metastealer | aa283d1f02c6d3c83dcc1665e9944ed54705e6c46132276c3db208d043e6ca34

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa283d1f02c6d3c83dcc1665e9944ed54705e6c46132276c3db208d043e6ca34.msi
Size

1.9MB
MD5

8b77331198791037f336022ef7e269d2
SHA1

c48ddd7547eec8417b295bcd00cbac3c34bd175b
SHA256

aa283d1f02c6d3c83dcc1665e9944ed54705e6c46132276c3db208d043e6ca34
SHA512

d841c91694094cbb1ea9b6f282748ec994c6bd0af3d037831481b9713c28dd8ae79149b93b7a30d2bcdde7875b42ad102ea81de6f99e6c4dd5f25ae7b5d947e5
SSDEEP

24576:ht9cpVDhXukQS9k2+y4csX3+4OkoorlvRaLicTOUKX:WpRhX5VxP4XO4OKrPaLNazX

Score

10^/10

metastealer discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/3504-198-0x0000000010000000-0x0000000010731000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5148	powershell.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3568	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\Installer\e57b277.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b277.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB342.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0B0E6C8A-C139-47E7-99E1-CFD19140782C}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
3504	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
4648	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4808	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001d4141155d34ac580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001d4141150000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001d414115000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1d414115000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001d41411500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5560	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2184	msiexec.exe
2184	msiexec.exe
4084	msedge.exe
4084	msedge.exe
3132	msedge.exe
3132	msedge.exe
2276	identity_helper.exe
2276	identity_helper.exe
5148	powershell.exe
5148	powershell.exe
5148	powershell.exe
3504	setup.exe
3504	setup.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4808	msiexec.exe
Token: SeSecurityPrivilege	2184	msiexec.exe
Token: SeCreateTokenPrivilege	4808	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4808	msiexec.exe
Token: SeLockMemoryPrivilege	4808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4808	msiexec.exe
Token: SeMachineAccountPrivilege	4808	msiexec.exe
Token: SeTcbPrivilege	4808	msiexec.exe
Token: SeSecurityPrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeLoadDriverPrivilege	4808	msiexec.exe
Token: SeSystemProfilePrivilege	4808	msiexec.exe
Token: SeSystemtimePrivilege	4808	msiexec.exe
Token: SeProfSingleProcessPrivilege	4808	msiexec.exe
Token: SeIncBasePriorityPrivilege	4808	msiexec.exe
Token: SeCreatePagefilePrivilege	4808	msiexec.exe
Token: SeCreatePermanentPrivilege	4808	msiexec.exe
Token: SeBackupPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeShutdownPrivilege	4808	msiexec.exe
Token: SeDebugPrivilege	4808	msiexec.exe
Token: SeAuditPrivilege	4808	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4808	msiexec.exe
Token: SeChangeNotifyPrivilege	4808	msiexec.exe
Token: SeRemoteShutdownPrivilege	4808	msiexec.exe
Token: SeUndockPrivilege	4808	msiexec.exe
Token: SeSyncAgentPrivilege	4808	msiexec.exe
Token: SeEnableDelegationPrivilege	4808	msiexec.exe
Token: SeManageVolumePrivilege	4808	msiexec.exe
Token: SeImpersonatePrivilege	4808	msiexec.exe
Token: SeCreateGlobalPrivilege	4808	msiexec.exe
Token: SeBackupPrivilege	3572	vssvc.exe
Token: SeRestorePrivilege	3572	vssvc.exe
Token: SeAuditPrivilege	3572	vssvc.exe
Token: SeBackupPrivilege	2184	msiexec.exe
Token: SeRestorePrivilege	2184	msiexec.exe
Token: SeRestorePrivilege	2184	msiexec.exe
Token: SeTakeOwnershipPrivilege	2184	msiexec.exe
Token: SeRestorePrivilege	2184	msiexec.exe
Token: SeTakeOwnershipPrivilege	2184	msiexec.exe
Token: SeBackupPrivilege	1896	srtasks.exe
Token: SeRestorePrivilege	1896	srtasks.exe
Token: SeSecurityPrivilege	1896	srtasks.exe
Token: SeTakeOwnershipPrivilege	1896	srtasks.exe
Token: SeBackupPrivilege	1896	srtasks.exe
Token: SeRestorePrivilege	1896	srtasks.exe
Token: SeSecurityPrivilege	1896	srtasks.exe
Token: SeTakeOwnershipPrivilege	1896	srtasks.exe
Token: SeDebugPrivilege	5148	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4808	msiexec.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1896	2184	msiexec.exe	87
PID 2184 wrote to memory of 1896	2184	msiexec.exe	87
PID 2184 wrote to memory of 4648	2184	msiexec.exe	89
PID 2184 wrote to memory of 4648	2184	msiexec.exe	89
PID 2184 wrote to memory of 4648	2184	msiexec.exe	89
PID 4648 wrote to memory of 3568	4648	MsiExec.exe	92
PID 4648 wrote to memory of 3568	4648	MsiExec.exe	92
PID 4648 wrote to memory of 3568	4648	MsiExec.exe	92
PID 4648 wrote to memory of 2936	4648	MsiExec.exe	94
PID 4648 wrote to memory of 2936	4648	MsiExec.exe	94
PID 4648 wrote to memory of 2936	4648	MsiExec.exe	94
PID 4648 wrote to memory of 4000	4648	MsiExec.exe	98
PID 4648 wrote to memory of 4000	4648	MsiExec.exe	98
PID 4648 wrote to memory of 4000	4648	MsiExec.exe	98
PID 4000 wrote to memory of 3132	4000	cmd.exe	100
PID 4000 wrote to memory of 3132	4000	cmd.exe	100
PID 3132 wrote to memory of 1264	3132	msedge.exe	101
PID 3132 wrote to memory of 1264	3132	msedge.exe	101
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4996	3132	msedge.exe	103
PID 3132 wrote to memory of 4084	3132	msedge.exe	104
PID 3132 wrote to memory of 4084	3132	msedge.exe	104
PID 3132 wrote to memory of 4916	3132	msedge.exe	106
PID 3132 wrote to memory of 4916	3132	msedge.exe	106
PID 3132 wrote to memory of 4916	3132	msedge.exe	106
PID 3132 wrote to memory of 4916	3132	msedge.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\aa283d1f02c6d3c83dcc1665e9944ed54705e6c46132276c3db208d043e6ca34.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4808

