Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-08-2024 22:06
Static task
static1
Behavioral task
behavioral1
Sample
27AA8AD8930FA0D076510CFB6573CE74.exe
Resource
win7-20240708-en
General
-
Target
27AA8AD8930FA0D076510CFB6573CE74.exe
-
Size
384KB
-
MD5
27aa8ad8930fa0d076510cfb6573ce74
-
SHA1
26da6ec9efcd8b95c2d744373532afd12d26bf8f
-
SHA256
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d
-
SHA512
bb1af7c9caf9d05e6bf2ebf3ff8fbada74c0e4fbac04759428da3766110b66a8966081b22c0ffc4dc3a141a0914e552a6fc0a766c037c438546e8d4124f5922f
-
SSDEEP
6144:6JHf/OboJwboxHcE2Heo6e+qFCKs7cDZGrBKdt7cWZGbpYByPT7lyvIcbSIvF68U:c3VwboxHc8o6epUVKd9cWvByPHly5WIl
Malware Config
Extracted
nanocore
1.2.2.0
blackangel.hopto.org:54984
f71cda30-fa3d-4402-acaf-cf2c8c816f12
-
activate_away_mode
true
-
backup_connection_host
blackangel.hopto.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-04-20T19:45:18.703376436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54984
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
f71cda30-fa3d-4402-acaf-cf2c8c816f12
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
blackangel.hopto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
microsoft.exemicrosoft.exemicrosoft.exemicrosoft.exepid process 4080 microsoft.exe 3600 microsoft.exe 2916 microsoft.exe 1924 microsoft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
27AA8AD8930FA0D076510CFB6573CE74.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisv.exe" 27AA8AD8930FA0D076510CFB6573CE74.exe -
Processes:
27AA8AD8930FA0D076510CFB6573CE74.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 27AA8AD8930FA0D076510CFB6573CE74.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
27AA8AD8930FA0D076510CFB6573CE74.exemicrosoft.exemicrosoft.exedescription pid process target process PID 3012 set thread context of 4664 3012 27AA8AD8930FA0D076510CFB6573CE74.exe 27AA8AD8930FA0D076510CFB6573CE74.exe PID 4080 set thread context of 3600 4080 microsoft.exe microsoft.exe PID 2916 set thread context of 1924 2916 microsoft.exe microsoft.exe -
Drops file in Program Files directory 2 IoCs
Processes:
27AA8AD8930FA0D076510CFB6573CE74.exedescription ioc process File created C:\Program Files (x86)\DPI Service\dpisv.exe 27AA8AD8930FA0D076510CFB6573CE74.exe File opened for modification C:\Program Files (x86)\DPI Service\dpisv.exe 27AA8AD8930FA0D076510CFB6573CE74.exe -
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
27AA8AD8930FA0D076510CFB6573CE74.exeschtasks.exemicrosoft.execmd.exemicrosoft.execmd.execmd.exemicrosoft.execmd.exemicrosoft.execmd.exeschtasks.execmd.exeschtasks.exe27AA8AD8930FA0D076510CFB6573CE74.execmd.execmd.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27AA8AD8930FA0D076510CFB6573CE74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27AA8AD8930FA0D076510CFB6573CE74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 940 schtasks.exe 2260 schtasks.exe 4452 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
27AA8AD8930FA0D076510CFB6573CE74.exepid process 4664 27AA8AD8930FA0D076510CFB6573CE74.exe 4664 27AA8AD8930FA0D076510CFB6573CE74.exe 4664 27AA8AD8930FA0D076510CFB6573CE74.exe 4664 27AA8AD8930FA0D076510CFB6573CE74.exe 4664 27AA8AD8930FA0D076510CFB6573CE74.exe 4664 27AA8AD8930FA0D076510CFB6573CE74.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
27AA8AD8930FA0D076510CFB6573CE74.exepid process 4664 27AA8AD8930FA0D076510CFB6573CE74.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
27AA8AD8930FA0D076510CFB6573CE74.exedescription pid process Token: SeDebugPrivilege 4664 27AA8AD8930FA0D076510CFB6573CE74.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
