Analysis
-
max time kernel
97s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2022 16:16
Static task
static1
General
-
Target
fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe
-
Size
840KB
-
MD5
837fd128d246ccb07647515dd273f4f9
-
SHA1
8fa22f3f426216aa7f1301d127582aa7434c9d4b
-
SHA256
fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71
-
SHA512
19f668b337f08ce16e831fe811876edf632d9e5c06b3d311bd9c7057c480fbe3ba2fc1c9d446cba4b755d375dff7bdbcd80224223b79204ce7324de19fd665c1
-
SSDEEP
12288:UZ/fiJLRc2evo2Ursov0KT4zHsyYgH/PT134slbbHl2qPVGNbTuMuKBD7hpvA/N:JAo/s7HsynTB4ATST0sDdIN
Malware Config
Extracted
Family
formbook
Version
4.1
Campaign
et2d
Decoy
wcaconline.com
travelbackpackss.com
ao-m-nishinomiya.com
tilania.com
vegbydesign.net
mybabysisterscloset.com
sanctitude-cuspidated.com
russtybeats.com
dichvubangchuan.com
su-seikatu.info
eratosantorini.com
ninetofivemama.com
delishany.com
pawchamamapet.net
nissicloud.com
strictlyotaku.net
kissmanga.pro
appalachianfx.com
aralending.com
forbrighterlife.com
manhe3.com
cas100.com
kayabrands.net
innerworkshops.love
kforkidz.com
niulorge.com
thelittleredcraftshack.com
583846.com
dutchesspistolpermit.com
gempharmatechllc.com
hatiyhgsnterahs.com
grooming-gigi.com
wevertexinc.com
brazil920.com
loan-stalemate.info
cleanerkitchen-shop.com
lilyamore.com
invest-eight.com
cfa-cuu.com
k978-k2bsp-mr.net
essisoasesorias.com
mechaf.com
danmerinc.com
prestigehometransformations.com
brandsincart.com
dichvuviplike.pro
bigiproperty.com
mysteryblack.com
magentos6.com
pilotsugardaddys.net
securityacadamy.com
media-cruise.com
sloppyasians.com
unempioymentpua.com
texasrefinances.com
hellogringa.com
vspectra.site
lakewoodcharity.com
lowdownlocal.com
jedzeniomat.com
sellmyhouseolympia.com
halsmart.info
lailraw.com
reapen.com
mommabearmoney.com
Signatures
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/2160-139-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5056 set thread context of 2160 5056 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe 90 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 5056 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe 2160 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe 2160 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2340 chrome.exe 2340 chrome.exe 2340 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3060 taskmgr.exe Token: SeSystemProfilePrivilege 3060 taskmgr.exe Token: SeCreateGlobalPrivilege 3060 taskmgr.exe Token: SeDebugPrivilege 5056 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5056 wrote to memory of 2160 5056 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe 90 PID 5056 wrote to memory of 2160 5056 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe 90 PID 5056 wrote to memory of 2160 5056 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe 90 PID 5056 wrote to memory of 2160 5056 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe 90 PID 5056 wrote to memory of 2160 5056 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe 90 PID 5056 wrote to memory of 2160 5056 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe 90 PID 2340 wrote to memory of 2032 2340 chrome.exe 93 PID 2340 wrote to memory of 2032 2340 chrome.exe 93 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 884 2340 chrome.exe 96 PID 2340 wrote to memory of 3316 2340 chrome.exe 97 PID 2340 wrote to memory of 3316 2340 chrome.exe 97 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98 PID 2340 wrote to memory of 492 2340 chrome.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe"C:\Users\Admin\AppData\Local\Temp\fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe"C:\Users\Admin\AppData\Local\Temp\fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2160
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3060
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd72134f50,0x7ffd72134f60,0x7ffd72134f702⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1656,12766752701317024813,10307903819266528795,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1604 /prefetch:22⤵PID:884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,12766752701317024813,10307903819266528795,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2024 /prefetch:82⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1656,12766752701317024813,10307903819266528795,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2364 /prefetch:82⤵PID:492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,12766752701317024813,10307903819266528795,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:12⤵PID:4952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,12766752701317024813,10307903819266528795,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:12⤵PID:3988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,12766752701317024813,10307903819266528795,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:12⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,12766752701317024813,10307903819266528795,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4508 /prefetch:82⤵PID:3280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,12766752701317024813,10307903819266528795,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4540 /prefetch:82⤵PID:3200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,12766752701317024813,10307903819266528795,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4780 /prefetch:82⤵PID:1856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,12766752701317024813,10307903819266528795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 /prefetch:82⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,12766752701317024813,10307903819266528795,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4740 /prefetch:82⤵PID:4032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,12766752701317024813,10307903819266528795,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4592 /prefetch:82⤵PID:4800
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4916