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 062C0CBD0A5A4FC8F82041B59EBF9812
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-74f71331-879c-4c57-a8ef-78aa1b1cc11a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3568
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffba7a846f8,0x7ffba7a84708,0x7ffba7a84718
        5⤵
        
        PID:1264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,6218938872526916084,7288029946345039094,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
        5⤵
        
        PID:4996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,6218938872526916084,7288029946345039094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,6218938872526916084,7288029946345039094,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
        5⤵
        
        PID:4916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6218938872526916084,7288029946345039094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
        5⤵
        
        PID:2660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6218938872526916084,7288029946345039094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        
        PID:2040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,6218938872526916084,7288029946345039094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
        5⤵
        
        PID:3716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,6218938872526916084,7288029946345039094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6218938872526916084,7288029946345039094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
        5⤵
        
        PID:920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6218938872526916084,7288029946345039094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
        5⤵
        
        PID:2072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6218938872526916084,7288029946345039094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
        5⤵
        
        PID:5296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6218938872526916084,7288029946345039094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
        5⤵
        
        PID:5304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,6218938872526916084,7288029946345039094,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5496 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4704
- - C:\Users\Admin\AppData\Local\Temp\MW-74f71331-879c-4c57-a8ef-78aa1b1cc11a\files\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-74f71331-879c-4c57-a8ef-78aa1b1cc11a\files\setup.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3504
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5148
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:5560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
184B