27AA8AD8930FA0D076510CFB6573CE74.execmd.exemicrosoft.execmd.exemicrosoft.execmd.exedescription pid process target process PID 3012 wrote to memory of 4664 3012 27AA8AD8930FA0D076510CFB6573CE74.exe 27AA8AD8930FA0D076510CFB6573CE74.exe PID 3012 wrote to memory of 4664 3012 27AA8AD8930FA0D076510CFB6573CE74.exe 27AA8AD8930FA0D076510CFB6573CE74.exe PID 3012 wrote to memory of 4664 3012 27AA8AD8930FA0D076510CFB6573CE74.exe 27AA8AD8930FA0D076510CFB6573CE74.exe PID 3012 wrote to memory of 4664 3012 27AA8AD8930FA0D076510CFB6573CE74.exe 27AA8AD8930FA0D076510CFB6573CE74.exe PID 3012 wrote to memory of 4664 3012 27AA8AD8930FA0D076510CFB6573CE74.exe 27AA8AD8930FA0D076510CFB6573CE74.exe PID 3012 wrote to memory of 4664 3012 27AA8AD8930FA0D076510CFB6573CE74.exe 27AA8AD8930FA0D076510CFB6573CE74.exe PID 3012 wrote to memory of 4664 3012 27AA8AD8930FA0D076510CFB6573CE74.exe 27AA8AD8930FA0D076510CFB6573CE74.exe PID 3012 wrote to memory of 4664 3012 27AA8AD8930FA0D076510CFB6573CE74.exe 27AA8AD8930FA0D076510CFB6573CE74.exe PID 3012 wrote to memory of 5064 3012 27AA8AD8930FA0D076510CFB6573CE74.exe cmd.exe PID 3012 wrote to memory of 5064 3012 27AA8AD8930FA0D076510CFB6573CE74.exe cmd.exe PID 3012 wrote to memory of 5064 3012 27AA8AD8930FA0D076510CFB6573CE74.exe cmd.exe PID 3012 wrote to memory of 3612 3012 27AA8AD8930FA0D076510CFB6573CE74.exe cmd.exe PID 3012 wrote to memory of 3612 3012 27AA8AD8930FA0D076510CFB6573CE74.exe cmd.exe PID 3012 wrote to memory of 3612 3012 27AA8AD8930FA0D076510CFB6573CE74.exe cmd.exe PID 3612 wrote to memory of 940 3612 cmd.exe schtasks.exe PID 3612 wrote to memory of 940 3612 cmd.exe schtasks.exe PID 3612 wrote to memory of 940 3612 cmd.exe schtasks.exe PID 3012 wrote to memory of 4632 3012 27AA8AD8930FA0D076510CFB6573CE74.exe cmd.exe PID 3012 wrote to memory of 4632 3012 27AA8AD8930FA0D076510CFB6573CE74.exe cmd.exe PID 3012 wrote to memory of 4632 3012 27AA8AD8930FA0D076510CFB6573CE74.exe cmd.exe PID 4080 wrote to memory of 3600 4080 microsoft.exe microsoft.exe PID 4080 wrote to memory of 3600 4080 microsoft.exe microsoft.exe PID 4080 wrote to memory of 3600 4080 microsoft.exe microsoft.exe PID 4080 wrote to memory of 3600 4080 microsoft.exe microsoft.exe PID 4080 wrote to memory of 3600 4080 microsoft.exe microsoft.exe PID 4080 wrote to memory of 3600 4080 microsoft.exe microsoft.exe PID 4080 wrote to memory of 3600 4080 microsoft.exe microsoft.exe PID 4080 wrote to memory of 3600 4080 microsoft.exe microsoft.exe PID 4080 wrote to memory of 1068 4080 microsoft.exe cmd.exe PID 4080 wrote to memory of 1068 4080 microsoft.exe cmd.exe PID 4080 wrote to memory of 1068 4080 microsoft.exe cmd.exe PID 4080 wrote to memory of 836 4080 microsoft.exe cmd.exe PID 4080 wrote to memory of 836 4080 microsoft.exe cmd.exe PID 4080 wrote to memory of 836 4080 microsoft.exe cmd.exe PID 836 wrote to memory of 2260 836 cmd.exe schtasks.exe PID 836 wrote to memory of 2260 836 cmd.exe schtasks.exe PID 836 wrote to memory of 2260 836 cmd.exe schtasks.exe PID 4080 wrote to memory of 5088 4080 microsoft.exe cmd.exe PID 4080 wrote to memory of 5088 4080 microsoft.exe cmd.exe PID 4080 wrote to memory of 5088 4080 microsoft.exe cmd.exe PID 2916 wrote to memory of 1924 2916 microsoft.exe microsoft.exe PID 2916 wrote to memory of 1924 2916 microsoft.exe microsoft.exe PID 2916 wrote to memory of 1924 2916 microsoft.exe microsoft.exe PID 2916 wrote to memory of 1924 2916 microsoft.exe microsoft.exe PID 2916 wrote to memory of 1924 2916 microsoft.exe microsoft.exe PID 2916 wrote to memory of 1924 2916 microsoft.exe microsoft.exe PID 2916 wrote to memory of 1924 2916 microsoft.exe microsoft.exe PID 2916 wrote to memory of 1924 2916 microsoft.exe microsoft.exe PID 2916 wrote to memory of 3140 2916 microsoft.exe cmd.exe PID 2916 wrote to memory of 3140 2916 microsoft.exe cmd.exe PID 2916 wrote to memory of 3140 2916 microsoft.exe cmd.exe PID 2916 wrote to memory of 1268 2916 microsoft.exe cmd.exe PID 2916 wrote to memory of 1268 2916 microsoft.exe cmd.exe PID 2916 wrote to memory of 1268 2916 microsoft.exe cmd.exe PID 1268 wrote to memory of 4452 1268 cmd.exe schtasks.exe PID 1268 wrote to memory of 4452 1268 cmd.exe schtasks.exe PID 1268 wrote to memory of 4452 1268 cmd.exe schtasks.exe PID 2916 wrote to memory of 1000 2916 microsoft.exe cmd.exe PID 2916 wrote to memory of 1000 2916 microsoft.exe cmd.exe PID 2916 wrote to memory of 1000 2916 microsoft.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27AA8AD8930FA0D076510CFB6573CE74.exe"C:\Users\Admin\AppData\Local\Temp\27AA8AD8930FA0D076510CFB6573CE74.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\27AA8AD8930FA0D076510CFB6573CE74.exe"C:\Users\Admin\AppData\Local\Temp\27AA8AD8930FA0D076510CFB6573CE74.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\27AA8AD8930FA0D076510CFB6573CE74.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exeC:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exeC:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"2⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\microsoft.exe.logFilesize
520B
MD503febbff58da1d3318c31657d89c8542
SHA1c9e017bd9d0a4fe533795b227c855935d86c2092
SHA2565164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4
SHA5123750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3
-
C:\Users\Admin\AppData\Roaming\Microsoft\microsoft.exeFilesize
384KB
MD527aa8ad8930fa0d076510cfb6573ce74
SHA126da6ec9efcd8b95c2d744373532afd12d26bf8f
SHA25691dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d
SHA512bb1af7c9caf9d05e6bf2ebf3ff8fbada74c0e4fbac04759428da3766110b66a8966081b22c0ffc4dc3a141a0914e552a6fc0a766c037c438546e8d4124f5922f
-
memory/3012-18-0x0000000074B70000-0x0000000075320000-memory.dmpFilesize
7.7MB
-
memory/3012-1-0x00000000008C0000-0x0000000000926000-memory.dmpFilesize
408KB
-
memory/3012-2-0x00000000058A0000-0x0000000005E44000-memory.dmpFilesize
5.6MB
-
memory/3012-3-0x0000000074B70000-0x0000000075320000-memory.dmpFilesize
7.7MB
-
memory/3012-0-0x0000000074B7E000-0x0000000074B7F000-memory.dmpFilesize
4KB
-
memory/4664-21-0x0000000006CA0000-0x0000000006CB2000-memory.dmpFilesize
72KB
-
memory/4664-25-0x0000000006D00000-0x0000000006D0C000-memory.dmpFilesize
48KB
-
memory/4664-9-0x0000000005720000-0x000000000572A000-memory.dmpFilesize
40KB
-
memory/4664-15-0x00000000057A0000-0x00000000057AA000-memory.dmpFilesize
40KB
-
memory/4664-16-0x0000000005980000-0x000000000599E000-memory.dmpFilesize
120KB
-
memory/4664-7-0x0000000074B70000-0x0000000075320000-memory.dmpFilesize
7.7MB
-
memory/4664-17-0x00000000058D0000-0x00000000058DA000-memory.dmpFilesize
40KB
-
memory/4664-6-0x00000000057B0000-0x000000000584C000-memory.dmpFilesize
624KB
-
memory/4664-22-0x0000000006CB0000-0x0000000006CCA000-memory.dmpFilesize
104KB
-
memory/4664-23-0x0000000006CE0000-0x0000000006CEE000-memory.dmpFilesize
56KB
-
memory/4664-24-0x0000000006CF0000-0x0000000006CFE000-memory.dmpFilesize
56KB
-
memory/4664-8-0x0000000074B70000-0x0000000075320000-memory.dmpFilesize
7.7MB
-
memory/4664-26-0x0000000006D10000-0x0000000006D24000-memory.dmpFilesize
80KB
-
memory/4664-27-0x0000000006D20000-0x0000000006D30000-memory.dmpFilesize
64KB
-
memory/4664-28-0x0000000006D30000-0x0000000006D44000-memory.dmpFilesize
80KB
-
memory/4664-29-0x0000000006D60000-0x0000000006D6E000-memory.dmpFilesize
56KB
-
memory/4664-30-0x0000000006D70000-0x0000000006D9E000-memory.dmpFilesize
184KB
-
memory/4664-31-0x0000000006DA0000-0x0000000006DB4000-memory.dmpFilesize
80KB
-
memory/4664-32-0x0000000006F70000-0x0000000006FD6000-memory.dmpFilesize
408KB
-
memory/4664-39-0x0000000074B70000-0x0000000075320000-memory.dmpFilesize
7.7MB
-
memory/4664-40-0x0000000074B70000-0x0000000075320000-memory.dmpFilesize
7.7MB
-
memory/4664-5-0x0000000005670000-0x0000000005702000-memory.dmpFilesize
584KB
-
memory/4664-4-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB