Malware Analysis Report

2024-11-15 08:44

Sample ID 240510-fkr6qscc3t
Target 75552440685c9dc4644df81c7e365370_NeikiAnalytics
SHA256 f079f9374811130ef9b4df4ecb0d7b70cc253c2df7774ddb3f13363797f52124
Tags
pyinstaller zgrat execution rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f079f9374811130ef9b4df4ecb0d7b70cc253c2df7774ddb3f13363797f52124

Threat Level: Known bad

The file 75552440685c9dc4644df81c7e365370_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

pyinstaller zgrat execution rat

ZGRat

Process spawned unexpected child process

Detect ZGRat V1

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Detects Pyinstaller

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Runs ping.exe

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-10 04:56

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 04:56

Reported

2024-05-10 04:58

Platform

win7-20240508-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI16442\python39.dll

MD5 5cd203d356a77646856341a0c9135fc6
SHA1 a1f4ac5cc2f5ecb075b3d0129e620784814a48f7
SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
SHA512 390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 04:56

Reported

2024-05-10 04:58

Platform

win10v2004-20240508-en

Max time kernel

125s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

ZGRat

rat zgrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
File created C:\Program Files\Microsoft Office 15\ClientX64\6cb0b6c459d5d3 C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\debug\9e8d7a4ca61bd9 C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
File created C:\Windows\it-IT\dwm.exe C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
File opened for modification C:\Windows\it-IT\dwm.exe C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
File created C:\Windows\it-IT\6cb0b6c459d5d3 C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
File created C:\Windows\debug\RuntimeBroker.exe C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1328 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe
PID 1328 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe
PID 5032 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 5032 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 4224 wrote to memory of 3236 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.exe
PID 4224 wrote to memory of 3236 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.exe
PID 4224 wrote to memory of 3236 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.exe
PID 3236 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.exe C:\Windows\SysWOW64\WScript.exe
PID 3236 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.exe C:\Windows\SysWOW64\WScript.exe
PID 3236 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.exe C:\Windows\SysWOW64\WScript.exe
PID 5012 wrote to memory of 984 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 984 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 984 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 984 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe
PID 984 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe
PID 3948 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe C:\Windows\System32\cmd.exe
PID 3948 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe C:\Windows\System32\cmd.exe
PID 2700 wrote to memory of 1608 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 2700 wrote to memory of 1608 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 2700 wrote to memory of 2740 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 2700 wrote to memory of 2740 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 2700 wrote to memory of 1928 N/A C:\Windows\System32\cmd.exe C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe
PID 2700 wrote to memory of 1928 N/A C:\Windows\System32\cmd.exe C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c Update.exe

C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.exe

Update.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\gniOKJTyiy2L24587b.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\G8uE6tD633eayRxoVmMQKAQRLRgR.bat" "

C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe

"C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon/msWinruntimebrokercrt.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:8

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\it-IT\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\it-IT\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\it-IT\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\debug\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\debug\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\debug\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msWinruntimebrokercrtm" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Recent\msWinruntimebrokercrt.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msWinruntimebrokercrt" /sc ONLOGON /tr "'C:\Users\Default\Recent\msWinruntimebrokercrt.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msWinruntimebrokercrtm" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Recent\msWinruntimebrokercrt.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\dwm.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\RuntimeBroker.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\msWinruntimebrokercrt.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DYS9JLSQ5I.bat"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe

"C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 142.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 papa1488.hhos.net udp
FI 95.216.74.46:80 papa1488.hhos.net tcp
US 8.8.8.8:53 46.74.216.95.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 169.253.116.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI13282\python39.dll

MD5 5cd203d356a77646856341a0c9135fc6
SHA1 a1f4ac5cc2f5ecb075b3d0129e620784814a48f7
SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
SHA512 390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f

C:\Users\Admin\AppData\Local\Temp\_MEI13282\VCRUNTIME140.dll

MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

C:\Users\Admin\AppData\Local\Temp\_MEI13282\_socket.pyd

MD5 fd1cfe0f0023c5780247f11d8d2802c9
SHA1 5b29a3b4c6edb6fa176077e1f1432e3b0178f2bc
SHA256 258a5f0b4d362b2fed80b24eeabcb3cdd1602e32ff79d87225da6d15106b17a6
SHA512 b304a2e56829a557ec401c6fdda78d6d05b7495a610c1ed793d6b25fc5af891cb2a1581addb27ab5e2a6cb0be24d9678f67b97828015161bc875df9b7b5055ae

C:\Users\Admin\AppData\Local\Temp\_MEI13282\_bz2.pyd

MD5 e91b4f8e1592da26bacaceb542a220a8
SHA1 5459d4c2147fa6db75211c3ec6166b869738bd38
SHA256 20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f
SHA512 cb797fa758c65358e5b0fef739181f6b39e0629758a6f8d5c4bd7dc6422001769a19df0c746724fb2567a58708b18bbd098327bfbdf3378426049b113eb848e9

C:\Users\Admin\AppData\Local\Temp\_MEI13282\_lzma.pyd

MD5 493c33ddf375b394b648c4283b326481
SHA1 59c87ee582ba550f064429cb26ad79622c594f08
SHA256 6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16
SHA512 a4a83f04c7fc321796ce6a932d572dca1ad6ecefd31002320aeaa2453701ed49ef9f0d9ba91c969737565a6512b94fbb0311aee53d355345a03e98f43e6f98b2

C:\Users\Admin\AppData\Local\Temp\_MEI13282\_hashlib.pyd

MD5 7c69cb3cb3182a97e3e9a30d2241ebed
SHA1 1b8754ff57a14c32bcadc330d4880382c7fffc93
SHA256 12a84bacb071b1948a9f751ac8d0653ba71a8f6b217a69fe062608e532065c20
SHA512 96dbabbc6b98d473cbe06dcd296f6c6004c485e57ac5ba10560a377393875192b22df8a7103fe4a22795b8d81b8b0ae14ce7646262f87cb609b9e2590a93169e

C:\Users\Admin\AppData\Local\Temp\_MEI13282\_decimal.pyd

MD5 65287fd87a64bc756867a1afddec9e29
SHA1 cda1db353f81df7a4a818add8f87bca9ac840455
SHA256 df19c2e6ec3145166fa8d206c11db78bc1979a027105c4f21d40410b5082ba34
SHA512 3e3f19cf965b260ffc68e45d5101234e8a957411c076a0d487d307dcfa714a9801cb501224fe7621937aebdf90275f655c8a70dd6675bcfb5374404fda53236f

C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.zip

MD5 c3cda7c747788b44fae029d327ed3e13
SHA1 9bf9da89ec0c5da9ee5e30a2711444dcb930cd85
SHA256 45b919cfb1807ae86bd7cf8f9a6630708a81f7dc9799b5328177e1a25fa0e2cd
SHA512 5cdadc0801568fb7adc9de75eeb75a4f8e1d81297f95318c58229b7b09392ae8d1b88063e712481ff28020e12e9372e1e8049f0ed850142e76531adfbeb9c91f

C:\Users\Admin\AppData\Local\Temp\_MEI13282\unicodedata.pyd

MD5 7af51031368619638cca688a7275db14
SHA1 64e2cc5ac5afe8a65af690047dc03858157e964c
SHA256 7f02a99a23cc3ff63ecb10ba6006e2da7bf685530bad43882ebf90d042b9eeb6
SHA512 fbde24501288ff9b06fc96faff5e7a1849765df239e816774c04a4a6ef54a0c641adf4325bfb116952082d3234baef12288174ad8c18b62407109f29aa5ab326

C:\Users\Admin\AppData\Local\Temp\_MEI13282\select.pyd

MD5 0e3cf5d792a3f543be8bbc186b97a27a
SHA1 50f4c70fce31504c6b746a2c8d9754a16ebc8d5e
SHA256 c7ffae6dc927cf10ac5da08614912bb3ad8fc52aa0ef9bc376d831e72dd74460
SHA512 224b42e05b4dbdf7275ee7c5d3eb190024fc55e22e38bd189c1685efee2a3dd527c6dfcb2feeec525b8d6dc35aded1eac2423ed62bb2599bb6a9ea34e842c340

C:\Users\Admin\AppData\Local\Temp\_MEI13282\libcrypto-1_1.dll

MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

C:\Users\Admin\AppData\Local\Temp\_MEI13282\base_library.zip

MD5 2abe470164e060916c6842da1263e5ad
SHA1 197163bfb26ce54420fa6eba03cf0fa0a5622934
SHA256 151a4c8ea261130b5ae94653e5470ac6fe4663de269c187b2b38d6fccadc1baa
SHA512 01e2c58b24f7d3d7b31df97c6dbe8aee0c0f61f457c78d62830fa954c17dffb74b4e5389ef389926b5ba78f96deb08ad4cd61c9ecea256bf35e0a99cd2366d65

C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.exe

MD5 09a97734007a8bf914a52e703e3fab2a
SHA1 34b65e86de26e0214259cc23594c43d8ae3634dc
SHA256 4c4883f0ee5ad8b71c2256f2ee95c1956b6a47308d8223f82fb5f91d392b29bf
SHA512 ab0542b67d62d55ace25b1e5b0e6a786ef1064fb518e1d45df5e3db80610d030c20c318b4019d4859ac356f7299f1fe609a7638c772f35694b43ecb8f36f579a

C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\gniOKJTyiy2L24587b.vbe

MD5 6e94c3b45fb8800584700c41110ede32
SHA1 d0f84586a043845f8c8f27699ed0bb6f2d65971c
SHA256 3c116f72cbd04239eeea6b4ec789d47c9fe9c946ff9cdc16bd792a9fc55bbde7
SHA512 c3cda3dadd3df7067812139d5598f9fd2d6cd9f7afeab51820a8fbf44d8ab489944cd8e04b73a8391ee043401c06e550bcf79b9892fb520e7ac6bb982b04f516

C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\G8uE6tD633eayRxoVmMQKAQRLRgR.bat

MD5 e24834f7ee8cf79c64bad3c8b584c544
SHA1 cfab87d796f5ea2d859c79b031f27989f5c8db8e
SHA256 396bc8928db2bf0bab219079382ab3d59f2583a520b04733536a06862f937737
SHA512 9c60f85ab02992a7aa33b0804908fe1750fa033ab5d706228095ff8eb2613c1bfb5fb3a50c96ff9ef00de449bd6b49f1de451066787ced637740e1245e424594

C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe

MD5 25e509398197efe59f7f088c75833914
SHA1 3c0482b5e12a1df6f184b43b4f87041140e2d163
SHA256 66d0f44a9c53f8874252142bd6334ab2e3373e42bd4ba9fda3b337f8eb5d1805
SHA512 35eba476c6f013aabefdd192a64bf0b5debf87a7e66ec59b87c083f39cb6a496209ff73e7492432580b581a06ae1ebe1d4de6c225f470f17b371fe1f8c3b8452

memory/3948-44-0x0000000000400000-0x0000000000408000-memory.dmp

memory/3948-45-0x000000001B060000-0x000000001B2F8000-memory.dmp

memory/3948-47-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-85-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-93-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-87-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-83-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-79-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-77-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-75-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-73-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-71-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-81-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-69-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-65-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-61-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-59-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-57-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-53-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-51-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-49-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-46-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-67-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-63-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-55-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-101-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-109-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-107-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-105-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-103-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-99-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-97-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-95-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-91-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-89-0x000000001B060000-0x000000001B2F2000-memory.dmp

memory/3948-3603-0x0000000000BC0000-0x0000000000BCE000-memory.dmp

memory/3948-3605-0x0000000002550000-0x000000000256C000-memory.dmp

memory/3948-3606-0x0000000002700000-0x0000000002750000-memory.dmp

memory/3948-3608-0x0000000002570000-0x0000000002588000-memory.dmp

memory/3948-3610-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

memory/3948-3612-0x0000000000C70000-0x0000000000C7E000-memory.dmp

memory/3948-3614-0x0000000002530000-0x000000000253C000-memory.dmp

memory/3948-3616-0x00000000026D0000-0x00000000026E2000-memory.dmp

memory/3948-3618-0x0000000002540000-0x000000000254C000-memory.dmp

memory/3948-3620-0x0000000002770000-0x0000000002786000-memory.dmp

memory/3948-3622-0x00000000026B0000-0x00000000026BC000-memory.dmp

memory/3948-3624-0x00000000026C0000-0x00000000026CE000-memory.dmp

memory/3948-3626-0x00000000026F0000-0x00000000026FC000-memory.dmp

memory/3948-3628-0x000000001C410000-0x000000001C45E000-memory.dmp

memory/3168-3652-0x0000024A80010000-0x0000024A80032000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_haitpdm5.ogp.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\DYS9JLSQ5I.bat

MD5 99de3325e034d64e5f848bc532ab8757
SHA1 73744b5080d9234dc3e24bd9dd30e1e41397ad5a
SHA256 12a54106c2faff75d0e0ae0f604339c14115b0a37dd0a424f986d8b69560b16a
SHA512 0539438c09dd85837e948408c386e13580b15ba8e84827512480e47bb38e709c765a2330b140e3a1b4a14807eb32d5691ea519fee24774a1467e0e5aeb487ab4

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c