MD5
0144f813407aa0fe300436850b359a93

SHA1
335b4016acb582f6110429d8742e639a007f61dc

SHA256
50d8020d11f3876e18a3fd05209f5962ed94f352efe00e30aa2e7ebc20424d9b

SHA512
de88771cc91785f7ae776a4e4bbdc2573d9ba209304577eff120521dcc806fdbf86bc33d66cef4c8ed8252e47a3abb65bb9813efe18085be74dce6fa4e7268bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d21c6eb733c62edcf739789be88cc0fd

SHA1
614d994f8691f85665b9252e61ecc197d25c0977

SHA256
38aab8a739495a0f220f9f1b2d878556d1ae28e9925111a2b40d162500d69e0c

SHA512
42e46abc9ac80f538c7712675c8737340c9161a7e92ffc48dec6fabba833b84219dcb0f53d3c96eba38a99a224e23b63a2603e362ca10f0b2a30b95f4c372974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72452e552bb2ebfd5feddf982314c9ee

SHA1
9c1916d111fa4c7d2cef2a96a892e013b5aafca1

SHA256
21dfcbd3649e2b314797dd02ebfe31e18eede70d758a288449c37125a679fbd2

SHA512
c160dae0f3185890f0955991249f144067bd3aab916ca1428c24ef53ecabcd831cda68fde4b3c4d4a21eed6e08d86b20b433b090a6771e7ed08c147480ebcafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eb4b589c-413c-49f2-8c90-bf1d4f222c78.tmp

Filesize
10KB

MD5
e04a6201c24c178a7dc3e599875fd553

SHA1
de6868d0a5c821c4ffdb86f963b172182e55de7d

SHA256
3f7a5295c3fe091d41248d39e292eee4b34686e9d3e1d25be153fa89b08af4d4

SHA512
4f644f3c370db438b683aff3949efededf22016cc90d0b5109fa1e00cbdfaab325f400d34510b1adfc9e9110edc1243488baac8470d040414917d6bfae382b73

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-74f71331-879c-4c57-a8ef-78aa1b1cc11a\files.cab

Filesize
1.6MB

MD5
809337e8fba896e6c6be38773398afd5

SHA1
f1cf29e8175ba87b9b28a02dca9e5fb09f175027

SHA256
6b956a5c80beb1085c7bb11f6386b31b718bbf59c59ee8bd83de2c0febe90aa3

SHA512
4edf0a07ecb49a0af6b06621c06221e2fe5d48808cc305b59d4142c990474543bce0c6fb99677257a3dede9c6edcbaa8e613af31c3ad0cf0c21576a783ee19f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-74f71331-879c-4c57-a8ef-78aa1b1cc11a\msiwrapper.ini

Filesize
380B

MD5
59815394cea2256b4296903c12e8aff4

SHA1
19d9f57703882ef426e9d90f06dcdfb00f9bfc4b

SHA256
15c1463251c0532b9a3b0c387b67c918ee95804949e353bd2e57194d1619ca55

SHA512
0b6865dc9390c76c81cfba9d159c63075c386c26a443b7fcd56086288717579895262bb5fe11269e5c5542039c3777e7b73b004ba72b5f0505a931e6be2641d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-74f71331-879c-4c57-a8ef-78aa1b1cc11a\msiwrapper.ini

Filesize
1KB

MD5
de3bbfdf70c702f44db4cd47596602a6

SHA1
d5cfa74b944bfc3b07b51061e8a265804b9b4cd2

SHA256
a3fc944c4fb3499fd8224985d99c4a92547b053bcea51e2dc5b209c3e34d440b

SHA512
11c7ca4504f2b7ef0d6aadf041fb9e6ea87b7bdfd3384f6e409491d9e84b5249d85f3c568e720b63e8b77e86dceb0fa31d5b326930b02c1bfd7ceea53ca5b56d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-74f71331-879c-4c57-a8ef-78aa1b1cc11a\msiwrapper.ini

