Analysis
-
max time kernel
206s -
max time network
210s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26/08/2022, 06:00
Static task
static1
Behavioral task
behavioral1
Sample
a18b2b6648a6e116fb85974ed5b174eb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a18b2b6648a6e116fb85974ed5b174eb.exe
Resource
win10v2004-20220812-en
General
-
Target
a18b2b6648a6e116fb85974ed5b174eb.exe
-
Size
532KB
-
MD5
a18b2b6648a6e116fb85974ed5b174eb
-
SHA1
2335736ebb5b727dd221adaaf4a6e319d54650c1
-
SHA256
7f69f2fe22dfaa47d7fdb7dd3a78b6feae38ea490dc2b81b7d044cd64836429b
-
SHA512
179c9a08696e37c4d5b46b8e5195edee16d93098f2f400cd4312a2879edc149fb3472b1bb6e50bd3022cd88074950fea369c93a54d25e2d05842add78e9ade9e
-
SSDEEP
12288:J7EaM88A/SFXR2i8u+kkXdXoDzXQfYw4wunnq:lP/KpR2pL5XtoDDQf4bq
Malware Config
Extracted
eternity
http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion
Signatures
-
Detects Eternity clipper 4 IoCs
resource yara_rule behavioral1/files/0x0008000000015622-66.dat eternity_clipper behavioral1/files/0x0008000000015622-68.dat eternity_clipper behavioral1/files/0x0008000000015622-69.dat eternity_clipper behavioral1/memory/1160-72-0x0000000000CD0000-0x0000000000CE0000-memory.dmp eternity_clipper -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Executes dropped EXE 3 IoCs
pid Process 808 Stealer.exe 1160 Clipper.exe 1836 Tor.exe -
Loads dropped DLL 9 IoCs
pid Process 304 a18b2b6648a6e116fb85974ed5b174eb.exe 304 a18b2b6648a6e116fb85974ed5b174eb.exe 1836 Tor.exe 1836 Tor.exe 1836 Tor.exe 1836 Tor.exe 1836 Tor.exe 1836 Tor.exe 1836 Tor.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Stealer.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Stealer.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Stealer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 Stealer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Stealer.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Stealer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Stealer.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2008 PING.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1160 Clipper.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 808 Stealer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 304 a18b2b6648a6e116fb85974ed5b174eb.exe Token: SeDebugPrivilege 1160 Clipper.exe Token: SeDebugPrivilege 808 Stealer.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 304 wrote to memory of 808 304 a18b2b6648a6e116fb85974ed5b174eb.exe 27 PID 304 wrote to memory of 808 304 a18b2b6648a6e116fb85974ed5b174eb.exe 27 PID 304 wrote to memory of 808 304 a18b2b6648a6e116fb85974ed5b174eb.exe 27 PID 304 wrote to memory of 808 304 a18b2b6648a6e116fb85974ed5b174eb.exe 27 PID 304 wrote to memory of 1160 304 a18b2b6648a6e116fb85974ed5b174eb.exe 28 PID 304 wrote to memory of 1160 304 a18b2b6648a6e116fb85974ed5b174eb.exe 28 PID 304 wrote to memory of 1160 304 a18b2b6648a6e116fb85974ed5b174eb.exe 28 PID 304 wrote to memory of 1160 304 a18b2b6648a6e116fb85974ed5b174eb.exe 28 PID 808 wrote to memory of 1968 808 Stealer.exe 30 PID 808 wrote to memory of 1968 808 Stealer.exe 30 PID 808 wrote to memory of 1968 808 Stealer.exe 30 PID 1968 wrote to memory of 1484 1968 cmd.exe 32 PID 1968 wrote to memory of 1484 1968 cmd.exe 32 PID 1968 wrote to memory of 1484 1968 cmd.exe 32 PID 1968 wrote to memory of 468 1968 cmd.exe 33 PID 1968 wrote to memory of 468 1968 cmd.exe 33 PID 1968 wrote to memory of 468 1968 cmd.exe 33 PID 1968 wrote to memory of 824 1968 cmd.exe 34 PID 1968 wrote to memory of 824 1968 cmd.exe 34 PID 1968 wrote to memory of 824 1968 cmd.exe 34 PID 808 wrote to memory of 1836 808 Stealer.exe 35 PID 808 wrote to memory of 1836 808 Stealer.exe 35 PID 808 wrote to memory of 1836 808 Stealer.exe 35 PID 808 wrote to memory of 1836 808 Stealer.exe 35 PID 808 wrote to memory of 1748 808 Stealer.exe 37 PID 808 wrote to memory of 1748 808 Stealer.exe 37 PID 808 wrote to memory of 1748 808 Stealer.exe 37 PID 1748 wrote to memory of 1428 1748 cmd.exe 39 PID 1748 wrote to memory of 1428 1748 cmd.exe 39 PID 1748 wrote to memory of 1428 1748 cmd.exe 39 PID 1748 wrote to memory of 2008 1748 cmd.exe 40 PID 1748 wrote to memory of 2008 1748 cmd.exe 40 PID 1748 wrote to memory of 2008 1748 cmd.exe 40 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Stealer.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Stealer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a18b2b6648a6e116fb85974ed5b174eb.exe"C:\Users\Admin\AppData\Local\Temp\a18b2b6648a6e116fb85974ed5b174eb.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Users\Admin\AppData\Local\Temp\Stealer.exe"C:\Users\Admin\AppData\Local\Temp\Stealer.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:808 -
C:\Windows\system32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:1484
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵PID:468
-
-
C:\Windows\system32\findstr.exefindstr All4⤵PID:824
-
-
-
C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe"C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Stealer.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:1428
-
-
C:\Windows\system32\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:2008
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Clipper.exe"C:\Users\Admin\AppData\Local\Temp\Clipper.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD58ca91deb0b495906ddcb1baf997dedf7
SHA1cdfe17d5ab94cfc7ed67b1ece1013e74be060ef4
SHA256bcb1c93cfd5eae7f95a20b426bec5b7151734a4eba469a1caaf6b8cb665b9890
SHA512b76b633fe9f1ae3f196541b41bcb8ff8d63865b6285c3a3672dc9141269df3d0dde7dc83589d7f69936d772f74a340be6141d30d22b3522c72c1a91b8be1ddec
-
Filesize
38KB
MD58ca91deb0b495906ddcb1baf997dedf7
SHA1cdfe17d5ab94cfc7ed67b1ece1013e74be060ef4
SHA256bcb1c93cfd5eae7f95a20b426bec5b7151734a4eba469a1caaf6b8cb665b9890
SHA512b76b633fe9f1ae3f196541b41bcb8ff8d63865b6285c3a3672dc9141269df3d0dde7dc83589d7f69936d772f74a340be6141d30d22b3522c72c1a91b8be1ddec
-
Filesize
336KB
MD5d1cdefb0ed7a84fdb2aba99ec065d2e2
SHA19cad12bc5214a118e72424b6d7799d362383f8f5
SHA25680b855a33f26827638ffe23996eab1ee83c1582c207c9c76ed7b94856040268e
SHA512a92a29a92e3835b5a9d4325227239b14b18f9e493645d7598178f6f195b28511996bbc615b461b369f1d070cddff1732fd4d1adc8ce646c2aac5e429756a1b3e
-
Filesize
336KB
MD5d1cdefb0ed7a84fdb2aba99ec065d2e2
SHA19cad12bc5214a118e72424b6d7799d362383f8f5
SHA25680b855a33f26827638ffe23996eab1ee83c1582c207c9c76ed7b94856040268e
SHA512a92a29a92e3835b5a9d4325227239b14b18f9e493645d7598178f6f195b28511996bbc615b461b369f1d070cddff1732fd4d1adc8ce646c2aac5e429756a1b3e
-
Filesize
3.5MB
MD53406f79392c47a72bed2f0067b3ce466
SHA1a8e2940d61fc840441c4e2a835959d197929ffdf
SHA256e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d
SHA512930d794aa8715dcd23fafbead7fe2ec95d2863783b4c52279870cad93d5b6cf02ba8a13e2653d2bf731e9882bf63f43a7e44788ce47505346be3fe8e8b872fa4
-
Filesize
1.1MB
MD5a3bf8e33948d94d490d4613441685eee
SHA175ed7f6e2855a497f45b15270c3ad4aed6ad02e2
SHA25691c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585
SHA512c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28
-
Filesize
1.0MB
MD5bd40ff3d0ce8d338a1fe4501cd8e9a09
SHA13aae8c33bf0ec9adf5fbf8a361445969de409b49
SHA256ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c
SHA512404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1
-
Filesize
1.1MB
MD59e3d55fbf890c6cbffd836f2aef4ba31
SHA1715890ba3bda3431470cca4f4bc492c0f63fa138
SHA256e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0
SHA5129848f28fd96c21dd054cbf3e722e56373696c1f7803c137afc7c7203325d9738fa6b984d95cd49ff78a6d95c8f9406f869af3c3783901da3cc003e2b09497d65
-
Filesize
246KB
MD5b77328da7cead5f4623748a70727860d
SHA113b33722c55cca14025b90060e3227db57bf5327
SHA25646541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7
SHA5122f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2
-
Filesize
512KB
MD519d7cc4377f3c09d97c6da06fbabc7dc
SHA13a3ba8f397fb95ed5df22896b2c53a326662fcc9
SHA256228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d
SHA51223711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a
-
Filesize
4.0MB
MD567ab12cf6cabc14588e4f51b21c2134a
SHA132a4ff564f38bf4b62007e419f19c991e60d6e14
SHA256f0aaae0364306bb7a4681d01935c96c2ac76b3576b7982990f86bcaf811a45ba
SHA5122a1c67e9d23d6b050e35c5a8e159309cf598095239406c60a9f721fddc912e21afab7036cbd9f77197cc4241df5f8fa6aa9d7294762659178c6edeb4699d5bec
-
Filesize
121KB
MD56f98da9e33cd6f3dd60950413d3638ac
SHA1e630bdf8cebc165aa81464ff20c1d55272d05675
SHA256219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773
SHA5122983faaf7f47a8f79a38122aa617e65e7deddd19ba9a98b62acf17b48e5308099b852f21aaf8ca6fe11e2cc76c36eed7ffa3307877d4e67b1659fe6e4475205c
-
Filesize
38KB
MD58ca91deb0b495906ddcb1baf997dedf7
SHA1cdfe17d5ab94cfc7ed67b1ece1013e74be060ef4
SHA256bcb1c93cfd5eae7f95a20b426bec5b7151734a4eba469a1caaf6b8cb665b9890
SHA512b76b633fe9f1ae3f196541b41bcb8ff8d63865b6285c3a3672dc9141269df3d0dde7dc83589d7f69936d772f74a340be6141d30d22b3522c72c1a91b8be1ddec
-
Filesize
336KB
MD5d1cdefb0ed7a84fdb2aba99ec065d2e2
SHA19cad12bc5214a118e72424b6d7799d362383f8f5
SHA25680b855a33f26827638ffe23996eab1ee83c1582c207c9c76ed7b94856040268e
SHA512a92a29a92e3835b5a9d4325227239b14b18f9e493645d7598178f6f195b28511996bbc615b461b369f1d070cddff1732fd4d1adc8ce646c2aac5e429756a1b3e
-
Filesize
3.5MB
MD53406f79392c47a72bed2f0067b3ce466
SHA1a8e2940d61fc840441c4e2a835959d197929ffdf
SHA256e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d
SHA512930d794aa8715dcd23fafbead7fe2ec95d2863783b4c52279870cad93d5b6cf02ba8a13e2653d2bf731e9882bf63f43a7e44788ce47505346be3fe8e8b872fa4
-
Filesize
1.1MB
MD5a3bf8e33948d94d490d4613441685eee
SHA175ed7f6e2855a497f45b15270c3ad4aed6ad02e2
SHA25691c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585
SHA512c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28
-
Filesize
1.0MB
MD5bd40ff3d0ce8d338a1fe4501cd8e9a09
SHA13aae8c33bf0ec9adf5fbf8a361445969de409b49
SHA256ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c
SHA512404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1
-
Filesize
1.1MB
MD59e3d55fbf890c6cbffd836f2aef4ba31
SHA1715890ba3bda3431470cca4f4bc492c0f63fa138
SHA256e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0
SHA5129848f28fd96c21dd054cbf3e722e56373696c1f7803c137afc7c7203325d9738fa6b984d95cd49ff78a6d95c8f9406f869af3c3783901da3cc003e2b09497d65
-
Filesize
246KB
MD5b77328da7cead5f4623748a70727860d
SHA113b33722c55cca14025b90060e3227db57bf5327
SHA25646541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7
SHA5122f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2
-
Filesize
512KB
MD519d7cc4377f3c09d97c6da06fbabc7dc
SHA13a3ba8f397fb95ed5df22896b2c53a326662fcc9
SHA256228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d
SHA51223711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a
-
Filesize
121KB
MD56f98da9e33cd6f3dd60950413d3638ac
SHA1e630bdf8cebc165aa81464ff20c1d55272d05675
SHA256219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773
SHA5122983faaf7f47a8f79a38122aa617e65e7deddd19ba9a98b62acf17b48e5308099b852f21aaf8ca6fe11e2cc76c36eed7ffa3307877d4e67b1659fe6e4475205c