Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2022, 04:05
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe
Resource
win10v2004-20220901-en
General
-
Target
HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe
-
Size
1.0MB
-
MD5
c9b1338dfcaf42a0fa3595306afce4b3
-
SHA1
c8e04e6df3535099c41c1fc6db737d4613a8b303
-
SHA256
50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639
-
SHA512
81955bfbdd0ff52a9413a9860737d80d94e8c7bb182cec1ecb9c59627875cf71a299674dcb1ec549b16e8826d7a4ec4e4b4ba022bf8d456a83dfe3b90843676c
-
SSDEEP
24576:CIggbZfccl1V2qBVds4Dy2DEHFVBnCZsGUy0:7ggNfV1YqNfDL4HFVtiWV
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\511771926\readme-warning.txt
makop
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2800 created 4304 2800 svchost.exe 100 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 3280 wbadmin.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4244 set thread context of 4304 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 100 PID 3504 set thread context of 1468 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 118 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200_contrast-high.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-80.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsyml.ttf HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Describe.ps1 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-100_contrast-white.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\ui-strings.js HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-125.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\LargeTile.scale-100.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\readme-warning.txt HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.ITS HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Config\ExportConfig.json HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-150.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\readme-warning.txt HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\readme-warning.txt HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.513.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\javaws.jar HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-125.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-32.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\readme-warning.txt HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\MedTile.scale-100.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16_altform-unplated.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\ui-strings.js HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-32_altform-unplated.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\readme-warning.txt HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\readme-warning.txt HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\readme-warning.txt HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Microsoft.VCLibs.x86.14.00.appx HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Fingerprinting HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\webviewCore.min.js HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-200.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\LargeTile.scale-100.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\common.lua HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\readme-warning.txt HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBCN6.CHM HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-200_contrast-white.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_contrast-high.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-lightunplated_devicefamily-colorfulunplated.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-20_altform-unplated_contrast-white.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\lt.pak.DATA HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Snooze.scale-64.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-64_contrast-black.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_it.json HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WorldClockWideTile.contrast-white_scale-100.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBENDF98.CHM HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pt-PT\View3d\3DViewerProductDescription-universal.xml HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\FreeCell.Wide.png HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\readme-warning.txt HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3064 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 5116 powershell.exe 5116 powershell.exe 4304 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 4304 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 4600 powershell.exe 4600 powershell.exe -
Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeDebugPrivilege 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe Token: SeTcbPrivilege 2800 svchost.exe Token: SeTcbPrivilege 2800 svchost.exe Token: SeDebugPrivilege 5116 powershell.exe Token: SeBackupPrivilege 2332 vssvc.exe Token: SeRestorePrivilege 2332 vssvc.exe Token: SeAuditPrivilege 2332 vssvc.exe Token: SeBackupPrivilege 3388 wbengine.exe Token: SeRestorePrivilege 3388 wbengine.exe Token: SeSecurityPrivilege 3388 wbengine.exe Token: SeIncreaseQuotaPrivilege 1964 WMIC.exe Token: SeSecurityPrivilege 1964 WMIC.exe Token: SeTakeOwnershipPrivilege 1964 WMIC.exe Token: SeLoadDriverPrivilege 1964 WMIC.exe Token: SeSystemProfilePrivilege 1964 WMIC.exe Token: SeSystemtimePrivilege 1964 WMIC.exe Token: SeProfSingleProcessPrivilege 1964 WMIC.exe Token: SeIncBasePriorityPrivilege 1964 WMIC.exe Token: SeCreatePagefilePrivilege 1964 WMIC.exe Token: SeBackupPrivilege 1964 WMIC.exe Token: SeRestorePrivilege 1964 WMIC.exe Token: SeShutdownPrivilege 1964 WMIC.exe Token: SeDebugPrivilege 1964 WMIC.exe Token: SeSystemEnvironmentPrivilege 1964 WMIC.exe Token: SeRemoteShutdownPrivilege 1964 WMIC.exe Token: SeUndockPrivilege 1964 WMIC.exe Token: SeManageVolumePrivilege 1964 WMIC.exe Token: 33 1964 WMIC.exe Token: 34 1964 WMIC.exe Token: 35 1964 WMIC.exe Token: 36 1964 WMIC.exe Token: SeIncreaseQuotaPrivilege 1964 WMIC.exe Token: SeSecurityPrivilege 1964 WMIC.exe Token: SeTakeOwnershipPrivilege 1964 WMIC.exe Token: SeLoadDriverPrivilege 1964 WMIC.exe Token: SeSystemProfilePrivilege 1964 WMIC.exe Token: SeSystemtimePrivilege 1964 WMIC.exe Token: SeProfSingleProcessPrivilege 1964 WMIC.exe Token: SeIncBasePriorityPrivilege 1964 WMIC.exe Token: SeCreatePagefilePrivilege 1964 WMIC.exe Token: SeBackupPrivilege 1964 WMIC.exe Token: SeRestorePrivilege 1964 WMIC.exe Token: SeShutdownPrivilege 1964 WMIC.exe Token: SeDebugPrivilege 1964 WMIC.exe Token: SeSystemEnvironmentPrivilege 1964 WMIC.exe Token: SeRemoteShutdownPrivilege 1964 WMIC.exe Token: SeUndockPrivilege 1964 WMIC.exe Token: SeManageVolumePrivilege 1964 WMIC.exe Token: 33 1964 WMIC.exe Token: 34 1964 WMIC.exe Token: 35 1964 WMIC.exe Token: 36 1964 WMIC.exe Token: SeDebugPrivilege 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe Token: SeDebugPrivilege 4600 powershell.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 4244 wrote to memory of 5116 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 96 PID 4244 wrote to memory of 5116 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 96 PID 4244 wrote to memory of 5116 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 96 PID 4244 wrote to memory of 1596 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 97 PID 4244 wrote to memory of 1596 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 97 PID 4244 wrote to memory of 1596 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 97 PID 4244 wrote to memory of 1016 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 99 PID 4244 wrote to memory of 1016 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 99 PID 4244 wrote to memory of 1016 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 99 PID 4244 wrote to memory of 4304 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 100 PID 4244 wrote to memory of 4304 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 100 PID 4244 wrote to memory of 4304 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 100 PID 4244 wrote to memory of 4304 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 100 PID 4244 wrote to memory of 4304 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 100 PID 4244 wrote to memory of 4304 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 100 PID 4244 wrote to memory of 4304 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 100 PID 4244 wrote to memory of 4304 4244 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 100 PID 2800 wrote to memory of 3504 2800 svchost.exe 102 PID 2800 wrote to memory of 3504 2800 svchost.exe 102 PID 2800 wrote to memory of 3504 2800 svchost.exe 102 PID 2800 wrote to memory of 3504 2800 svchost.exe 102 PID 2800 wrote to memory of 3504 2800 svchost.exe 102 PID 2800 wrote to memory of 3504 2800 svchost.exe 102 PID 2800 wrote to memory of 3504 2800 svchost.exe 102 PID 4304 wrote to memory of 4036 4304 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 103 PID 4304 wrote to memory of 4036 4304 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 103 PID 4036 wrote to memory of 3064 4036 cmd.exe 105 PID 4036 wrote to memory of 3064 4036 cmd.exe 105 PID 4036 wrote to memory of 3280 4036 cmd.exe 108 PID 4036 wrote to memory of 3280 4036 cmd.exe 108 PID 4036 wrote to memory of 1964 4036 cmd.exe 112 PID 4036 wrote to memory of 1964 4036 cmd.exe 112 PID 3504 wrote to memory of 4600 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 115 PID 3504 wrote to memory of 4600 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 115 PID 3504 wrote to memory of 4600 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 115 PID 3504 wrote to memory of 5048 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 117 PID 3504 wrote to memory of 5048 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 117 PID 3504 wrote to memory of 5048 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 117 PID 3504 wrote to memory of 1468 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 118 PID 3504 wrote to memory of 1468 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 118 PID 3504 wrote to memory of 1468 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 118 PID 3504 wrote to memory of 1468 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 118 PID 3504 wrote to memory of 1468 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 118 PID 3504 wrote to memory of 1468 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 118 PID 3504 wrote to memory of 1468 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 118 PID 3504 wrote to memory of 1468 3504 HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"2⤵PID:1596
-
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"2⤵PID:1016
-
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe" n43043⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"4⤵PID:5048
-
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe"4⤵PID:1468
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:3064
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:3280
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4408
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:3076
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HEUR-Trojan.MSIL.Taskun.gen-50b0c7858bc2bb2d1fa3d441bd2c4e3930b88b77c6cef11a51af5705727d6639.exe.log
Filesize1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD536acdd8613bfa092db54ac59fa18b411
SHA1ad4e29ee385c1613b310b92b99e1a3d567fe1bd2
SHA256d7ad4f1092cc07f08a53a8506ead752dccc98af1079bcbd2c704b7c06412619d
SHA5126031fdf28f7a8c28e5ee500297da831e5cb84757e1590274067f810129193fca099fb9ca2ef664a463952d5f0262429ce99fdceedeee6c5d70eee30aee1d79a9