Filesize
1KB

MD5
dcffefa53fe746bae61e2c00973442aa

SHA1
ae7a74d13f42251561cea198ad95f42910a013a2

SHA256
e1a4a931829d5f9ad65d39f7b8fef5225a35abfdce15e7e08cbdcce74c9a8a12

SHA512
29bfcc69784f379b1c35eb379198b5b1cdb1a9d24e322772cd97f72eb0ccc189ca8d562364f561404c10696f808af34a51a2b99bf8fd06162f8105b5ce1d3576

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qsfzuirt.y13.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSIB342.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
9a567a95e9fc18db90624d597c4396ab

SHA1
fc4aea31f0dc0a584f7074f47b91b86e025a9b00

SHA256
d552adc79d952e7b8bb12a572001865af041312f367e71f263859cb6171ac4fd

SHA512
f316cce31f0628c42e8e6441c41e6d2b57bd1de76533586dafef8a621fef4a7ed64bb218afe39b71e914fc6dd0b256298af6fc9ffb316773a8aee9fadefb18dd

Download Submit
\??\Volume{1541411d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1c323a81-5560-4a50-9a65-8ebdc4294b45}_OnDiskSnapshotProp

Filesize
6KB

MD5
9e7cb7245acabbecfb2ab46e03618e5f

SHA1
29c0bb80ffd55d6272b35e0b66c44dfb90fcdd73

SHA256
3abd5a45d3f6940bce45d287049613bbda42fa0259af981a2afb744f48572948

SHA512
0f9bf6646dd7a1fbe802782a25fbaa787e0ee4326f4a46bb4ab9b14dcd6757dac364ea43a0afcdb55fe1c494148058c767242213d153343ed577cbc6c3059d21

Download Submit
memory/3504-198-0x0000000010000000-0x0000000010731000-memory.dmp

Filesize
7.2MB

Download
memory/5148-204-0x0000000005220000-0x0000000005848000-memory.dmp

Filesize
6.2MB

Download
memory/5148-233-0x0000000007360000-0x0000000007403000-memory.dmp

Filesize
652KB

Download
memory/5148-206-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Filesize
408KB

Download
memory/5148-207-0x0000000005B30000-0x0000000005B96000-memory.dmp

Filesize
408KB

Download
memory/5148-203-0x0000000002840000-0x0000000002876000-memory.dmp

Filesize
216KB

Download
memory/5148-217-0x0000000005CA0000-0x0000000005FF4000-memory.dmp

Filesize
3.3MB

Download
memory/5148-219-0x0000000006150000-0x000000000616E000-memory.dmp

Filesize
120KB

Download
memory/5148-220-0x00000000061A0000-0x00000000061EC000-memory.dmp

Filesize
304KB

Download
memory/5148-222-0x000000006F180000-0x000000006F1CC000-memory.dmp

Filesize
304KB

Download
memory/5148-221-0x0000000007120000-0x0000000007152000-memory.dmp

Filesize
200KB

Download
memory/5148-232-0x0000000006740000-0x000000000675E000-memory.dmp

Filesize
120KB

Download
memory/5148-205-0x00000000051C0000-0x00000000051E2000-memory.dmp

Filesize
136KB

Download
memory/5148-234-0x0000000007AD0000-0x000000000814A000-memory.dmp

Filesize
6.5MB

Download
memory/5148-235-0x0000000007490000-0x00000000074AA000-memory.dmp

Filesize
104KB

Download
memory/5148-236-0x00000000074F0000-0x00000000074FA000-memory.dmp

Filesize
40KB

Download
memory/5148-237-0x0000000007720000-0x00000000077B6000-memory.dmp

Filesize
600KB

Download
memory/5148-238-0x0000000007690000-0x00000000076A1000-memory.dmp

Filesize
68KB

Download
memory/5148-239-0x00000000076C0000-0x00000000076CE000-memory.dmp

Filesize
56KB

Download
memory/5148-240-0x00000000076D0000-0x00000000076E4000-memory.dmp

Filesize
80KB

Download
memory/5148-241-0x00000000077E0000-0x00000000077FA000-memory.dmp

Filesize
104KB

Download
memory/5148-242-0x0000000007710000-0x0000000007718000-memory.dmp

Filesize
32KB

Download