Analysis
-
max time kernel
95s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-06-2022 15:45
Static task
static1
Behavioral task
behavioral1
Sample
ProtonVPN.msi
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
ProtonVPN.msi
Resource
win10v2004-20220414-en
windows10-2004_x64
General
-
Target
ProtonVPN.msi
-
Size
1.5MB
-
MD5
926ec22b8ba727571a2f85148489fd85
-
SHA1
e6cb03d143489f3af01575de4ea917b680109105
-
SHA256
aba77fcc24b7172206eda1a7f47eff0e0f2fe6ad988536d995ab38ee1a28e783
-
SHA512
c1a344377997ebb354d2bf0c916744a28723aa0845a4cb4a6b59eb6be4317f205386628b4a7bba5baba47203a628c843190de64532dc5496c8396a738da8407a
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
X5C2FUk80DDy5JAd.exepid Process 792 X5C2FUk80DDy5JAd.exe -
Loads dropped DLL 5 IoCs
Processes:
MsiExec.exepid Process 1972 MsiExec.exe 1972 MsiExec.exe 1972 MsiExec.exe 1972 MsiExec.exe 1972 MsiExec.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe -
Drops file in Windows directory 10 IoCs
Processes:
DrvInst.exemsiexec.exeEXPAND.EXEdescription ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\6c6e1f.msi msiexec.exe File opened for modification C:\Windows\Installer\6c6e1f.msi msiexec.exe File created C:\Windows\Installer\6c6e20.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI70AE.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE -
Modifies data under HKEY_USERS 43 IoCs
Processes:
DrvInst.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
msiexec.exeX5C2FUk80DDy5JAd.exepid Process 2016 msiexec.exe 2016 msiexec.exe 792 X5C2FUk80DDy5JAd.exe 792 X5C2FUk80DDy5JAd.exe 792 X5C2FUk80DDy5JAd.exe 792 X5C2FUk80DDy5JAd.exe 792 X5C2FUk80DDy5JAd.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid Process Token: SeShutdownPrivilege 1488 msiexec.exe Token: SeIncreaseQuotaPrivilege 1488 msiexec.exe Token: SeRestorePrivilege 2016 msiexec.exe Token: SeTakeOwnershipPrivilege 2016 msiexec.exe Token: SeSecurityPrivilege 2016 msiexec.exe Token: SeCreateTokenPrivilege 1488 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1488 msiexec.exe Token: SeLockMemoryPrivilege 1488 msiexec.exe Token: SeIncreaseQuotaPrivilege 1488 msiexec.exe Token: SeMachineAccountPrivilege 1488 msiexec.exe Token: SeTcbPrivilege 1488 msiexec.exe Token: SeSecurityPrivilege 1488 msiexec.exe Token: SeTakeOwnershipPrivilege 1488 msiexec.exe Token: SeLoadDriverPrivilege 1488 msiexec.exe Token: SeSystemProfilePrivilege 1488 msiexec.exe Token: SeSystemtimePrivilege 1488 msiexec.exe Token: SeProfSingleProcessPrivilege 1488 msiexec.exe Token: SeIncBasePriorityPrivilege 1488 msiexec.exe Token: SeCreatePagefilePrivilege 1488 msiexec.exe Token: SeCreatePermanentPrivilege 1488 msiexec.exe Token: SeBackupPrivilege 1488 msiexec.exe Token: SeRestorePrivilege 1488 msiexec.exe Token: SeShutdownPrivilege 1488 msiexec.exe Token: SeDebugPrivilege 1488 msiexec.exe Token: SeAuditPrivilege 1488 msiexec.exe Token: SeSystemEnvironmentPrivilege 1488 msiexec.exe Token: SeChangeNotifyPrivilege 1488 msiexec.exe Token: SeRemoteShutdownPrivilege 1488 msiexec.exe Token: SeUndockPrivilege 1488 msiexec.exe