Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    71s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2024, 10:08

General

  • Target

    0a238d4825cbf981766421b6c13786b4_JaffaCakes118.exe

  • Size

    276KB

  • MD5

    0a238d4825cbf981766421b6c13786b4

  • SHA1

    e8869b02df3858e485f5f104fdc45d6644911900

  • SHA256

    622f79330bda2080671671ffcdcef09069c31093dbb9c0721329230fe11645c2

  • SHA512

    a6e63446cc7dcafe2436cb60f7a73743304a058aa164eb8793c75135e061d95cbf5ac6ddb6ac09f1c6cefd148f0c5d933c162bd7bbb05dc4b617840a88fe4e86

  • SSDEEP

    6144:8TPCUHeUYr5kj1OdOKRU64X9bGB7UqFoCevShTJVa0n/4:8OUZYr2jMoaUtXQBgCo3uJV7n/

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a238d4825cbf981766421b6c13786b4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0a238d4825cbf981766421b6c13786b4_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1904
    • C:\Users\Admin\AppData\Local\Temp\0a238d4825cbf981766421b6c13786b4_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\0a238d4825cbf981766421b6c13786b4_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\3FCD4\7AED3.exe%C:\Users\Admin\AppData\Roaming\3FCD4
      2⤵
        PID:4360
      • C:\Users\Admin\AppData\Local\Temp\0a238d4825cbf981766421b6c13786b4_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\0a238d4825cbf981766421b6c13786b4_JaffaCakes118.exe startC:\Program Files (x86)\D4B56\lvvm.exe%C:\Program Files (x86)\D4B56
        2⤵
          PID:2140
        • C:\Program Files (x86)\LP\D3A3\11CE.tmp
          "C:\Program Files (x86)\LP\D3A3\11CE.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4176
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2204
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:668
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2972
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2780
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4928
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4616
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4740
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2344
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:3664
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2744
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3564
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3760
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1392
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4468
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1536
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3156
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4084
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:5044
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2972
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4644
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4636
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4312
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3952
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3064
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3352
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5028
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        PID:2700
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3364
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:4888
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:736
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:4256
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:1416
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:3632
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:2628
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:3684
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:4116
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:2196
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:3536
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4840
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:1120
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:2468
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:760
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:3556
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:5004
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:4560
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:1536
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:4956
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:1392
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:3620
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:3952
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:5000
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:2700
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:3588
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3084
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:748
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:2408
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:628
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:2740
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:2780
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4576
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:1376
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:2072
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4360
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:4912
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:640
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:4272
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:1392
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:2832
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:1964
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:1916
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:3192
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3236
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:184
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:4244

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Program Files (x86)\LP\D3A3\11CE.tmp

                                                                                                      Filesize

                                                                                                      104KB

                                                                                                      MD5

                                                                                                      296365f98338c7267752451423e72be1

                                                                                                      SHA1

                                                                                                      951728a38cf1824967b036cfa2ea701912541e61

                                                                                                      SHA256

                                                                                                      12ea8a3c0368375a8690de8439051576677a4b818f5599b57eb00264882a8bb0

                                                                                                      SHA512

                                                                                                      83e37ecaee17f464f89b0c1437660b7856fc4bd35f28e355d6edd7b3424d2f8f95f6f3b9f7871f631051ed013cf35c544748b2d6c083c07ac095945cad4fe15c

                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                      Filesize

                                                                                                      471B

                                                                                                      MD5

                                                                                                      00cd62d1c71f7cebc93821164f916e82

                                                                                                      SHA1

                                                                                                      c6ef1580c902900947355be0fc19d24a1d9647da

                                                                                                      SHA256

                                                                                                      b320f01682d14a9614da0691aee664c132abedf6e666189b3e53ca58e2247afb

                                                                                                      SHA512

                                                                                                      80a0135269b76328d95257502b2524867a0f302e961560b164d8cacab397af248d772508050f80de4c99787abf4fa4838015e0d486adbfbe8171aae4d37b61bd

                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                      Filesize

                                                                                                      420B

                                                                                                      MD5

                                                                                                      b789a58a192ce476b67e4c2c54812f05

                                                                                                      SHA1

                                                                                                      a967e751c7dd4173f34e95122db28976ba8ea04e

                                                                                                      SHA256

                                                                                                      ab0c657cfe48800a0ebf6fab1213899b63277c460793a7b38081ba5f732437fa

                                                                                                      SHA512

                                                                                                      eedc49924ab614e0897651c23219ce611aa4b394153894898aa01140cd35ad100a20db5b83c7a8634724d4cd96904453138aecec1fe81c9613d9bd26c660ebae

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      f31b95e19f451e8865639c991c40bc5d

                                                                                                      SHA1

                                                                                                      908dfed87a0a5c078eaf17ab2cfab4d409a1f5d5

                                                                                                      SHA256

                                                                                                      1363a0197e24aad78e451cc4c4bcdd5014a5f2806ec91dd95cef62f733385cb8

                                                                                                      SHA512

                                                                                                      6138d9bad8f63ed020e05520cc6d1b7ca85ccde954eeae1877b9cb9fca422dc83039c8d95bd8e6f2dfdd0ddba71a8844113706ecdcac9e652b17e53dbef5f079

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VJ9UXBET\microsoft.windows[1].xml

                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      d28bf9e615b97abc4f63418e57cc40bc

                                                                                                      SHA1

                                                                                                      65885f634c0b15cabd1caf45861e7767f3110e44

                                                                                                      SHA256

                                                                                                      92e5c802db2c618a0c0aec072bec43479f082c95f35157b117749fee0ec295f7

                                                                                                      SHA512

                                                                                                      23e0b838c4a4a91b117fa0292e0350d691aa78eda49299819aa684efd6c6ec03b73a7d231996cf4d7e6cd10311a4755b5a434cae732c6376276290cb52f12eb0

                                                                                                    • C:\Users\Admin\AppData\Roaming\3FCD4\4B56.FCD

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      581f2ec3604c49ab606caecd6e0dca50

                                                                                                      SHA1

                                                                                                      f4c8354ae397fbc1d3d33f7c5f603d56c113aba3

                                                                                                      SHA256

                                                                                                      66eb890a2627153813ae22ce9b36253213f6084a44300caf58d15337b017d367

                                                                                                      SHA512

                                                                                                      466dd6b251df8d6e048dfa7bceec0ba8df5b7739764b0532b766bd85eb9160f719cb8117effd7a77720aecf90b1d0b167949e0845da44554de30e03a2dcc4ca6

                                                                                                    • C:\Users\Admin\AppData\Roaming\3FCD4\4B56.FCD

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      8c8400276071bdd6faf649cbd5193f64

                                                                                                      SHA1

                                                                                                      be57c1ab4655a1a9193d1b19e0f4c130c26d5e81

                                                                                                      SHA256

                                                                                                      11918e0141a8ea8be7a893ce7365f4c50069228cdbe4ddfdaddb7edff72334e4

                                                                                                      SHA512

                                                                                                      65b9ce53a3e8d26d1ab5c76bdf25a9edfc3cf1ca42df60c446e908689151080767dcb6159425790f25e798ac664a099a90338d6e23a8c9ce6f505d304ceae679

                                                                                                    • C:\Users\Admin\AppData\Roaming\3FCD4\4B56.FCD

                                                                                                      Filesize

                                                                                                      597B

                                                                                                      MD5

                                                                                                      24dc82d8973e8767d1126710cde840ae

                                                                                                      SHA1

                                                                                                      cbda6f0f5c20f0e83b023a87eed8f5eab2740c9d

                                                                                                      SHA256

                                                                                                      773f33540b45c5eebec6e1458edd578e7813c13029ae22dd7005dfcc660f4804

                                                                                                      SHA512

                                                                                                      7d56522ede2b38f82a4ee2ef8293f9d1de51a3b719536ef88d2a553c5c79681c00ee54b32d71726ae16d0216da704aa65b0b5ed51280f89d134c779e5f96a636

                                                                                                    • C:\Users\Admin\AppData\Roaming\3FCD4\4B56.FCD

                                                                                                      Filesize

                                                                                                      897B

                                                                                                      MD5

                                                                                                      f8cc197cf6bf0b026d2996a4b41582dc

                                                                                                      SHA1

                                                                                                      b8376e9d3b715b2bd179fe8916af7486f31ee367

                                                                                                      SHA256

                                                                                                      d6bec7a156af050d5ad561650748784340958f799ab4f97cdc9764aa67fe8d26

                                                                                                      SHA512

                                                                                                      485d5b5136a851c83c98b8ca75cc90ed34692103792704e52120f1aae64bdaf33729084bf382ef4cdba212f551f528cfd22b3fcc44f17e16c5dc25d6ddb26b95

                                                                                                    • C:\Users\Admin\AppData\Roaming\3FCD4\4B56.FCD

                                                                                                      Filesize

                                                                                                      297B

                                                                                                      MD5

                                                                                                      943dc94d01a1fa603fe0bbd16ff62fb9

                                                                                                      SHA1

                                                                                                      a3a5c5855ed9422406f9b103e4be50b78afef7b6

                                                                                                      SHA256

                                                                                                      a79c876d36bf93a43a6860a968e01ae576bc54e35299ab9debfbac715788bdd2

                                                                                                      SHA512

                                                                                                      3adb6ac574a1deb844c3d4402fe9980c1c9909a6ac70aabd211cceb30fb340bf5a4506559787baf5f74609d731b447331f41724121e664b3dd90eeae765ae9c6

                                                                                                    • memory/736-1409-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1416-1417-0x00000204FEC90000-0x00000204FECB0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/1416-1442-0x00000204FF260000-0x00000204FF280000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/1416-1430-0x00000204FEC50000-0x00000204FEC70000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/1536-677-0x00000000040E0000-0x00000000040E1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1904-127-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                      Filesize

                                                                                                      420KB

                                                                                                    • memory/1904-1265-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                      Filesize

                                                                                                      420KB

                                                                                                    • memory/1904-1-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                                      Filesize

                                                                                                      408KB

                                                                                                    • memory/1904-207-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                      Filesize

                                                                                                      420KB

                                                                                                    • memory/1904-56-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                      Filesize

                                                                                                      420KB

                                                                                                    • memory/1904-55-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                                      Filesize

                                                                                                      408KB

                                                                                                    • memory/1904-2-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                      Filesize

                                                                                                      420KB

                                                                                                    • memory/2140-124-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                      Filesize

                                                                                                      420KB

                                                                                                    • memory/2140-123-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                      Filesize

                                                                                                      420KB

                                                                                                    • memory/2140-126-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                      Filesize

                                                                                                      420KB

                                                                                                    • memory/2344-247-0x0000023B3FB00000-0x0000023B3FC00000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/2344-266-0x0000023B40C00000-0x0000023B40C20000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/2344-283-0x0000023B41010000-0x0000023B41030000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/2344-252-0x0000023B40C40000-0x0000023B40C60000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/2700-1268-0x00000000043D0000-0x00000000043D1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3064-1118-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3564-398-0x00000179FA940000-0x00000179FAA40000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/3564-414-0x00000179FB850000-0x00000179FB870000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/3564-426-0x00000179FBE60000-0x00000179FBE80000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/3564-402-0x00000179FB890000-0x00000179FB8B0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/3564-397-0x00000179FA940000-0x00000179FAA40000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/3664-395-0x0000000004E20000-0x0000000004E21000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3760-537-0x00000000045C0000-0x00000000045C1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3952-1009-0x00000192627A0000-0x00000192627C0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/3952-1003-0x0000019262390000-0x00000192623B0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/3952-978-0x00000192623D0000-0x00000192623F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4084-684-0x0000014ED7860000-0x0000014ED7880000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4084-679-0x0000014ED6700000-0x0000014ED6800000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/4084-706-0x0000014ED7C20000-0x0000014ED7C40000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4084-694-0x0000014ED7820000-0x0000014ED7840000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4084-681-0x0000014ED6700000-0x0000014ED6800000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/4084-680-0x0000014ED6700000-0x0000014ED6800000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/4176-206-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                      Filesize

                                                                                                      116KB

                                                                                                    • memory/4360-52-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                      Filesize

                                                                                                      420KB

                                                                                                    • memory/4360-54-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                      Filesize

                                                                                                      420KB

                                                                                                    • memory/4468-568-0x00000295DFE70000-0x00000295DFE90000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4468-544-0x00000295DFAA0000-0x00000295DFAC0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4468-552-0x00000295DFA60000-0x00000295DFA80000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4616-245-0x0000000004960000-0x0000000004961000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4636-970-0x0000000004480000-0x0000000004481000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4644-831-0x000001BD96A40000-0x000001BD96A60000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4644-828-0x000001B594900000-0x000001B594A00000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/4644-860-0x000001BD96E00000-0x000001BD96E20000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4644-827-0x000001B594900000-0x000001B594A00000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/4644-844-0x000001BD96A00000-0x000001BD96A20000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4888-1296-0x000001C42F8A0000-0x000001C42F8C0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4888-1284-0x000001C42F290000-0x000001C42F2B0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4888-1274-0x000001C42F2D0000-0x000001C42F2F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4888-1269-0x000001C42E400000-0x000001C42E500000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/5028-1121-0x00000219F0200000-0x00000219F0300000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/5028-1138-0x00000219F1260000-0x00000219F1280000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/5028-1147-0x00000219F1670000-0x00000219F1690000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/5028-1120-0x00000219F0200000-0x00000219F0300000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/5028-1125-0x00000219F12A0000-0x00000219F12C0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/5044-825-0x0000000003F90000-0x0000000003F91000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB