100557365727300600008000400efbeee3a851a2359ac292a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000002359da2a10204c6f63616c00380008000400efbe2359ac292359da2a2a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe
2272	msng.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2272	msng.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1884	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe
2272	msng.exe
2828	iexplore.exe
2828	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3064	1884	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe	30
PID 1884 wrote to memory of 3064	1884	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe	30
PID 1884 wrote to memory of 3064	1884	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe	30
PID 1884 wrote to memory of 3064	1884	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe	30
PID 1884 wrote to memory of 2272	1884	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe	31
PID 1884 wrote to memory of 2272	1884	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe	31
PID 1884 wrote to memory of 2272	1884	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe	31
PID 1884 wrote to memory of 2272	1884	0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe	31
PID 2272 wrote to memory of 2148	2272	msng.exe	33
PID 2272 wrote to memory of 2148	2272	msng.exe	33
PID 2272 wrote to memory of 2148	2272	msng.exe	33
PID 2272 wrote to memory of 2148	2272	msng.exe	33
PID 2960 wrote to memory of 2828	2960	explorer.exe	35
PID 2960 wrote to memory of 2828	2960	explorer.exe	35
PID 2960 wrote to memory of 2828	2960	explorer.exe	35
PID 2828 wrote to memory of 2636	2828	iexplore.exe	36
PID 2828 wrote to memory of 2636	2828	iexplore.exe	36
PID 2828 wrote to memory of 2636	2828	iexplore.exe	36
PID 2828 wrote to memory of 2636	2828	iexplore.exe	36

C:\Users\Admin\AppData\Local\Temp\0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\0ec6d61b12e3ff3ea863439cb4869887_JaffaCakes118
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3064
- C:\Windows\SysWOW64\msng.exe
  "C:\Windows\system32\msng.exe" fuckystart
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe http://www.OpenClose.ir
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2148

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2900

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.openclose.ir/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2828 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99805255f40c42b92e53ab5b2c7d3d0f

SHA1
0b912f2a65b793f0d7fc86e5241f7c6132dee15a

SHA256
6e5532310c036ce84f499747226072546e044f9570d194b6269d5bd71dcfce79

SHA512
93f5e6a32387625bf33ef773db9b33ecec80da447defc3e9f715713c9df8e9b46581eb069e4096e6856519af99d087adcef337014714ffddde6617684b3f3431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85652c0d5393627a2f942545f1d988fb

SHA1
5071a52cd094ff3c9bd2660250c84bc2ad7b1fc6

SHA256
b92b2201c3b67e787878420eb659d45b9b4a711077a852df96d51997d6cd607c

SHA512
fbf348b6ae2883ecd60eabb06e286a1353759df05920a3ec69b675fe9046cf175b86245259f0aea552fcd620c12f34fc36dad913cc092f99f04d889063123ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d44d433474199a129c191845c78e34c6

SHA1
e0b17b30f33b050e475d235a4d635d64be10bbbd

SHA256
e17d72ef0811c051240d5f4b0a88504c81bdd4ac8036c47496888a8c43254378

SHA512
82df3367785b81ef6a9d368ff3bc33ad83d1cca540700ee4c4401517999c98f334cce2611c91bc8a8dc08534a4ab3caf2a7ea5a7ffd1bc8098074bd453d014fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a284742e109e19421d3870db4012b25a

SHA1
87386a045870862cfe49623eea685cbddd0dfc8b

SHA256
c588bc1b67192ca9b435c4ab86f83f2146e99cdcfb8c7f39609b965b2596ab4d

SHA512
24c6210389a33cf383cc5eb9b707db6911a1ac9bbbe65eb0ab1996b455064df4cb21ac7498ee2c5611f4ba7de2dd29a0967c4f8814c72032d080360beafba641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc06a59284ad0c8100c7e557da838928

SHA1
7a1576d20ded2fc71e6334d86b05cb53e66de450

SHA256
0a2bc41e9bdcdeebaa38d9f1054d427860d1ad67fd34e5d11281fedc20cb0dd7

SHA512
76db54ad56bd1c9c3483397ab2cb6188253370275ce713618ef049967ad53dcafd9dd7e3e9b79d414143d113a075fe16ecc1f0538ad6b4d4c9dcbeecc7a59ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9c73d43dbdbaf0dfa67b9075fe6d9bd

SHA1
0ebd12bc190424d8e0ec96123679eb8900f5fed8

SHA256
eee919fc90320664bfdf836e9644dffc8b4fc5e631acef7cefca8b9f15446ff7

SHA512
3bc6252e73c23c9feac7b447f68a709c9b84c19d2c8bfc50639527f18eb258c4e8077b203ce4f31d8dbe8cd2ae241e2a18d2f96a7f27bcab43d22962e1a1103b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5db8ebf234ef264e2ace4b8b06b4a498

SHA1
3ab3714ced89af2f8e8a8e32a3f73caebaff463a

SHA256
d4ed26acef0289ee81257a631fee60d5face8790785778db25fa4782f720be04

SHA512
683dc7188d04b326009a8e719efcb2f632f4ae30fad4ad88b668344f9957e3fc0338cb7d8ef35a175fe3e0f0ed1426d51f6b306fb8b9aeb9bfeb2f7c732ba12c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
393ee73a3a4639ff891c42be2eb7196c

SHA1
560aa004e22360e1dbc5f80925c64738013c47d1

SHA256
bac149bbfb63f8fc21fa0a68116a8a1793bb1e1e6d1586b2639b619de39369de

SHA512
4959506f6ec09954c741ba445d074b463a40d110b527963dbcd36fdd9d0d8abe7c94ad555064bd4ceb3119c4fc232b7b164a40a10347fd3ffbe1ee6010169e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9fc2a16da6d77aa53a072a9ec767914

SHA1
0fdba1af975ba5226b473b2f2f6108fd4679a494

SHA256
3c4f1515b42c15a743060ed753c9dadde66a7f7cddac45ae6a547737b36c8ad3

SHA512
90a4aa7f0699927e782722088193f7f3ae024925ca7f4b4eca2af3fbf5f4bbfaa471cd758936ac7aef6b614a494bc2cff06c6007c67632f51f6c7738d4931d51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83dfd1bb54c91d83d0711564c5fc8212

SHA1
c58ff6e83c7aa782cb64141ccc6f7d9bf0db486e

SHA256
2f9ec7086e6fdefbbd913e8e7452319d41ac44a4c6a8f19c2e91381db879def9

SHA512
f8c9f8fcd5647f84f529f95645e0137ea37091b9ae4b7cdf264dfb15b8418679d5d49fe32c7f41032b073b00f5487d3fe283056f3dc713d84cad054a00fcaa9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9707b4719d37cf95cad5d547c3782016

SHA1
37f2a5cf888c1738f425ea19b1c31df8545e4a08

SHA256
663a0c59457be59dd733e029876145360b9523f9ea54be0d68cc17ad393bd20f

SHA512
3d07dc9cacb8ddc45a9eea1b381ad9125525fe02634561f127ee71282e31a0c9ebff299eb5c65fe7c381f09d154d18851b92674dbc2942b517e421717f4fde23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc063cb73621adbb26dbbf82df9e815a

SHA1
438a2a9810f56bc310ae16d9e876db4803f64bd1

SHA256
a7b91594f763a4945757ad9dc28a6aaf15922caf6dfbd4942fdc0e0086a9bc16

SHA512
0ad48434a5a192bd0657eb484797ccdfd186a8a48a01fe89952d0c7ab32c0b647beccaeefd4c72678e9c8217ce4b9c6722cb2a202f3ff3f0dc8e9cbb85a91be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb3f092c9b0fa88cf64c40ceac8436bf

SHA1
1ca85cde54cb1abf82175127c77dffb1b3674617

SHA256
f1d69e3af78a039392c81f84cf8ce0b7b85d535315e1327cab7baf13c1652c98

SHA512
0f8db10108d46fd08377329b18c3c70c7adb56d451f904cd45edfad7f41271eabe2d36f38e12d2f0e710c774f540e0d2f4f2b3277a164c8f847238847b48a88e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27fc6a9f08005fa0a5efa2679d28090e

SHA1
4b6e9e1398be4e31f4c07ba944644e8a9708197a

SHA256
02215fe7f612564fdee6bedac0f68b2930f939e380b500ede9044871cfd883e9

SHA512
fecc94c81d7d56e4220bfc3d1e3e11fdeb6b8b757b6a379e6576623b02c08b80b0d2f2e0b61bcf801c28843694fd7a9bf5502f558f079e4da3f5f3523f64da65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1211daa51ad5549f07ad24b261f1d3b1

SHA1
1495492e434822a1aca820caf6c2a2d972569106

SHA256
21537c5c6332892b64ce848aa4aff63ef1bf6cb7f09dc62bd4fcf1014ef3579f

SHA512
9f9990161cf4e27c2ae1d27f5606f9813ab1a418482f2e0dc11bafffbf021462d18bef3ef96615fe5a2fa35b03feb58b7327a488cfb3d53d2018a9b2a6368013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5354a46c0ba2d54fd345317f318a8d8

SHA1
d3d46ff197472c7f6dd252fa4dcaba455d9e740c

SHA256
f0555b8e765a23aaabc6691b33fddb16059534463cd7ad53b6ed14377667a85e

SHA512
90e564823762af4a889f4b49ff2ff8551ac6e647e1c2430b901c9d9b9376347ad4f2f3753913f9ebb4963d66addea505db509d3070c4aaa8b8c0364a62eb9a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89cd0169ea22975155389616c7135f0f

SHA1
852d5babf071c9eab10c9b3a40d1479d92600868

SHA256
f788e29b3f7188668b03e1b995d01f634c51b5a6c9b96a4cd17b4f5f3fc4f750

SHA512
c342f8b6f44974eb567c583243ce5ba3da890314531ad9562a1b64be1e8c28720cdb347577106d821c79a76f6c5ee6cab9b51ec91d01d81c8b3ce96e3daff371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb2c85670bb23636c5fd25673649f2a8

SHA1
81904e24b0710e440543e1bc9e877ffb53a48281

SHA256
e6c2206b104f12a236c1aad9b9f3dbef549765c33d4b3ff627fa51d3087116b9

SHA512
f1e066d86f134bf3704f89fb0fd836a23056ec1dd29d30deecaa8bb27b0999abc6fcdc526626a0333d5dbaf296c2d3bdb827ed9c94c1399403d8c976bc3dc94f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41bef58ab40184c932927bb7c08f734b

SHA1
2018d4c017210c0efe354b54c70d50da33c95f83

SHA256
9967b931bf217a7bbdcfbed4f4203ec17b8b976d1e6f0f19cb8f49875e622f66

SHA512
7544c0f36951f9cce24f3aed2de7514c0d8a112841bbb3c0aa4149904b28becdc29393c9ead826626ee1816e02bfd50b4bf4fd3d2879cb80ee5155280ab701e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF03B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF08C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\SysWOW64\msng.exe

Filesize
132KB

MD5
0ec6d61b12e3ff3ea863439cb4869887

SHA1
023200ebdf6c6e78b54ae545f5e4e4c7cc803b62

SHA256
cfeee34235a2945605a1ac5f98f51863e3d7c641294f0b6df5bd70284f670179

SHA512
36e677cd83df4b9e7ccf1bd601645c628cccff309bc282bdd0ec20f37bed95bf6f0496652dbaacb1f04f5513d2cc166b042de059b8f0af2c786e5984c1402fac

Download Submit
C:\Windows\SysWOW64\rundII32.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\~0002ftd.tmp

Filesize
82B

MD5
39039bb0323a784ad9b7322cb592c98c

SHA1
03db8048bf8c077a1121214e46206b1f5b2749e3

SHA256
58d2aad83aedab931f2f717e822c4848690d58a572e810347a9f0b59dd474b9f

SHA512
af458febf106d79a5171230d103b1a67b3e29872bd1ff6006f9aa87565da168b4afc3a6301305adb38c17648f9692c2b79b355841a1cec7d73fbebc5930b99f1

Download Submit
memory/1884-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1884-16-0x0000000003330000-0x00000000033AD000-memory.dmp

Filesize
500KB

Download
memory/1884-19-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1884-15-0x0000000003330000-0x00000000033AD000-memory.dmp

Filesize
500KB

Download
memory/2272-114-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2272-17-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2272-59-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/2900-27-0x0000000003A10000-0x0000000003A20000-memory.dmp

Filesize
64KB

Download