Token: SeSyncAgentPrivilege 1488 msiexec.exe Token: SeEnableDelegationPrivilege 1488 msiexec.exe Token: SeManageVolumePrivilege 1488 msiexec.exe Token: SeImpersonatePrivilege 1488 msiexec.exe Token: SeCreateGlobalPrivilege 1488 msiexec.exe Token: SeBackupPrivilege 1960 vssvc.exe Token: SeRestorePrivilege 1960 vssvc.exe Token: SeAuditPrivilege 1960 vssvc.exe Token: SeBackupPrivilege 2016 msiexec.exe Token: SeRestorePrivilege 2016 msiexec.exe Token: SeRestorePrivilege 1208 DrvInst.exe Token: SeRestorePrivilege 1208 DrvInst.exe Token: SeRestorePrivilege 1208 DrvInst.exe Token: SeRestorePrivilege 1208 DrvInst.exe Token: SeRestorePrivilege 1208 DrvInst.exe Token: SeRestorePrivilege 1208 DrvInst.exe Token: SeRestorePrivilege 1208 DrvInst.exe Token: SeLoadDriverPrivilege 1208 DrvInst.exe Token: SeLoadDriverPrivilege 1208 DrvInst.exe Token: SeLoadDriverPrivilege 1208 DrvInst.exe Token: SeRestorePrivilege 2016 msiexec.exe Token: SeTakeOwnershipPrivilege 2016 msiexec.exe Token: SeRestorePrivilege 2016 msiexec.exe Token: SeTakeOwnershipPrivilege 2016 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msiexec.exepid Process 1488 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
msiexec.exeMsiExec.exedescription pid Process procid_target PID 2016 wrote to memory of 1972 2016 msiexec.exe 31 PID 2016 wrote to memory of 1972 2016 msiexec.exe 31 PID 2016 wrote to memory of 1972 2016 msiexec.exe 31 PID 2016 wrote to memory of 1972 2016 msiexec.exe 31 PID 2016 wrote to memory of 1972 2016 msiexec.exe 31 PID 2016 wrote to memory of 1972 2016 msiexec.exe 31 PID 2016 wrote to memory of 1972 2016 msiexec.exe 31 PID 1972 wrote to memory of 1376 1972 MsiExec.exe 32 PID 1972 wrote to memory of 1376 1972 MsiExec.exe 32 PID 1972 wrote to memory of 1376 1972 MsiExec.exe 32 PID 1972 wrote to memory of 1376 1972 MsiExec.exe 32 PID 1972 wrote to memory of 1536 1972 MsiExec.exe 34 PID 1972 wrote to memory of 1536 1972 MsiExec.exe 34 PID 1972 wrote to memory of 1536 1972 MsiExec.exe 34 PID 1972 wrote to memory of 1536 1972 MsiExec.exe 34 PID 1972 wrote to memory of 792 1972 MsiExec.exe 36 PID 1972 wrote to memory of 792 1972 MsiExec.exe 36 PID 1972 wrote to memory of 792 1972 MsiExec.exe 36 PID 1972 wrote to memory of 792 1972 MsiExec.exe 36
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ProtonVPN.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1488
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 53C705522E5E5E7D469FC97371D976C12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-28d2a5e3-5e32-47e4-aca0-c69a9d8a7e1b\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:1376
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\MW-28d2a5e3-5e32-47e4-aca0-c69a9d8a7e1b\files\X5C2FUk80DDy5JAd.exe"C:\Users\Admin\AppData\Local\Temp\MW-28d2a5e3-5e32-47e4-aca0-c69a9d8a7e1b\files\X5C2FUk80DDy5JAd.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:792
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000574" "0000000000000584"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1208
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD511983dda7f04b10dde29656cd05e119f
SHA1c43dfb4a404b183cf7b69120224329aa22b598d5
SHA2569a47c85b7508ede06caefc61cfdf5a9f3b757dd64cf41cf7dbe25c72c17b059b
SHA5123ba1821de94ac45dfffe0a868ba2e21de3ce96bf8a1c02fc1be6e19ce638f118f78248c5fb04b33569e59b768d572c7cc7bc280083d4586339a83a4321c7eae8
-
C:\Users\Admin\AppData\Local\Temp\MW-28d2a5e3-5e32-47e4-aca0-c69a9d8a7e1b\files\X5C2FUk80DDy5JAd.exe
Filesize1.6MB
MD5fb0e77955a8b400a73e4156d1d66e860
SHA10eb0910fba5418dffeb59ccf7cff5bb2af4d9ebb
SHA256ab3110124ba23e717a71eedbcf44197b20308efa621118dd4fcc936a8976cdfa
SHA512bad2a0b4b1df892c21085985452bd1bd7a314f697813ae2199c734c3432b1beb23a0039b8629e4ab27c57eb79c6996d6b2d30f33804608e33280f7031f77af12
-
C:\Users\Admin\AppData\Local\Temp\MW-28d2a5e3-5e32-47e4-aca0-c69a9d8a7e1b\files\X5C2FUk80DDy5JAd.exe
Filesize1.6MB
MD5fb0e77955a8b400a73e4156d1d66e860
SHA10eb0910fba5418dffeb59ccf7cff5bb2af4d9ebb
SHA256ab3110124ba23e717a71eedbcf44197b20308efa621118dd4fcc936a8976cdfa
SHA512bad2a0b4b1df892c21085985452bd1bd7a314f697813ae2199c734c3432b1beb23a0039b8629e4ab27c57eb79c6996d6b2d30f33804608e33280f7031f77af12
-
Filesize
1KB
MD51ddbaeddbd8c2eb8223a962ef4936fcc
SHA1fcc74bb7692a8f4124493adb56096337247ef765
SHA2562482ae74e5bfa92d5b17b2d269af3575ade6909b4ae0a9b5a28be9f55ee5ec43
SHA51274a104f9ecc73181aa244af629ca6bacdfb42bbf18a767080242ab23c346cbdf53b802944ba638af290552d92987947c2ec7a5ee074525a3e26fa180c746241f
-
Filesize
208KB
MD54caaa03e0b59ca60a3d34674b732b702
SHA1ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA256d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
SHA51225888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
-
Filesize
1.6MB
MD5fb0e77955a8b400a73e4156d1d66e860
SHA10eb0910fba5418dffeb59ccf7cff5bb2af4d9ebb
SHA256ab3110124ba23e717a71eedbcf44197b20308efa621118dd4fcc936a8976cdfa
SHA512bad2a0b4b1df892c21085985452bd1bd7a314f697813ae2199c734c3432b1beb23a0039b8629e4ab27c57eb79c6996d6b2d30f33804608e33280f7031f77af12
-
Filesize
1.6MB
MD5fb0e77955a8b400a73e4156d1d66e860
SHA10eb0910fba5418dffeb59ccf7cff5bb2af4d9ebb
SHA256ab3110124ba23e717a71eedbcf44197b20308efa621118dd4fcc936a8976cdfa
SHA512bad2a0b4b1df892c21085985452bd1bd7a314f697813ae2199c734c3432b1beb23a0039b8629e4ab27c57eb79c6996d6b2d30f33804608e33280f7031f77af12
-
Filesize
1.6MB
MD5fb0e77955a8b400a73e4156d1d66e860
SHA10eb0910fba5418dffeb59ccf7cff5bb2af4d9ebb
SHA256ab3110124ba23e717a71eedbcf44197b20308efa621118dd4fcc936a8976cdfa
SHA512bad2a0b4b1df892c21085985452bd1bd7a314f697813ae2199c734c3432b1beb23a0039b8629e4ab27c57eb79c6996d6b2d30f33804608e33280f7031f77af12
-
Filesize
1.6MB
MD5fb0e77955a8b400a73e4156d1d66e860
SHA10eb0910fba5418dffeb59ccf7cff5bb2af4d9ebb
SHA256ab3110124ba23e717a71eedbcf44197b20308efa621118dd4fcc936a8976cdfa
SHA512bad2a0b4b1df892c21085985452bd1bd7a314f697813ae2199c734c3432b1beb23a0039b8629e4ab27c57eb79c6996d6b2d30f33804608e33280f7031f77af12
-
Filesize
208KB
MD54caaa03e0b59ca60a3d34674b732b702
SHA1ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA256d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
SHA51225888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34