Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2023, 02:29

General

  • Target

    1b41dc25d775ac227ba620e36b6b1883925f7266faa4a064308e93e64398a982.exe

  • Size

    592KB

  • MD5

    e4ea21932060cd0d8e34abbc9a18d721

  • SHA1

    1a144200fee84fe6d00673686abd09d068d0dd5b

  • SHA256

    1b41dc25d775ac227ba620e36b6b1883925f7266faa4a064308e93e64398a982

  • SHA512

    0a34f250472394089e8e706bd4f94dee3702355014c03d60d0c3354ce63cfcbf3a14ae7e96c9ae636cc60de4c419f3c26b20265abe5cea5fbba20d702077cc15

  • SSDEEP

    12288:bMrNy90V4l2xtsdCdHYdPrz+rEs+BHeQEhOR4hhmCe:Sy3jwHYlrnsSnrR42/

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.129:19068

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b41dc25d775ac227ba620e36b6b1883925f7266faa4a064308e93e64398a982.exe
    "C:\Users\Admin\AppData\Local\Temp\1b41dc25d775ac227ba620e36b6b1883925f7266faa4a064308e93e64398a982.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3708
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0963090.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0963090.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0065735.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0065735.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4704
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2710424.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2710424.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1384
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4245423.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4245423.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:752
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6594119.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6594119.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1060
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3852
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:4488
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3548
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:4200
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "lamod.exe" /P "Admin:N"
                6⤵
                  PID:4352
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "lamod.exe" /P "Admin:R" /E
                  6⤵
                    PID:2672
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:492
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\a9e2a16078" /P "Admin:N"
                      6⤵
                        PID:2104
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:4044
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:3940
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9353164.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9353164.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4392
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4812
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 608
                    3⤵
                    • Program crash
                    PID:3784
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4392 -ip 4392
                1⤵
                  PID:3952
                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  1⤵
                  • Executes dropped EXE
                  PID:736
                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3464

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9353164.exe

                  Filesize

                  282KB

                  MD5

                  a0c7f0977155fc618906f30682dd159f

                  SHA1

                  04af6cbff384d1d462191b6223b6b689582cd192

                  SHA256

                  be2471d4dfad7ce201b1fd9fac8cdb8bb7f4f023200641e6a523c7547d5fcfb1

                  SHA512

                  337e53cb2c49c67086bada8c751a8fe911541dbdc2675118397f89f384aa797c39cad3a2f47b8c1a6f25f0a2846946e9a8f6c7cd3e2f492457b0671ea76739f7

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9353164.exe

                  Filesize

                  282KB

                  MD5

                  a0c7f0977155fc618906f30682dd159f

                  SHA1

                  04af6cbff384d1d462191b6223b6b689582cd192

                  SHA256

                  be2471d4dfad7ce201b1fd9fac8cdb8bb7f4f023200641e6a523c7547d5fcfb1

                  SHA512

                  337e53cb2c49c67086bada8c751a8fe911541dbdc2675118397f89f384aa797c39cad3a2f47b8c1a6f25f0a2846946e9a8f6c7cd3e2f492457b0671ea76739f7

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0963090.exe

                  Filesize

                  378KB

                  MD5

                  58888e8e610f43e6411b494b800ba661

                  SHA1

                  5357bf2409b240d5009e64e770f98d9e51404980

                  SHA256

                  099379aaf5e099e84b51aa713ee0e0905fdf242cdbdde21d316544aef71f9beb

                  SHA512

                  103a89499f6b0ed107a5e1611a1fc455e52f9c96fc8ac6ea2c5d8d652a1815303108458605e14f15cee25d93c619369414beccb767c16781ae435c6d2967b416

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0963090.exe

                  Filesize

                  378KB

                  MD5

                  58888e8e610f43e6411b494b800ba661

                  SHA1

                  5357bf2409b240d5009e64e770f98d9e51404980

                  SHA256

                  099379aaf5e099e84b51aa713ee0e0905fdf242cdbdde21d316544aef71f9beb

                  SHA512

                  103a89499f6b0ed107a5e1611a1fc455e52f9c96fc8ac6ea2c5d8d652a1815303108458605e14f15cee25d93c619369414beccb767c16781ae435c6d2967b416

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6594119.exe

                  Filesize

                  207KB

                  MD5

                  27a1df10f8113dfe85b3212be9b26c9b

                  SHA1

                  1a94dc03fc65c232136fa3d0312a16f860c47fd4

                  SHA256

                  1283181d21ec1c6044519c288397e87c67c79477e5e34402c76ce007c347d1ae

                  SHA512

                  c1f571b26cd6d03b2a3ce09ef30a91482f05af8f7b9a86367a4a808ddba0972b3a4158a73206588ee9c0015a629b7cd0caca4f99d4e90a9053b22e1db89e23cf

