44caliber | 481e16bd9e829fee9cd41bd992a3287e5882a041b8306029eb7785a66bb4a1ac

Analysis

max time kernel
30s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2025, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

proga.exe
Size

1.8MB
MD5

37d52955fa43a9b6914f81fac04f0656
SHA1

ef005ff7f596ea057022a77f111847ac8b3fb66f
SHA256

481e16bd9e829fee9cd41bd992a3287e5882a041b8306029eb7785a66bb4a1ac
SHA512

9126bcda7b7ac8b3bc0b9a31981150f8fe59bca93f17b6322d04033ff6567df47d18e2833072c06235502e8a9bf5324967d31bbfd765805dfbc083aeb0d91c24
SSDEEP

49152:1Djlabwz9DmRaIKolB7bLpEBm9ggukQ2XC+N7:ZqwRmaQ5k0ukHS+x

Score

10^/10

44caliber discovery spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1356567873270710473/EBvbgkUkr1Nt60uLTvIefHjN4cRMKBHO54aiDqafnZD_q5UFbEfTFkzb_pq5tMMbgSTy

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
44Caliber family
44caliber

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	proga.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	EasyRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	indious.exe

Executes dropped EXE 4 IoCs

pid	Process
712	EasyRAT.exe
4476	indious.exe
5300	WindowsFormsApp2.exe
4444	Insidious.exe

Loads dropped DLL 2 IoCs

pid	Process
5300	WindowsFormsApp2.exe
5300	WindowsFormsApp2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	freegeoip.app
4	freegeoip.app

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\winrаr\EasyRAT.exe	proga.exe
File created	C:\Program Files\EasyRAT\Insidious.exe	indious.exe
File created	C:\Program Files\msedge_url_fetcher_6064_401303395\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\bg\messages.json	msedge.exe
File opened for modification	C:\Program Files\winrаr	proga.exe
File created	C:\Program Files\EasyRAT\WindowsFormsApp2.pdb	EasyRAT.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\gu\messages.json	msedge.exe
File opened for modification	C:\Program Files\EasyRAT	EasyRAT.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\EasyRAT\Guna.UI2.dll	EasyRAT.exe
File created	C:\Program Files\EasyRAT\WindowsFormsApp2.exe.config	EasyRAT.exe
File created	C:\Program Files\EasyRAT\WindowsFormsApp2.exe	EasyRAT.exe
File opened for modification	C:\Program Files\EasyRAT\WindowsFormsApp2.exe	EasyRAT.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\EasyRAT\Insidious.exe.config	indious.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\128.png	msedge.exe
File created	C:\Program Files\EasyRAT\__tmp_rar_sfx_access_check_240611781	EasyRAT.exe
File opened for modification	C:\Program Files\EasyRAT\Insidious.exe	indious.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\winrаr\__tmp_rar_sfx_access_check_240611296	proga.exe
File created	C:\Program Files\winrаr\EasyRAT.exe	proga.exe
File opened for modification	C:\Program Files\EasyRAT\Insidious.exe.config	indious.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\az\messages.json	msedge.exe
File opened for modification	C:\Program Files\EasyRAT\WindowsFormsApp2.pdb	EasyRAT.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\de\messages.json	msedge.exe
File opened for modification	C:\Program Files\winrаr\indious.exe	proga.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6064_1369765696\_locales\zh_TW\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsFormsApp2.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Insidious.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Insidious.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	WindowsFormsApp2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	WindowsFormsApp2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	WindowsFormsApp2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133885273356812601"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3975168204-1612096350-4002976354-1000\{C5AFBDF4-0C7E-4204-8B1B-4AD6B0350AB2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4444	Insidious.exe
4444	Insidious.exe
4444	Insidious.exe
4444	Insidious.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	Insidious.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 712	2452	proga.exe	86
PID 2452 wrote to memory of 712	2452	proga.exe	86
PID 2452 wrote to memory of 4476	2452	proga.exe	88
PID 2452 wrote to memory of 4476	2452	proga.exe	88
PID 712 wrote to memory of 5300	712	EasyRAT.exe	89
PID 712 wrote to memory of 5300	712	EasyRAT.exe	89
PID 712 wrote to memory of 5300	712	EasyRAT.exe	89
PID 4476 wrote to memory of 4444	4476	indious.exe	90
PID 4476 wrote to memory of 4444	4476	indious.exe	90
PID 5300 wrote to memory of 6064	5300	WindowsFormsApp2.exe	96
PID 5300 wrote to memory of 6064	5300	WindowsFormsApp2.exe	96
PID 5300 wrote to memory of 5340	5300	WindowsFormsApp2.exe	97
PID 5300 wrote to memory of 5340	5300	WindowsFormsApp2.exe	97
PID 6064 wrote to memory of 452	6064	msedge.exe	98
PID 6064 wrote to memory of 452	6064	msedge.exe	98
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 5604	6064	msedge.exe	99
PID 6064 wrote to memory of 5604	6064	msedge.exe	99
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100
PID 6064 wrote to memory of 6112	6064	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\proga.exe
"C:\Users\Admin\AppData\Local\Temp\proga.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files\winrаr\EasyRAT.exe
  "C:\Program Files\winrаr\EasyRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:712
- - C:\Program Files\EasyRAT\WindowsFormsApp2.exe
    "C:\Program Files\EasyRAT\WindowsFormsApp2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/easyratnik
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2e0,0x7fffa946f208,0x7fffa946f214,0x7fffa946f220
        5⤵
        
        PID:452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1876,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
        5⤵
        
        PID:5604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2204,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
        5⤵
        
        PID:6112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2536,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
        5⤵
        
        PID:3988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3500,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
        5⤵
        
        PID:5728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3524,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
        5⤵
        
        PID:6124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4376,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
        5⤵
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5184,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
        5⤵
        
        PID:5752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5344,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
        5⤵
        
        PID:4436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5088,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
        5⤵
        
        PID:4648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4972,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
        5⤵
        
        PID:3788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5580,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
        5⤵
        
        PID:4920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5592,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
        5⤵
        
        PID:1400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5592,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
        5⤵
        
        PID:1184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6236,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
        5⤵
        
        PID:5976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6248,i,8319692487592529466,2572076024046749601,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
        5⤵
        
        PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/easyratnik
      4⤵
      PID:5340
- C:\Program Files\winrаr\indious.exe
  "C:\Program Files\winrаr\indious.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Program Files\EasyRAT\Insidious.exe
    "C:\Program Files\EasyRAT\Insidious.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\EasyRAT\Guna.UI2.dll

Filesize
2.1MB

MD5
58459aefb74d5ff786b9efb982d44eab

SHA1
584f851c9824a27f4e2e5594ac206f8b165adf72

SHA256
6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030

SHA512
80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55

Download Submit
C:\Program Files\EasyRAT\Insidious.exe

Filesize
274KB

MD5
69e87bcc519628a0910e0bbf2559baaa

SHA1
696acb30b321eb09e50b07144bfce51b290de285

SHA256
054bcd6fa76fae3606818abee25d9cceaaffc130cdf69db1e3dceb98ebc2cef5

SHA512
728c1661b9e52853ac3d3dfc0471d5a5e7ef7430d886965e439406b6010dc9393bbbf7ffc3ccf0a162398c74f72ae0b1ffe12383f4fa740b73f1e5976f1c4869

Download Submit
C:\Program Files\EasyRAT\Insidious.exe.config

Filesize
161B

MD5
c16b0746faa39818049fe38709a82c62

SHA1
3fa322fe6ed724b1bc4fd52795428a36b7b8c131

SHA256
d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad

SHA512
cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c

Download Submit
C:\Program Files\EasyRAT\Insidious.pdb

Filesize
865KB

MD5
3908ad15e3ec252640e1412fd49df07a

SHA1
bf9b1a6492c1f876249db4a01d2bdf3921913eda

SHA256
71ae41f12b290a13654adb0dfea576e10cf6e674f9caa657dec1eaabf8167b94

SHA512
e443bbd11dc25ad24a379ea8fc5dc6ce08671b1d6a148dcf50de128fcfb90b243e990cb30fa4b39b71b8e766b3b8d037b1d2eb0f8af67c82ab00965cf75ce85c

Download Submit
C:\Program Files\EasyRAT\WindowsFormsApp2.exe

Filesize
12KB

MD5
9a4014eeefa35b270e32f100cfef092c

SHA1
5c49ce183a66fd16bfaa6651482abb70f620718a

SHA256
0f332f3e60d6741579bf027f09db5de7a0bf2c28e2a265f19aaa4bc2df2fe5fe

SHA512
c1c7a1d475c3838477b6ab338424a73e4a45b017f0dfbdefc91776c086f6cc2f489eeba1873e0e7cb9698b201fbc076464d75e08503863a9db44b8ce5c4482e1

Download Submit
C:\Program Files\EasyRAT\WindowsFormsApp2.exe.config

Filesize
189B

MD5
9dbad5517b46f41dbb0d8780b20ab87e

SHA1
ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

SHA256
47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

SHA512
43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

Download Submit
C:\Program Files\winrаr\EasyRAT.exe

Filesize
1.1MB

MD5
bb06d54db319bb59e11dc1be1823b4ee

SHA1
08e91ab25a204b567550a32df951388a1fbd922b

SHA256
ec27b2fa0be2d5856c8a5b1fcf216f5d5a17db8a1b0d82d850407b4d335816a6

SHA512
fab177483bc9275701cde2027a5e34ed5e7d67d606b4a6d345af6e9b5e5965acc7d2637bd4186e49e8d085be1fb2c979cf9229d7d325f2cc2100459a3b0902b2

Download Submit
C:\Program Files\winrаr\indious.exe

Filesize
683KB

MD5
649c2c983c8ec28dae7fe6b304e641dc

SHA1
e8baf34d897d268f7aeadb27dc174a5c54ccecc9

SHA256
c971ef15af9dd0da7d4abbbc8c89f4964d1ca02fb8b611618c846f3e47965059

SHA512
73b61e12d5f7263fb089f9b4e3326c8277c5d3ee6ec63fd44cfb0bf6a92b2706d696029633cac3980edf34f1a8ce13fa768dda6f76a92efba4e1beb751b34bd8

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
1KB

MD5
2e35c2c351531fcb94dd9754beb013ab

SHA1
98a1239c62c0b50f814c903ab344c5f95fcf62b7

SHA256
f91dff04ca54acb3857dae60d1ebcca9de82890ebd443785c17bf9c549ff02a7

SHA512
9c885f45022fdf85094dd121d2e11a9fed7b79529a782d5d5046e5cf9a2a547fe019a2293d2dff0b37b6128741aee969d3069e3a14541235b17295c6d08a75d6

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
737B

MD5
98dc9b768c2504107cf879969e2b066c

SHA1
c13d0b2b15e152126905d2940c6a7919d3c0fe5d

SHA256
fa0520260e16dba2d5e20a1b2d6be7f01460cacff304d5927f2373d6522f54e3

SHA512
9881b73ff709ddcc6dcbf0530ebd2ca9152465857cb6ce24ea87bdb9562068357af1135aa834191ac5d5a34279bc6034fc7cd4fe3b447adfcd04f367f1fbc509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
65044109d1beb8ed8d59560642cbc519

SHA1
0084485b0aa26069232fab51ee603682e8edfd17

SHA256
a1e0b448218678b30356cbbe4092ea091435e7450822a9748361b6e8b198962d

SHA512
96dcc68fe92f98c4329a8335cfffdb0849a52562431045ccc42076bda0abf3842491303fb669246bfd04e64113688d3f90000a09571dd76ff84b52e34e45f9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3648321b642e8b430786e4b2dad939d8

SHA1
a7446552dc4926a812824fce6637951ae34ce730

SHA256
e0460e88d5c3dcc9b612135fdf20e3e0ec841fd4286af7a653ed2a3980e74de4

SHA512
c97035a7c74669eb1e6279ec2102fcbfdf4c4bfaac5b637f9689558281eb7ab466788dce0cbb4b7d7044111a8cfbee95cbc471413c87d9fb4a3ed8f921664e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e1f4.TMP

Filesize
3KB

MD5
b249317737ece68d013d96c8eada6e79

SHA1
1146bd1aa147583df8c274b4f93b20f181be1310

SHA256
6e05d0db47b525f0e83933180b21bc8844739d52246c6cd2c16cf9a8a6b864a3

SHA512
4c89e230597e6b845c70aaa06038c6f7473fc04bf0b3c15f1fe961ae67529d7a17e6edadbf160f19736abf20f65a16985ac95382abf7fcf133b86e25441b2613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
b4f5c18095b2760ef1e2583ae02e70c7

SHA1
8dde37a4b6d6cc61f522b2a43b4b3f94048f5106

SHA256
9ebf03f49bfa95780bd7ca5435b010e55cd0b6e32eed5f136bc9411499f7c399

SHA512
1d0068f35fd86712832bbd79dd9b745c90a3c3bb3ff773862ef022def1570f145bb233cb42e08a075ef5dbcc5fe3aa5337939d762031827fa1c73bb054b38566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
44a3ea5cb79dd539bcda9e5262e0000c

SHA1
b7a1434500ae7141bcf7998d506d8f54c848c2ce

SHA256
66335c777eeca3001b452d3046c6a57645cd0c185bd2eb113627951c050a5211

SHA512
5cc135f8c23f5bf5759cd118045759c603dbea7ddea3c4864f7ed2ba96a87d4e8e764ddae66623c7e760d5da3628ae749918b998e1c0b735d080e4b650d4fb1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
f68fae4db8ae6356313e1d48026d5b46

SHA1
992bc78905bd4a18e33fe4280ea60ad83d4704d3

SHA256
1e02a46495442715c55873bb859db4b90bf0afd4c9c7361940a5cf10926140c8

SHA512
68727e33842613c00ea30fbf0b1dc89c16fc6827c2c386cc044950ccdd1cd5f2f8c737de4b685723058affa16296af969678736d3f09f5e4d599bf1cceca5b90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
e379d57770bb827beb12281c1e62640a

SHA1
49bf3dbd7e76ae3ffd246b4aeb4a2a5f7f455961

SHA256
4a6d31fe44e0d316947ed639351057ab1cae2332b4fd32388824603c3ee9a31f

SHA512
cb21b2b95cff1d028b740706dc60c780caaf4fefeaeec1954d21f84958f68645c4b3a04a7d9861d49a9891b09f32c57f25be8748d4bce67bd5c0cc17d101e3ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
62def21af7f478e268d8a687a561aa82

SHA1
32f34dcb39ed7ec88d32b26c35c89b8c0720a87a

SHA256
f539ea06d6d4c6dabbe1346cd9238d894e074f96842b3c6a3687451b4c79166d

SHA512
73c779dddb4299f4b57aa01db9eb9d91d1f991508798e44f2c2a6b822eeea1d5c02c8b68371d7b9bb2cfd9fdd5f348657e28504894ad18d4911a0a681301b567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
1c62a3f47d59fd13831c466ea340793a

SHA1
5a25401b1d0ad5cc3c570ac06d3b7b955de61e8a

SHA256
feeef4e3377d16a0b4d65479c52dd249a8895dd4725c55b660e0ea6540b9a22d

SHA512
321fb435af6f3fac54ddd6d7e788c33a6b326ade167dd934b0dd612e9b8e88f0ae64901cc2630ee685a3c42fdee2c2f2518ece916ac61703d28a72c4945b19f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
44b3c6c4bd62bb8284567fb8ea66d995

SHA1
41fb6c3e312ed0a9cdfe5d1756287bc6e621cebf

SHA256
52449e9fcb9f2c9e825d2e70d97f70d6aac72f7d89da79343ad68f95d3608086

SHA512
b9bc3a72d2fe7ecc52621ba1b9b02b4e4e74886c697cc305986f29df54f39b1741e1f42b0a4ab05b14c50591c72f63302b3697b53761cb2ba87fd6fdb2c2b279

Download Submit
memory/4444-182-0x000001C6F7E60000-0x000001C6F8009000-memory.dmp

Filesize
1.7MB

Download
memory/4444-54-0x000001C6DD5A0000-0x000001C6DD5EA000-memory.dmp

Filesize
296KB

Download
memory/5300-179-0x0000000006580000-0x000000000679C000-memory.dmp

Filesize
2.1MB

Download
memory/5300-131-0x00000000058B0000-0x00000000058BA000-memory.dmp

Filesize
40KB

Download
memory/5300-84-0x00000000058D0000-0x0000000005962000-memory.dmp

Filesize
584KB

Download
memory/5300-83-0x0000000005FD0000-0x0000000006574000-memory.dmp

Filesize
5.6MB

Download
memory/5300-82-0x0000000000EF0000-0x0000000000EFA000-memory.dmp

Filesize
40KB

Download