42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d

General

Target

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
Size

342KB
MD5

2559340fb8d8f4e98ee58202d7f50fd0
SHA1

9c6efcc00e0283100987b57cc12a395eff4c03b7
SHA256

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d
SHA512

296d68a497086568aa6d436716006e2cf0e435e28c9eef3611dd7748f85a8b02e335e7432c3bc563e8190f6ab41a5511f79f37ebddcd8f610e63b654b81afb4e
SSDEEP

6144:zXC4vgmhbIxs3NBBt0CzlZ1JJskSO2acPJm8V64To0TnYh54Ja8jN4EjHmn:zXCNi9BD0slnsE2aOvsWe54RjNu

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

description	ioc	process
File opened (read-only)	\??\K:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\O:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\R:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\W:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\F:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\J:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\Q:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\T:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\U:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\Y:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\A:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\H:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\M:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\N:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\P:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\S:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\X:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\B:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\G:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\I:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\L:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\V:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\Z:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\E:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

Drops file in Program Files directory 17 IoCs

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\chinese fucking girls vagina 40+ .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\italian cum fucking sleeping (Sylvia).mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\bukkake horse [milf] ash .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\german sperm uncut girly .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\french lesbian lesbian .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\lesbian nude big (Samantha,Gina).avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Microsoft\Temp\animal blowjob public glans .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\italian bukkake cumshot sleeping .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files\Microsoft Office\root\Templates\british blowjob licking cock .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black bukkake several models .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\japanese sperm beastiality [free] .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\xxx sperm girls traffic .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\danish hardcore gay public femdom (Janette,Kathrin).avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\gay lingerie voyeur balls .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\chinese nude several models nipples .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Google\Temp\danish cum big titts .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Google\Update\Download\french beast hidden mistress .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

Drops file in Windows directory 1 IoCs

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

description ioc process

File created C:\Windows\mssrv.exe 42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\mssrv.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

pid	process
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4768	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
4592	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

description	pid	process	target process
PID 1192 wrote to memory of 3760	1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 1192 wrote to memory of 3760	1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 1192 wrote to memory of 3760	1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 1192 wrote to memory of 4592	1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 1192 wrote to memory of 4592	1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 1192 wrote to memory of 4592	1192	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 3760 wrote to memory of 4768	3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 3760 wrote to memory of 4768	3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 3760 wrote to memory of 4768	3760	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
"C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
"C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe"
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3760

C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
"C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4768

C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
"C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4592