Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-10-2022 16:00
Static task
static1
Behavioral task
behavioral1
Sample
e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
General
-
Target
e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe
-
Size
16.1MB
-
MD5
9d2f493c94e4f454a657e0189bf2cccb
-
SHA1
8951c86bab48477b5996d65602e21fa9c72bf0e2
-
SHA256
e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df
-
SHA512
46f3e989a89e5a83a4b2133c5e9e16ea83cf87808dce4d9d770c1dd87ea3887beabc4e506973e9ed82d5b151d0702989d76d6081f90316134eaa715ab724a4ad
-
SSDEEP
393216:LAnF0gSwwQHg8TPUQfJXZ7JwD2nOMI9ZHA7:EnFjksJXZsMIH6
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kaspersky.exe e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kaspersky.exe e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\autorun.inf cmd.exe File created C:\Users\Admin\AppData\Local\Temp\autorun.inf cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\autorun.inf cmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEES.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\OARPMANR.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1XTOR.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msdaprst.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdaps.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msdfmap.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODDBS.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\pidgenx.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadco.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEODBCI.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\CsiSoap.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\IACOM2.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPWEC.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEINTL.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado15.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msjro.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdasc.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\penusa.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\penjpn.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEREP.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\oledb32.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\InkObj.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\WISC30.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSETUP.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadce.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EURO\MSOEURO.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\hxds.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEWSS.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\MSMAPI\1033\MSMAPI32.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\EEINTL.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\penchs.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\wab32.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\sqlxmlx.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\USP10.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msxactps.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadcfr.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\DirectDB.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\oledb32r.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPERSON.DLL e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1284 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe Token: SeDebugPrivilege 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe Token: SeBackupPrivilege 2008 vssvc.exe Token: SeRestorePrivilege 2008 vssvc.exe Token: SeAuditPrivilege 2008 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2000 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 27 PID 2012 wrote to memory of 2000 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 27 PID 2012 wrote to memory of 2000 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 27 PID 2012 wrote to memory of 2000 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 27 PID 2000 wrote to memory of 1284 2000 cmd.exe 29 PID 2000 wrote to memory of 1284 2000 cmd.exe 29 PID 2000 wrote to memory of 1284 2000 cmd.exe 29 PID 2000 wrote to memory of 1284 2000 cmd.exe 29 PID 2012 wrote to memory of 1128 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 31 PID 2012 wrote to memory of 1128 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 31 PID 2012 wrote to memory of 1128 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 31 PID 2012 wrote to memory of 1128 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 31 PID 2012 wrote to memory of 1556 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 33 PID 2012 wrote to memory of 1556 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 33 PID 2012 wrote to memory of 1556 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 33 PID 2012 wrote to memory of 1556 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 33 PID 2012 wrote to memory of 1548 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 35 PID 2012 wrote to memory of 1548 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 35 PID 2012 wrote to memory of 1548 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 35 PID 2012 wrote to memory of 1548 2012 e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe"C:\Users\Admin\AppData\Local\Temp\e62a2f4c6b627c8a95b3260ea2871b9ca98f538842ae51e5e45ead45ec02d6df.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet && wmic shadowcopy delete2⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1284
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ^[autorun^] >autorun.inf2⤵
- Drops autorun.inf file
PID:1128
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ^open^=KasperskyScan^.exe >>autorun.inf2⤵
- Drops autorun.inf file
PID:1556
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ^execute=^KasperskyScan^.exe >>autorun.inf2⤵
- Drops autorun.inf file
PID:1548
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37B
MD53883f693b2911e7b9cabaf1d89601ebd
SHA1a733bc5b66e5b7beb1ab54ce430ff16cdb935fcb
SHA256747ea7ec54ee0bc9b637867de0c451df65c840f757988f5a3b6e3fe6c73ab1b6
SHA51241fb0555004f392f2c67fd7675d2aea2a7a28a4f51d92237fdaff2d60624c559a5401335887b66f49a721dff669f8f9bd150fde0afe0845eb366309ca1088a98
-
Filesize
65B
MD5fbefa88e6b51c05dd63d97dfdbeb3589
SHA167e09918d878c6615befab5dc9194439027f268d
SHA2563861acedffd29452d2fdb96728f7347652bde9353915d3873a7414843f49b8b1
SHA51258f8c1a64f2eb21be7b96db335d1ade0ce0878566a8386b3689b650132ca28e14761b20fdfe50f2af9915dff2bdd3a5b07f6f3ed082e4e6998ec5f0cd052f12f
-
Filesize
65B
MD5fbefa88e6b51c05dd63d97dfdbeb3589
SHA167e09918d878c6615befab5dc9194439027f268d
SHA2563861acedffd29452d2fdb96728f7347652bde9353915d3873a7414843f49b8b1
SHA51258f8c1a64f2eb21be7b96db335d1ade0ce0878566a8386b3689b650132ca28e14761b20fdfe50f2af9915dff2bdd3a5b07f6f3ed082e4e6998ec5f0cd052f12f