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6594119.exe

                  Filesize

                  207KB

                  MD5

                  27a1df10f8113dfe85b3212be9b26c9b

                  SHA1

                  1a94dc03fc65c232136fa3d0312a16f860c47fd4

                  SHA256

                  1283181d21ec1c6044519c288397e87c67c79477e5e34402c76ce007c347d1ae

                  SHA512

                  c1f571b26cd6d03b2a3ce09ef30a91482f05af8f7b9a86367a4a808ddba0972b3a4158a73206588ee9c0015a629b7cd0caca4f99d4e90a9053b22e1db89e23cf

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0065735.exe

                  Filesize

                  206KB

                  MD5

                  614c30dcbfbcf54cf004791a30be8756

                  SHA1

                  e7a1ef57a6c575d11680f4739fe383e5f89fc0c1

                  SHA256

                  3832df8b0897c90ec44d81a43a13c8d01af858c3de0b6a994f4439ce7a7c2cec

                  SHA512

                  74e5c839e410603aced46b05ca648db62157bdc34e64c36ab61822585677f5b0baf81147c9e943d7bac157a9c561565ad27573ca7c271be4433d393b92a4de89

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0065735.exe

                  Filesize

                  206KB

                  MD5

                  614c30dcbfbcf54cf004791a30be8756

                  SHA1

                  e7a1ef57a6c575d11680f4739fe383e5f89fc0c1

                  SHA256

                  3832df8b0897c90ec44d81a43a13c8d01af858c3de0b6a994f4439ce7a7c2cec

                  SHA512

                  74e5c839e410603aced46b05ca648db62157bdc34e64c36ab61822585677f5b0baf81147c9e943d7bac157a9c561565ad27573ca7c271be4433d393b92a4de89

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2710424.exe

                  Filesize

                  173KB

                  MD5

                  6d40b1efc19cdb85e246bde8585a2742

                  SHA1

                  ae95e6cf61aeb7c3e7f66911494e11a463f905e8

                  SHA256

                  dc67e17d958b24f02e298676eeefbe7eb2ab9ff4d2c079c9971bd1cc0ca72221

                  SHA512

                  f0dfc27492b6016e71a4253836369d40d42aad276fbe028366645a53fb9a0f08b3b60e98e63d6f560be94c310cf8e37ab4b9a571dc5d02bb28af2c9e73d69ff5

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2710424.exe

                  Filesize

                  173KB

                  MD5

                  6d40b1efc19cdb85e246bde8585a2742

                  SHA1

                  ae95e6cf61aeb7c3e7f66911494e11a463f905e8

                  SHA256

                  dc67e17d958b24f02e298676eeefbe7eb2ab9ff4d2c079c9971bd1cc0ca72221

                  SHA512

                  f0dfc27492b6016e71a4253836369d40d42aad276fbe028366645a53fb9a0f08b3b60e98e63d6f560be94c310cf8e37ab4b9a571dc5d02bb28af2c9e73d69ff5

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4245423.exe

                  Filesize

                  13KB

                  MD5

                  c0ae6ed3558ae844ecad63a2447f967c

                  SHA1

                  c7a800d3fadf11ae2d344e5ed51654d6d85e7307

                  SHA256

                  5fd7a44343dced82ca7ddd6426665e89963cdb17ddfd0922616d088de1e36d75

                  SHA512

                  8313cbde122c51d0ee2cb6eb3c44623fc420394b24298f95451f0b049859417b81ceb7ec67a309b229db7276a1ee64d988dc5091d0f25c0e93ff722c6a914fad

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4245423.exe

                  Filesize

                  13KB

                  MD5

                  c0ae6ed3558ae844ecad63a2447f967c

                  SHA1

                  c7a800d3fadf11ae2d344e5ed51654d6d85e7307

                  SHA256

                  5fd7a44343dced82ca7ddd6426665e89963cdb17ddfd0922616d088de1e36d75

                  SHA512

                  8313cbde122c51d0ee2cb6eb3c44623fc420394b24298f95451f0b049859417b81ceb7ec67a309b229db7276a1ee64d988dc5091d0f25c0e93ff722c6a914fad

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  207KB

                  MD5

                  27a1df10f8113dfe85b3212be9b26c9b

                  SHA1

                  1a94dc03fc65c232136fa3d0312a16f860c47fd4

                  SHA256

                  1283181d21ec1c6044519c288397e87c67c79477e5e34402c76ce007c347d1ae

                  SHA512

                  c1f571b26cd6d03b2a3ce09ef30a91482f05af8f7b9a86367a4a808ddba0972b3a4158a73206588ee9c0015a629b7cd0caca4f99d4e90a9053b22e1db89e23cf

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  207KB

                  MD5

                  27a1df10f8113dfe85b3212be9b26c9b

                  SHA1

                  1a94dc03fc65c232136fa3d0312a16f860c47fd4

                  SHA256

                  1283181d21ec1c6044519c288397e87c67c79477e5e34402c76ce007c347d1ae

                  SHA512

                  c1f571b26cd6d03b2a3ce09ef30a91482f05af8f7b9a86367a4a808ddba0972b3a4158a73206588ee9c0015a629b7cd0caca4f99d4e90a9053b22e1db89e23cf

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  207KB

                  MD5

                  27a1df10f8113dfe85b3212be9b26c9b

                  SHA1

                  1a94dc03fc65c232136fa3d0312a16f860c47fd4

                  SHA256

                  1283181d21ec1c6044519c288397e87c67c79477e5e34402c76ce007c347d1ae

                  SHA512

                  c1f571b26cd6d03b2a3ce09ef30a91482f05af8f7b9a86367a4a808ddba0972b3a4158a73206588ee9c0015a629b7cd0caca4f99d4e90a9053b22e1db89e23cf

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  207KB

                  MD5

                  27a1df10f8113dfe85b3212be9b26c9b

                  SHA1

                  1a94dc03fc65c232136fa3d0312a16f860c47fd4

                  SHA256

                  1283181d21ec1c6044519c288397e87c67c79477e5e34402c76ce007c347d1ae

                  SHA512

                  c1f571b26cd6d03b2a3ce09ef30a91482f05af8f7b9a86367a4a808ddba0972b3a4158a73206588ee9c0015a629b7cd0caca4f99d4e90a9053b22e1db89e23cf

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  207KB

                  MD5

                  27a1df10f8113dfe85b3212be9b26c9b

                  SHA1

                  1a94dc03fc65c232136fa3d0312a16f860c47fd4

                  SHA256

                  1283181d21ec1c6044519c288397e87c67c79477e5e34402c76ce007c347d1ae

                  SHA512

                  c1f571b26cd6d03b2a3ce09ef30a91482f05af8f7b9a86367a4a808ddba0972b3a4158a73206588ee9c0015a629b7cd0caca4f99d4e90a9053b22e1db89e23cf

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  a5ed103ec4719a27ab3d3c01dac66f01

                  SHA1

                  c830d6980d7edea60568a518eccd36c0bc2a4924

                  SHA256

                  dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                  SHA512

                  b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  a5ed103ec4719a27ab3d3c01dac66f01

                  SHA1

                  c830d6980d7edea60568a518eccd36c0bc2a4924

                  SHA256

                  dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                  SHA512

                  b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  a5ed103ec4719a27ab3d3c01dac66f01

                  SHA1

                  c830d6980d7edea60568a518eccd36c0bc2a4924

                  SHA256

                  dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                  SHA512

                  b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                  Filesize

                  162B

                  MD5

                  1b7c22a214949975556626d7217e9a39

                  SHA1

                  d01c97e2944166ed23e47e4a62ff471ab8fa031f

                  SHA256

                  340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                  SHA512

                  ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                • memory/752-172-0x00000000003A0000-0x00000000003AA000-memory.dmp

                  Filesize

                  40KB

                • memory/1384-157-0x000000000A3B0000-0x000000000A3C2000-memory.dmp

                  Filesize

                  72KB

                • memory/1384-161-0x000000000AFA0000-0x000000000B032000-memory.dmp

                  Filesize

                  584KB

                • memory/1384-166-0x000000000C470000-0x000000000C99C000-memory.dmp

                  Filesize

                  5.2MB

                • memory/1384-165-0x000000000BD70000-0x000000000BF32000-memory.dmp

                  Filesize

                  1.8MB

                • memory/1384-164-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

                  Filesize

                  64KB

                • memory/1384-163-0x000000000A910000-0x000000000A976000-memory.dmp

                  Filesize

                  408KB

                • memory/1384-162-0x000000000B5F0000-0x000000000BB94000-memory.dmp

                  Filesize

                  5.6MB

                • memory/1384-167-0x000000000BC30000-0x000000000BC80000-memory.dmp

                  Filesize

                  320KB

                • memory/1384-154-0x0000000000630000-0x0000000000660000-memory.dmp

                  Filesize

                  192KB

                • memory/1384-155-0x000000000A980000-0x000000000AF98000-memory.dmp

                  Filesize

                  6.1MB

                • memory/1384-160-0x000000000A820000-0x000000000A896000-memory.dmp

                  Filesize

                  472KB

                • memory/1384-159-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

                  Filesize

                  64KB

                • memory/1384-158-0x000000000A410000-0x000000000A44C000-memory.dmp

                  Filesize

                  240KB

                • memory/1384-156-0x000000000A470000-0x000000000A57A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/4812-195-0x0000000005540000-0x0000000005550000-memory.dmp

                  Filesize

                  64KB

                • memory/4812-190-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB