Overview

overview

10

Static

static

10

f5ae5532f1...b5.exe

windows10-ltsc_2021-x64

10

f5cb51ffdb...c0.exe

windows10-ltsc_2021-x64

10

f5ed127464...bc.exe

windows10-ltsc_2021-x64

10

f62837f3bc...7a.exe

windows10-ltsc_2021-x64

10

f628fa20e8...3b.exe

windows10-ltsc_2021-x64

10

f640f01e80...c5.exe

windows10-ltsc_2021-x64

7

f66fa3036e...07.exe

windows10-ltsc_2021-x64

7

f68f044685...50.exe

windows10-ltsc_2021-x64

3

f6ac1ea5c1...25.exe

windows10-ltsc_2021-x64

8

f6b7978847...1a.exe

windows10-ltsc_2021-x64

7

f6e2978004...35.exe

windows10-ltsc_2021-x64

10

f721adec82...71.exe

windows10-ltsc_2021-x64

10

f736c152b3...c8.exe

windows10-ltsc_2021-x64

10

f780377dd9...c9.exe

windows10-ltsc_2021-x64

7

f7a96bf083...c8.exe

windows10-ltsc_2021-x64

1

f812ad48d0...9b.exe

windows10-ltsc_2021-x64

10

f8173be0fb...a4.exe

windows10-ltsc_2021-x64

1

f835ddaf49...d7.exe

windows10-ltsc_2021-x64

10

f846950431...1c.exe

windows10-ltsc_2021-x64

10

f89219b77e...00.exe

windows10-ltsc_2021-x64

10

f8a3f1d5a1...b0.exe

windows10-ltsc_2021-x64

10

f908d30321...39.exe

windows10-ltsc_2021-x64

10

f926cc363c...a8.exe

windows10-ltsc_2021-x64

10

f947bf8f07...dd.exe

windows10-ltsc_2021-x64

10

f97418dbfc...06.exe

windows10-ltsc_2021-x64

7

f98ee08aed...cc.exe

windows10-ltsc_2021-x64

10

f990d850e1...f8.exe

windows10-ltsc_2021-x64

8

f99ae4a378...93.exe

windows10-ltsc_2021-x64

10

f9a573b21a...18.exe

windows10-ltsc_2021-x64

10

fa0d8e0c80...8e.exe

windows10-ltsc_2021-x64

10

fa8e531e08...84.exe

windows10-ltsc_2021-x64

10

fa942bbb98...d7.exe

windows10-ltsc_2021-x64

10

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250410-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    14/04/2025, 07:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f98ee08aed6b41b1f9e6e1ca752d22cc.exe

  • Size

    1.9MB

  • MD5

    f98ee08aed6b41b1f9e6e1ca752d22cc

  • SHA1

    0ad8d0bac5c76e5f79ba872cf3ae18a6717ee6dd

  • SHA256

    82db60e8849ee07cae78c7f49afbbed2e3544618bfcd5d01daf09b120e97b1e0

  • SHA512

    63dcfc32399062ec5bb65a3a579c75a86bd80bc9bae28d63ff5df3510ef319a5e3237629fcea17232cdbaf96bca0347cd8d8b7669698188cbf08bdc2f3caed5a

  • SSDEEP

    24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD

Score
10/10
defense_evasionexecutiontrojan

Malware Config

Signatures

  • Process spawned unexpected child process 21 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 36 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Checks whether UAC is enabled 1 TTPs 24 IoCs
    defense_evasiontrojan
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 36 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\f98ee08aed6b41b1f9e6e1ca752d22cc.exe
    "C:\Users\Admin\AppData\Local\Temp\f98ee08aed6b41b1f9e6e1ca752d22cc.exe"
    1⤵
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5384
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\f98ee08aed6b41b1f9e6e1ca752d22cc.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4928
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\9d2b847687b690a2178c8f942b64\RuntimeBroker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4948
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4980
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\ssh\SearchApp.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4612
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\en-US\explorer.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5848
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5084
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4856
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\InboxApps\unsecapp.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4740
    • C:\Program Files (x86)\Windows Defender\en-US\explorer.exe
      "C:\Program Files (x86)\Windows Defender\en-US\explorer.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5988
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3622860-0396-467d-b55a-91e1323ba890.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5308
        • C:\Program Files (x86)\Windows Defender\en-US\explorer.exe
          "C:\Program Files (x86)\Windows Defender\en-US\explorer.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4460
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea443c01-ed5a-4cc7-9f5f-c92a02393d15.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2620
            • C:\Program Files (x86)\Windows Defender\en-US\explorer.exe
              "C:\Program Files (x86)\Windows Defender\en-US\explorer.exe"
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1144
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94e95a6b-162f-4d56-9447-a5c44d6a073e.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:5892
                • C:\Program Files (x86)\Windows Defender\en-US\explorer.exe
                  "C:\Program Files (x86)\Windows Defender\en-US\explorer.exe"
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:4896
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24c058af-50a8-464d-a729-bc035998bf42.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2868
                    • C:\Program Files (x86)\Windows Defender\en-US\explorer.exe
                      "C:\Program Files (x86)\Windows Defender\en-US\explorer.exe"
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:3344
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c045ee33-f84f-4a08-b55a-dd9f77ed8e0f.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4124
                        • C:\Program Files (x86)\Windows Defender\en-US\explorer.exe
                          "C:\Program Files (x86)\Windows Defender\en-US\explorer.exe"
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:1020
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40675d28-34d7-4684-9721-eae5f4ddd6ad.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3188
                            • C:\Program Files (x86)\Windows Defender\en-US\explorer.exe
                              "C:\Program Files (x86)\Windows Defender\en-US\explorer.exe"
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:828
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70d5941e-1860-4df7-93d5-59013636cf93.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4276
                                • C:\Program Files (x86)\Windows Defender\en-US\explorer.exe
                                  "C:\Program Files (x86)\Windows Defender\en-US\explorer.exe"
                                  16⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:4264
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d4119d58-a03f-4a85-a20a-b8ef31de2b3a.vbs"
                                    17⤵
                                      PID:2672
                                      • C:\Program Files (x86)\Windows Defender\en-US\explorer.exe
                                        "C:\Program Files (x86)\Windows Defender\en-US\explorer.exe"
                                        18⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • System policy modification
                                        PID:1632
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb0ef8be-2e9a-45cb-823c-306e31007253.vbs"
                                          19⤵
                                            PID:3868
                                            • C:\Program Files (x86)\Windows Defender\en-US\explorer.exe
                                              "C:\Program Files (x86)\Windows Defender\en-US\explorer.exe"
                                              20⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • System policy modification
                                              PID:2256
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f3fd50b-59cf-4236-856c-63dbdb63db14.vbs"
                                                21⤵
                                                  PID:4380
                                                  • C:\Program Files (x86)\Windows Defender\en-US\explorer.exe
                                                    "C:\Program Files (x86)\Windows Defender\en-US\explorer.exe"
                                                    22⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • System policy modification
                                                    PID:5436
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4cef8c12-0b17-4e7e-a78e-f3a33fd6970e.vbs"
                                                      23⤵
                                                        PID:4460
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08f5b0c1-1b87-44c1-b418-71c76db0a5dc.vbs"
                                                        23⤵
                                                          PID:1580
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e23a94a-b3b0-4521-abdf-430823026a65.vbs"
                                                      21⤵
                                                        PID:760
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5a51922-a212-47b4-975a-a37f38af540a.vbs"
                                                    19⤵
                                                      PID:560
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1216674e-74bb-4807-a404-d0cb694a86f2.vbs"
                                                  17⤵
                                                    PID:5028
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c84d9a0b-d52b-4ff7-b455-2697a302cd1f.vbs"
                                                15⤵
                                                  PID:4256
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48964d1a-ab4c-4588-960b-2c6ee414b10e.vbs"
                                              13⤵
                                                PID:5656
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c952c3e1-9973-440e-be95-53163af3413d.vbs"
                                            11⤵
                                              PID:344
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75f3fbdf-4a90-4ce3-a852-b2ec372d5f3f.vbs"
                                          9⤵
                                            PID:3376
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1fb4ef8-6f5c-4451-807c-6abcdd2fe081.vbs"
                                        7⤵
                                          PID:5532
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1794a635-0940-4463-bd31-2e2fe2eaa355.vbs"
                                      5⤵
                                        PID:2924
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ce74304-5dab-46d4-a532-c59fc4b29e24.vbs"
                                    3⤵
                                      PID:4060
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\9d2b847687b690a2178c8f942b64\RuntimeBroker.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:3388
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\9d2b847687b690a2178c8f942b64\RuntimeBroker.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:5420
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\9d2b847687b690a2178c8f942b64\RuntimeBroker.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1620
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2880
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1460
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2592
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\ssh\SearchApp.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:5936
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\ssh\SearchApp.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1132
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\ssh\SearchApp.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2920
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\en-US\explorer.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:5756
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\en-US\explorer.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2596
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\en-US\explorer.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:932
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1028
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:3640
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:5876
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1144
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:3828
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:5856
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Windows\InboxApps\unsecapp.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1660
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\InboxApps\unsecapp.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2196
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\InboxApps\unsecapp.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2296

                                Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\9d2b847687b690a2178c8f942b64\RuntimeBroker.exe
                                  Filesize

                                  1.9MB

                                  MD5

                                  5fc18209ff8b733e0d861e1f0053a690

                                  SHA1

                                  07ec30657b8a20565298a731c39bc61c07ccedb2

                                  SHA256

                                  c38939605785a8de421950fb7161ad44222c90dc194955c0fadc164cce802c9d

                                  SHA512

                                  c20c1517657f2cbef469b7e9e984ebdc507d875b9474262b96b92e62efd7f0b875f142b93f7704034b50b72bb480568bdc131b098e7b294a8b08d8e0088b7aac

                                  Download Submit

                                • C:\Program Files (x86)\Windows Defender\en-US\explorer.exe
                                  Filesize

                                  1.9MB

                                  MD5

                                  9195d2b0c2700421292d107963bb61a9

                                  SHA1

                                  e0ba8103ed5b82f1f33f49901928a20b47e552bf

                                  SHA256

                                  27d378c58a6cf42dc25ef3528622e0e8e6898aa2636bca240e129f26043c46fe

                                  SHA512

                                  030ddbd5758878bf2a67e5e90768d9f2477f4649aaac4f2ca99889f5895a7bb22a254a3f2657abe93841e11c197999033f45c8c373a9024bd3a61607a50a4659

                                  Download Submit

                                • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                                  Filesize

                                  1.9MB

                                  MD5

                                  5f83b1b269225073dfdcd653842b6a65

                                  SHA1

                                  12b96be7b9e6466deba8401d194e33bc460967ee

                                  SHA256

                                  212ac187c80339df3306576aa1fb349e0ac685d1731ee4d86b414e076fbb1be6

                                  SHA512

                                  5668d56075cd9729be946cca7e27644a1d7afb363ae867d762993a13d816b0889a7006e61354f913b0d78a750e392766060700d1265ab362026e4fa60336b719

                                  Download Submit

                                • C:\Recovery\WindowsRE\dllhost.exe
                                  Filesize

                                  1.9MB

                                  MD5

                                  bf88cff1eac9c5672ca885cad1b90c65

                                  SHA1

                                  add5f497fe883d52ac1a1480219e674ae1f0c1ed

                                  SHA256

                                  07266a7ec74ba2b25d07f0bc31b0ba044077dec2ea0b6f5914bbe175f6047088

                                  SHA512

                                  78dbca4c99235f2c7edca0a0ba529cb9b54101eec8147097054795d9c0d025b18cb7bc4e4a8c06ae3ec04bde4968e5050fd2db93e38cff9ce16da54ee4ecd588

                                  Download Submit

                                • C:\Recovery\WindowsRE\services.exe
                                  Filesize

                                  1.9MB

                                  MD5

                                  5cd27159173c2f8b4fa0a436ef97fca8

                                  SHA1

                                  8c04d6573ef7ad5914d9d994f3e3f6f04e700070

                                  SHA256

                                  42543937257061164399675d0b87a0afa5390e934a586208cdeeaf8df822612d

                                  SHA512

                                  6b385de6b6be988f7c308e05cfe56f0982c4a7ee88dbd0b4efe29db79890bb87a598c91485f1796638a164807dd7e1e05fe65635ee9bcea6210af73ef5dc34bf

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log
                                  Filesize

                                  1KB

                                  MD5

                                  9cdc082abcfcf189c301172f429a95b6

                                  SHA1

                                  2b48360ba5b8cfb5e9b5dcaa168b037a2d2583fe

                                  SHA256

                                  35a6bd50fcb3680da7bf82e91e10db63005483cd55fc33fa017363fe3444256f

                                  SHA512

                                  157febdd860dd528eb8044f4558197240ed68b74d8a7e99f0324ea8d6b5a5ea867068029f316f1affe478f35f7609bac9aba44e322691855ffa44daf9abb5f6d

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                  Filesize

                                  3KB

                                  MD5

                                  3eb3833f769dd890afc295b977eab4b4

                                  SHA1

                                  e857649b037939602c72ad003e5d3698695f436f

                                  SHA256

                                  c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

                                  SHA512

                                  c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  Filesize

                                  1KB

                                  MD5

                                  9be792467773fcdd326b92680f4a01f5

                                  SHA1

                                  b7dfa9f6ae7143bcb7dfcbceb80dccc5bd314790

                                  SHA256

                                  46aca4d2ec6cfb6527cb883d18022429ad92b506c1169ddb885247a635e957c3

                                  SHA512

                                  0ad55b1f4ba06add61f9ba6c081c8f5c1c233b77267dc60dc978280794e01a001664220ae01fa93e2d412be4154950d30d46908c1de2645c327736f86efb23c4

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  Filesize

                                  1KB

                                  MD5

                                  fbc43da3f23a19e81cdba8d990983c0a

                                  SHA1

                                  dde5adc1ec9531ac8ca4dc8d8b88eb2ee042a347

                                  SHA256

                                  ea293452013c18bc20f410a45333994a9f1022bb5999f241b3e494af01f8081e

                                  SHA512

                                  d7394f2954883ef4f8272b30cdf2e53800de8d6f5820c6ecde8798bc958f4268c33a7bad4dee09afcf0a455cc12f400065602dcea5cda3dce3716d56aebc0959

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  Filesize

                                  1KB

                                  MD5

                                  65c36c26296c2baf4540f118c5312534

                                  SHA1

                                  3c38b1dcde36b206dca52aad1a1e120b365ac06e

                                  SHA256

                                  ac74ca30bb6ae992cb3f2248a2b285758b0c890e4f5dd16cd89f6e4df34dd80e

                                  SHA512

                                  ce5c1016ecbd40348c4c0acc1b700c2233aa5840a16c412ec3ed6a6285b1534a310baaa3b93f0171f8117d954cd43f1d3297e3e7f284dd696317c45ff6072dc8

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\24c058af-50a8-464d-a729-bc035998bf42.vbs
                                  Filesize

                                  734B

                                  MD5

                                  dc8f6e1204a73b41301511899e64f525

                                  SHA1

                                  d76bb47eb05019c8ea9f6fdac230aa4edd9c066d

                                  SHA256

                                  422dee5f5a2cd7627447b310ba4fcec8f1e32d1fd2a94abeccb9fc63ac435ebf

                                  SHA512

                                  0a52b21bec32f4e8a81f28f785fa4ef12fffcc66a17b1d84193919ecb6bd4d42395a5215762ca6f65a41026fa51f802c8ec4cec74e3273ea35b2e2003425d7b4

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\40675d28-34d7-4684-9721-eae5f4ddd6ad.vbs
                                  Filesize

                                  734B

                                  MD5

                                  823fb9bacd15d9827b6a61bbfd7ca29a

                                  SHA1

                                  2df62381e82db6afcf9083a9ffd917c639aa79ae

                                  SHA256

                                  c6a563520fa00adde281a04d74de10b5de170356a6738699dc56c0928a0a016d

                                  SHA512

                                  f2e1578e04e44bc9c32d143fbaff1820433dd7b921dcab0a32c38b3f11a28ddd1f7bf40f09af6b4d285406fd470eb6f67dda5802db3e73a7dfd83ac176f2833c

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\4ce74304-5dab-46d4-a532-c59fc4b29e24.vbs
                                  Filesize

                                  510B

                                  MD5

                                  f103b537a29e928de058c4ba303df4e7

                                  SHA1

                                  dd4a7ef5fb9c863efeceff7ebf44dfd8cfe759d6

                                  SHA256

                                  867a02626d4b11550b86c3fbe85a34cf14d3a1b77a020b367e2db9ca633092bc

                                  SHA512

                                  1d4671b4fd1d825278ad0e9c6e9a2f2ae2411c29f6f716d5094d93307fc7d580168b88262938cc2394306cb238eb0bef212adeee90964dcd5e6d03d67a7b6776

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\4cef8c12-0b17-4e7e-a78e-f3a33fd6970e.vbs
                                  Filesize

                                  734B

                                  MD5

                                  8b314c2e4b4ffe428d5ed25c182ff5cf

                                  SHA1

                                  d7371dff5671296ce46485abc41afd322afaa432

                                  SHA256

                                  47079e2a4addc0011a7a8c89006ad8976b3e9371529a9910ef34174464cccc4b

                                  SHA512

                                  fc2cd5b6320b7af4a420082fd49c98ca529671b3237d1382010b80f2648ddcd2a628cc189cc8e1b843354b9965ba0756bbd357967e76c45e0a7bc59a6d45eb4f

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\4f3fd50b-59cf-4236-856c-63dbdb63db14.vbs
                                  Filesize

                                  734B

                                  MD5

                                  dd677c2cd6efb5a03094cc289efba1ea

                                  SHA1

                                  a31155bd3f21a1e2c270bc774b95cc0331f598b2

                                  SHA256

                                  6dd615ae5360a9c2c11f30d476e18f77125caad2a2781b6ff2fc6d444d281ded

                                  SHA512

                                  3e008882b49d92206c9e6fbd3b991214554cf46b372eff4d24dfbf42543284e3b536858de0a6203e31dab41b881774ab55acbbf8dd8435c2a6f14d91d55c563a

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\70d5941e-1860-4df7-93d5-59013636cf93.vbs
                                  Filesize

                                  733B

                                  MD5

                                  67aedd0132a437cd1d819d7c4f394149

                                  SHA1

                                  54f13c10b32a5544e8adb6f020ef4e5a170679b1

                                  SHA256

                                  a2361a4c7e388da181ae698a456a0713d1261d7011e816165d0f15447a2a1041

                                  SHA512

                                  2dae8febdf1237438fbd476defd94d4e16e7abc7b2cf9b1c0fba28e0474729e2b6f1fa2a3b3b22885ae0ad35e476aa3f5c5533dd5dec291d228cf8b8bb0764c2

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\94e95a6b-162f-4d56-9447-a5c44d6a073e.vbs
                                  Filesize

                                  734B

                                  MD5

                                  30c5cb1409efe38c606a1b805f75f21a

                                  SHA1

                                  5f9b77384eeea9441313cc372ed89ef6556d1b66

                                  SHA256

                                  2ad41ea00aba292c2dc2c288cca2968bf74872a98b7690172f8ede01590d4d7f

                                  SHA512

                                  1a6b48d547873ac4b8f96b1945bf44580b4063e49cfe965c89c2de614d99e6f760d841be4cfe493f4a76f5df3c1df551529d988f49247247758aa5cb360f2cf0

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_emkdc1ro.srn.ps1
                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\a3622860-0396-467d-b55a-91e1323ba890.vbs
                                  Filesize

                                  734B

                                  MD5

                                  f2d74b3870ab3b73e1b85c0497395ac5

                                  SHA1

                                  7e9afab13ae23be20c5a68f908cfb8b99e1c6636

                                  SHA256

                                  366fb9a4c2e551caed5973d778af74cbae1d92181f37c86f4a88a0056bdf7711

                                  SHA512

                                  8e4ac2afbe2ee5e979fd2c03a9ae984d11599ae99987d8e36467157d89332e84ebcb8316f0dc55788e72aac799ec90b47a87069271a6206de027d8fdba6ce381

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\c045ee33-f84f-4a08-b55a-dd9f77ed8e0f.vbs
                                  Filesize

                                  734B

                                  MD5

                                  6786660a5eed4abb59a0a7632d566eaa

                                  SHA1

                                  6d7632cc9360339054c209e506b05977822f7b92

                                  SHA256

                                  6af928b1426f0bdb00ee76bb818dc5e4ef2cde439b60c2e244e406de941ae5d6

                                  SHA512

                                  3146e0b5ceede3eff5efe63807b6203b6026a7ca12b530e09d5ee0a771e18386d371d8390d41f22df510ef39a68c408ef54a1ca908a3ab1d731d293674c96d3e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\d4119d58-a03f-4a85-a20a-b8ef31de2b3a.vbs
                                  Filesize

                                  734B

                                  MD5

                                  3b10f2de80bdf74235b8c62e74917ef0

                                  SHA1

                                  397af2b3db0435682b50cc154a012aad3a8b73a9

                                  SHA256

                                  54cbfcb7faae66964acf682d84105139e2bb7188c4e2d2fb28f18d70f8b8519e

                                  SHA512

                                  b433229355f5ba8c180690101bb9b1481bcc04935da372379b1c789c89991622ee5d018e7e81143b5b3f979558221e7b57f1494d5d25f27f97fbad7f75dd3580

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\ea443c01-ed5a-4cc7-9f5f-c92a02393d15.vbs
                                  Filesize

                                  734B

                                  MD5

                                  78063eb538f65c7a09cc7e5a93ad2cfe

                                  SHA1

                                  edc762cf53fc6deea34b560a18c0d72c87973d0a

                                  SHA256

                                  06f252d6b68e841974d3b06cc66d637dafc923dfcf365e65abc2a6cb937aeab4

                                  SHA512

                                  ca23cbc109f5e305196d12182788f6d0f2f29ff7e4b380daab1cd9994d8e8cb9ab29b8c0c9c1818e78becf9e0914748e3d86376041b26f544db2e14679feb67e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\eb0ef8be-2e9a-45cb-823c-306e31007253.vbs
                                  Filesize

                                  734B

                                  MD5

                                  354f1b0ebbc2408de9751e989dd327e0

                                  SHA1

                                  49e357fb6d0eb47c78dbbe4659e52254c65db00f

                                  SHA256

                                  a09e2b34b1fd5729953db79a542872056c48c183861205bbabc9754ef06fd4c3

                                  SHA512

                                  fff29047fe5350b5e8c1ebbcb2a5e49cbd1ce0ec6c1c0e2720e793a4d26fcc3b0edddb343c78e771a8e0e1c453641cdf0a165c51301a93b15ee8b7cc6c593a92

                                  Download Submit

                                • C:\Windows\InboxApps\unsecapp.exe
                                  Filesize

                                  1.9MB

                                  MD5

                                  29262bd140eeafaafbf722d058ec73a6

                                  SHA1

                                  c9f8e227e2cb29cdf2494aede59ba34720044720

                                  SHA256

                                  a386a8067ac32d91a2da6eec80f843331c229e3c625be6477ddbf55c459f67dc

                                  SHA512

                                  3a6b78f096eaeeda3289a6da7744ee2b86c4360e8a87acd3374ffa1ee9e7dfb51e2ef0fdeffc39d21706fbb0492f2f30ee632b116d2c47dec3e2e8589d6a39c1

                                  Download Submit

                                • memory/828-336-0x000000001B910000-0x000000001B966000-memory.dmp

                                  Filesize

                                  344KB

                                  Download

                                • memory/5084-144-0x0000018A30DD0000-0x0000018A30DF2000-memory.dmp

                                  Filesize

                                  136KB

                                  Download

                                • memory/5384-8-0x0000000000C60000-0x0000000000C6A000-memory.dmp

                                  Filesize

                                  40KB

                                  Download

                                • memory/5384-4-0x000000001B5E0000-0x000000001B630000-memory.dmp

                                  Filesize

                                  320KB

                                  Download

                                • memory/5384-226-0x00007FFAC63D0000-0x00007FFAC6E92000-memory.dmp

                                  Filesize

                                  10.8MB

                                  Download

                                • memory/5384-15-0x000000001B660000-0x000000001B66C000-memory.dmp

                                  Filesize

                                  48KB

                                  Download

                                • memory/5384-19-0x000000001B850000-0x000000001B85C000-memory.dmp

                                  Filesize

                                  48KB

                                  Download

                                • memory/5384-14-0x000000001C0D0000-0x000000001C5F8000-memory.dmp

                                  Filesize

                                  5.2MB

                                  Download

                                • memory/5384-5-0x0000000000A40000-0x0000000000A48000-memory.dmp

                                  Filesize

                                  32KB

                                  Download

                                • memory/5384-3-0x000000001AEC0000-0x000000001AEDC000-memory.dmp

                                  Filesize

                                  112KB

                                  Download

                                • memory/5384-6-0x0000000000A60000-0x0000000000A70000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/5384-9-0x000000001B590000-0x000000001B5E6000-memory.dmp

                                  Filesize

                                  344KB

                                  Download

                                • memory/5384-0-0x00007FFAC63D3000-0x00007FFAC63D5000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/5384-7-0x000000001AEE0000-0x000000001AEF6000-memory.dmp

                                  Filesize

                                  88KB

                                  Download

                                • memory/5384-10-0x000000001AEA0000-0x000000001AEAC000-memory.dmp

                                  Filesize

                                  48KB

                                  Download

                                • memory/5384-13-0x000000001B630000-0x000000001B642000-memory.dmp

                                  Filesize

                                  72KB

                                  Download

                                • memory/5384-2-0x00007FFAC63D0000-0x00007FFAC6E92000-memory.dmp

                                  Filesize

                                  10.8MB

                                  Download

                                • memory/5384-11-0x000000001AF00000-0x000000001AF08000-memory.dmp

                                  Filesize

                                  32KB

                                  Download

                                • memory/5384-1-0x00000000000A0000-0x000000000028A000-memory.dmp

                                  Filesize

                                  1.9MB

                                  Download

                                • memory/5384-20-0x000000001B860000-0x000000001B86C000-memory.dmp

                                  Filesize

                                  48KB

                                  Download

                                • memory/5384-16-0x000000001B820000-0x000000001B82A000-memory.dmp

                                  Filesize

                                  40KB

                                  Download

                                • memory/5384-17-0x000000001B830000-0x000000001B83E000-memory.dmp

                                  Filesize

                                  56KB

                                  Download

                                • memory/5384-18-0x000000001B840000-0x000000001B848000-memory.dmp

                                  Filesize

                                  32KB

                                  Download

                                • memory/5436-397-0x000000001BF80000-0x000000001BF92000-memory.dmp

                                  Filesize

                                  72KB

                                  Download

                                • memory/5988-228-0x000000001BBD0000-0x000000001BC26000-memory.dmp

                                  Filesize

                                  344KB

                                  Download

                                • memory/5988-227-0x0000000000F90000-0x000000000117A000-memory.dmp

                                  Filesize

                                  1.9MB

                                  Download