Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2023, 20:28
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe
Resource
win7-20230831-en
General
-
Target
NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe
-
Size
279KB
-
MD5
79f7c9976d94b597ef9cec6780cf40c0
-
SHA1
24f774232a3074a891611876600507490f69e3b9
-
SHA256
12c1978f46aacf94582f319bc3379f3bfab041b2519ad5a73e63f8a96943bc16
-
SHA512
693c916f258da870c5507dbf2ac5328e50514fb8bc8571ee9cf04bb621c58b8a2c4bda301c38c139eeda0c0c38f15ab7287844334d52601d8cfc03efdd41db81
-
SSDEEP
6144:m7OQ0l65RAHqjeEnoz5OEKS64y5eUSqX5kdpfkQr7ZBfE9M:m7lRGgdoz5LDsOddkUBc9M
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "3" NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 4284 C8E9.tmp -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/5108-3-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/5108-6-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/2724-17-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/5108-18-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3880-77-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/5108-80-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/5108-156-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/5108-190-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\D5E.exe = "C:\\Program Files (x86)\\LP\\AF4B\\D5E.exe" NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\LP\AF4B\D5E.exe NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe File opened for modification C:\Program Files (x86)\LP\AF4B\C8E9.tmp NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe File created C:\Program Files (x86)\LP\AF4B\D5E.exe NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe -
Modifies registry class 36 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost_ = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2344688013-2965468717-2034126-1000\{ED781B99-00C7-4B86-800C-13DE70C22505} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2344688013-2965468717-2034126-1000\{1D1FAA8E-9987-478A-9E5E-138182156301} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost_ = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2344688013-2965468717-2034126-1000\{1509D2DD-E01F-41AA-8168-B25C909730C6} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost_ = 6801000088020000 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2344688013-2965468717-2034126-1000\{38069656-8AE6-4953-9404-2A57315A366F} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3468 msiexec.exe Token: SeShutdownPrivilege 3432 explorer.exe Token: SeCreatePagefilePrivilege 3432 explorer.exe Token: SeShutdownPrivilege 3432 explorer.exe Token: SeCreatePagefilePrivilege 3432 explorer.exe Token: SeShutdownPrivilege 3432 explorer.exe Token: SeCreatePagefilePrivilege 3432 explorer.exe Token: SeShutdownPrivilege 3432 explorer.exe Token: SeCreatePagefilePrivilege 3432 explorer.exe Token: SeShutdownPrivilege 3432 explorer.exe Token: SeCreatePagefilePrivilege 3432 explorer.exe Token: SeShutdownPrivilege 3432 explorer.exe Token: SeCreatePagefilePrivilege 3432 explorer.exe Token: SeShutdownPrivilege 3432 explorer.exe Token: SeCreatePagefilePrivilege 3432 explorer.exe Token: SeShutdownPrivilege 3432 explorer.exe Token: SeCreatePagefilePrivilege 3432 explorer.exe Token: SeShutdownPrivilege 3432 explorer.exe Token: SeCreatePagefilePrivilege 3432 explorer.exe Token: SeShutdownPrivilege 3432 explorer.exe Token: SeCreatePagefilePrivilege 3432 explorer.exe Token: SeShutdownPrivilege 3432 explorer.exe Token: SeCreatePagefilePrivilege 3432 explorer.exe Token: SeShutdownPrivilege 3432 explorer.exe Token: SeCreatePagefilePrivilege 3432 explorer.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe Token: SeShutdownPrivilege 940 explorer.exe Token: SeCreatePagefilePrivilege 940 explorer.exe Token: SeShutdownPrivilege 940 explorer.exe Token: SeCreatePagefilePrivilege 940 explorer.exe Token: SeShutdownPrivilege 940 explorer.exe Token: SeCreatePagefilePrivilege 940 explorer.exe Token: SeShutdownPrivilege 940 explorer.exe Token: SeCreatePagefilePrivilege 940 explorer.exe Token: SeShutdownPrivilege 940 explorer.exe Token: SeCreatePagefilePrivilege 940 explorer.exe Token: SeShutdownPrivilege 940 explorer.exe Token: SeCreatePagefilePrivilege 940 explorer.exe Token: SeShutdownPrivilege 940 explorer.exe Token: SeCreatePagefilePrivilege 940 explorer.exe Token: SeShutdownPrivilege 940 explorer.exe Token: SeCreatePagefilePrivilege 940 explorer.exe Token: SeShutdownPrivilege 940 explorer.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 2556 explorer.exe 2556 explorer.exe -
Suspicious use of SendNotifyMessage 36 IoCs
pid Process 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 3432 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 2556 explorer.exe 2556 explorer.exe 2556 explorer.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3752 StartMenuExperienceHost.exe 5040 StartMenuExperienceHost.exe 4128 StartMenuExperienceHost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5108 wrote to memory of 2724 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 100 PID 5108 wrote to memory of 2724 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 100 PID 5108 wrote to memory of 2724 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 100 PID 5108 wrote to memory of 3880 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 103 PID 5108 wrote to memory of 3880 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 103 PID 5108 wrote to memory of 3880 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 103 PID 5108 wrote to memory of 4284 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 108 PID 5108 wrote to memory of 4284 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 108 PID 5108 wrote to memory of 4284 5108 NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe 108 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\NEAS.79f7c9976d94b597ef9cec6780cf40c0.exeC:\Users\Admin\AppData\Local\Temp\NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe startC:\Users\Admin\AppData\Roaming\BFFD4\1D8AF.exe%C:\Users\Admin\AppData\Roaming\BFFD42⤵PID:2724
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.79f7c9976d94b597ef9cec6780cf40c0.exeC:\Users\Admin\AppData\Local\Temp\NEAS.79f7c9976d94b597ef9cec6780cf40c0.exe startC:\Program Files (x86)\D44E7\lvvm.exe%C:\Program Files (x86)\D44E72⤵PID:3880
-
-
C:\Program Files (x86)\LP\AF4B\C8E9.tmp"C:\Program Files (x86)\LP\AF4B\C8E9.tmp"2⤵
- Executes dropped EXE
PID:4284
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3468
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3432
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
PID:560
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3752
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:640
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5040
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:940
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\0ff2c81b103b4c1aaee300a030808095 /t 3356 /p 33601⤵PID:1172
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4128
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4956
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2556
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3836
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD5cb853d0e676be7b23903aa89175d8d69
SHA12066462d42c45133df60c5e5f9e8956373d191b0
SHA2567291b34528651c542a4e09036bb828f27c9f75c134d2be3aed3e1c5a0db5fe20
SHA512bf96f4c8511929ef380562004211a72821330465538db6da3367cbce387092384265e0bfd4ab54e62b742d68d668ff1457f43381d7a770fd3027f3bab1f36038
-
Filesize
99KB
MD5cb853d0e676be7b23903aa89175d8d69
SHA12066462d42c45133df60c5e5f9e8956373d191b0
SHA2567291b34528651c542a4e09036bb828f27c9f75c134d2be3aed3e1c5a0db5fe20
SHA512bf96f4c8511929ef380562004211a72821330465538db6da3367cbce387092384265e0bfd4ab54e62b742d68d668ff1457f43381d7a770fd3027f3bab1f36038
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133392355733064044.txt
Filesize75KB
MD562d81c2e1e8b21733f95af2a596e4b18
SHA191c005ecc5ae4171f450c43c02d1ba532b4474c6
SHA256a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6
SHA512c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c
-
Filesize
600B
MD5ba23ef9a0855ead265440ce5fcc4b5e4
SHA1fdc6213fcb4fd64a08d435faf7e94f499683a563
SHA256667b38507243549ad3244b619334eb8b2eb279ba388fba90d47550551413e3a0
SHA51243458a8f1d285b7eeba2e5c65375b5eeef7fe6d949d058b1644cc9845c01362537d8af6cc12b800367bc37e3960291e98da89fa3f9191f8f58c5294d24373d43
-
Filesize
996B
MD5c6f61fdc03d51d9d9475aebe3df0d1e2
SHA1133ddd6facd2deb7d52b3112ded1ec91c0ceb76b
SHA2562bd1fdac674cd95bfc9462a316ba1a606ab47b3cfa3d6216240d9c0e2c4f4c78
SHA512e89762352dad25b933df0cac99f7ca118f28e7f3d67529832b10495048c50242d8da23e2ff88fac5a2bb40557a49f2a87b837a59264b0ca4a8bdd0b2cf034d21