Analysis
-
max time kernel
153s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:07
Static task
static1
Behavioral task
behavioral1
Sample
f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe
Resource
win10v2004-20221111-en
General
-
Target
f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe
-
Size
602KB
-
MD5
20ce4a86afb98801345f54571fb600ef
-
SHA1
f9f0d7af5409f23b8db54a35c8592d8ba1a7fd57
-
SHA256
f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d
-
SHA512
cff987d494e238ff840d7be733aad4ab6107c155894e90daa32e0f3254021743029b71f15ccd77435957805a24954bb7bc9056852fe0451d40e2c89dace62c71
-
SSDEEP
12288:NIny5DYTgG4uGWuCFKrDmw+Klil2idTJQVvC56i//+OMFGBa:ZUTgG4TCFgSwv+RpJQ+duG
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 2708 installd.exe 3180 nethtsrv.exe 1104 netupdsrv.exe 3060 nethtsrv.exe 3712 netupdsrv.exe -
Loads dropped DLL 14 IoCs
Processes:
f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exeinstalld.exenethtsrv.exenethtsrv.exepid process 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe 2708 installd.exe 3180 nethtsrv.exe 3180 nethtsrv.exe 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe 3060 nethtsrv.exe 3060 nethtsrv.exe 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exedescription ioc process File created C:\Windows\SysWOW64\installd.exe f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe File created C:\Windows\SysWOW64\nethtsrv.exe f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe File created C:\Windows\SysWOW64\netupdsrv.exe f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe File created C:\Windows\SysWOW64\hfnapi.dll f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe File created C:\Windows\SysWOW64\hfpapi.dll f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe -
Drops file in Program Files directory 3 IoCs
Processes:
f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\data.xml f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
Processes:
nethtsrv.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 664 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 3060 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exenet.exenet.exenet.exenet.exedescription pid process target process PID 4612 wrote to memory of 4752 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe net.exe PID 4612 wrote to memory of 4752 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe net.exe PID 4612 wrote to memory of 4752 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe net.exe PID 4752 wrote to memory of 4284 4752 net.exe net1.exe PID 4752 wrote to memory of 4284 4752 net.exe net1.exe PID 4752 wrote to memory of 4284 4752 net.exe net1.exe PID 4612 wrote to memory of 4304 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe net.exe PID 4612 wrote to memory of 4304 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe net.exe PID 4612 wrote to memory of 4304 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe net.exe PID 4304 wrote to memory of 4056 4304 net.exe net1.exe PID 4304 wrote to memory of 4056 4304 net.exe net1.exe PID 4304 wrote to memory of 4056 4304 net.exe net1.exe PID 4612 wrote to memory of 2708 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe installd.exe PID 4612 wrote to memory of 2708 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe installd.exe PID 4612 wrote to memory of 2708 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe installd.exe PID 4612 wrote to memory of 3180 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe nethtsrv.exe PID 4612 wrote to memory of 3180 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe nethtsrv.exe PID 4612 wrote to memory of 3180 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe nethtsrv.exe PID 4612 wrote to memory of 1104 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe netupdsrv.exe PID 4612 wrote to memory of 1104 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe netupdsrv.exe PID 4612 wrote to memory of 1104 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe netupdsrv.exe PID 4612 wrote to memory of 2616 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe net.exe PID 4612 wrote to memory of 2616 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe net.exe PID 4612 wrote to memory of 2616 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe net.exe PID 2616 wrote to memory of 3912 2616 net.exe net1.exe PID 2616 wrote to memory of 3912 2616 net.exe net1.exe PID 2616 wrote to memory of 3912 2616 net.exe net1.exe PID 4612 wrote to memory of 4052 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe net.exe PID 4612 wrote to memory of 4052 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe net.exe PID 4612 wrote to memory of 4052 4612 f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe net.exe PID 4052 wrote to memory of 3132 4052 net.exe net1.exe PID 4052 wrote to memory of 3132 4052 net.exe net1.exe PID 4052 wrote to memory of 3132 4052 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe"C:\Users\Admin\AppData\Local\Temp\f2a161b3417f9387a3e85d017b0960f7e4076dfbd21938a97793070e5603797d.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:4284
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:4056
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3180 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1104 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:3912
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:3132
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:3712
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5db24058d72e0eeaef87ba677fa2d2f1a
SHA1119694c53424dc692f43c1e9bd4a1c2c7b47fbbe
SHA2565d4690540e94778685e187c209b2d01f029c6f093350ca0417e27587bebfe27e
SHA512bd71c2663734a047fa1b3b18228367817287bb5835cc87995dc42d59afddfbc446690dc3ac5603b41de8a69cdd99f82431c6a22bc57113e66afe9967cb7724e3
-
Filesize
106KB
MD5db24058d72e0eeaef87ba677fa2d2f1a
SHA1119694c53424dc692f43c1e9bd4a1c2c7b47fbbe
SHA2565d4690540e94778685e187c209b2d01f029c6f093350ca0417e27587bebfe27e
SHA512bd71c2663734a047fa1b3b18228367817287bb5835cc87995dc42d59afddfbc446690dc3ac5603b41de8a69cdd99f82431c6a22bc57113e66afe9967cb7724e3
-
Filesize
106KB
MD5db24058d72e0eeaef87ba677fa2d2f1a
SHA1119694c53424dc692f43c1e9bd4a1c2c7b47fbbe
SHA2565d4690540e94778685e187c209b2d01f029c6f093350ca0417e27587bebfe27e
SHA512bd71c2663734a047fa1b3b18228367817287bb5835cc87995dc42d59afddfbc446690dc3ac5603b41de8a69cdd99f82431c6a22bc57113e66afe9967cb7724e3
-
Filesize
106KB
MD5db24058d72e0eeaef87ba677fa2d2f1a
SHA1119694c53424dc692f43c1e9bd4a1c2c7b47fbbe
SHA2565d4690540e94778685e187c209b2d01f029c6f093350ca0417e27587bebfe27e
SHA512bd71c2663734a047fa1b3b18228367817287bb5835cc87995dc42d59afddfbc446690dc3ac5603b41de8a69cdd99f82431c6a22bc57113e66afe9967cb7724e3
-
Filesize
241KB
MD53eb0f9ad45f261f4a01b850ec1f9207c
SHA1f8c3ff454382d436b1420c33df8d042bc590ea39
SHA2568251587631d93725bff137320222ac72702f12ff2ce4a91f5ae6a03c2ddca5a9
SHA51269f24109001139996562177435db6a789d5ec8f3fb0f7bb5e0d5aef8a693b69f6eb9e340cb4ec584c04c8deacce6a3a04461a8424c1f6fccec1c019493c602b5
-
Filesize
241KB
MD53eb0f9ad45f261f4a01b850ec1f9207c
SHA1f8c3ff454382d436b1420c33df8d042bc590ea39
SHA2568251587631d93725bff137320222ac72702f12ff2ce4a91f5ae6a03c2ddca5a9
SHA51269f24109001139996562177435db6a789d5ec8f3fb0f7bb5e0d5aef8a693b69f6eb9e340cb4ec584c04c8deacce6a3a04461a8424c1f6fccec1c019493c602b5
-
Filesize
241KB
MD53eb0f9ad45f261f4a01b850ec1f9207c
SHA1f8c3ff454382d436b1420c33df8d042bc590ea39
SHA2568251587631d93725bff137320222ac72702f12ff2ce4a91f5ae6a03c2ddca5a9
SHA51269f24109001139996562177435db6a789d5ec8f3fb0f7bb5e0d5aef8a693b69f6eb9e340cb4ec584c04c8deacce6a3a04461a8424c1f6fccec1c019493c602b5
-
Filesize
108KB
MD5e858852b382aaf8f58d3c2939be83905
SHA171950b9514b2c541d10072ce9af3e9a50f29f347
SHA2569d50518d9c70b5703a1af0e8c7a2bb2781dcc09ef46511ca07d6ac216e9817e4
SHA51200a5f5434e296a817b581333a7ed747f26bb997e2b83e32ad4a3cc967a36acd30b71456c8f39420461fb5b189f36940611b5c66fcd160a378df74c5cf472a5f4
-
Filesize
108KB
MD5e858852b382aaf8f58d3c2939be83905
SHA171950b9514b2c541d10072ce9af3e9a50f29f347
SHA2569d50518d9c70b5703a1af0e8c7a2bb2781dcc09ef46511ca07d6ac216e9817e4
SHA51200a5f5434e296a817b581333a7ed747f26bb997e2b83e32ad4a3cc967a36acd30b71456c8f39420461fb5b189f36940611b5c66fcd160a378df74c5cf472a5f4
-
Filesize
176KB
MD52b10e0d55498f5b24aafe94ba188c62d
SHA14b2b403b39671e97c3b3cccd508bdc81ecd64fbc
SHA256b600feea261d5dcd9df8b0eaf64a444fe3a924b091ab604932c798e5742ec504
SHA51202af30c2397aadb15aaf92b3a7bbe01fef505180e188917a5baf321f59a56c8f041ac141b52f3539857c88a1cd71409b1643b11cce7c478eb3d9783d747d3978
-
Filesize
176KB
MD52b10e0d55498f5b24aafe94ba188c62d
SHA14b2b403b39671e97c3b3cccd508bdc81ecd64fbc
SHA256b600feea261d5dcd9df8b0eaf64a444fe3a924b091ab604932c798e5742ec504
SHA51202af30c2397aadb15aaf92b3a7bbe01fef505180e188917a5baf321f59a56c8f041ac141b52f3539857c88a1cd71409b1643b11cce7c478eb3d9783d747d3978
-
Filesize
176KB
MD52b10e0d55498f5b24aafe94ba188c62d
SHA14b2b403b39671e97c3b3cccd508bdc81ecd64fbc
SHA256b600feea261d5dcd9df8b0eaf64a444fe3a924b091ab604932c798e5742ec504
SHA51202af30c2397aadb15aaf92b3a7bbe01fef505180e188917a5baf321f59a56c8f041ac141b52f3539857c88a1cd71409b1643b11cce7c478eb3d9783d747d3978
-
Filesize
158KB
MD5662fb4524f4424e362cb87740a3d1423
SHA1073bccffe281dd8b4f000845d60fc4c4d888648f
SHA256512cef1680f79ac0e37578b2b7630ea54a2edbdfb4bd80f2dfe587d9326feb21
SHA512158c5e3bab0d0d536446defc77cf1e449765f5644bf63dfd8eb41e250d9d7ca03a895121b90a79975388842eae740d231a1b2005ffc90d934b2eed433177092b
-
Filesize
158KB
MD5662fb4524f4424e362cb87740a3d1423
SHA1073bccffe281dd8b4f000845d60fc4c4d888648f
SHA256512cef1680f79ac0e37578b2b7630ea54a2edbdfb4bd80f2dfe587d9326feb21
SHA512158c5e3bab0d0d536446defc77cf1e449765f5644bf63dfd8eb41e250d9d7ca03a895121b90a79975388842eae740d231a1b2005ffc90d934b2eed433177092b
-
Filesize
158KB
MD5662fb4524f4424e362cb87740a3d1423
SHA1073bccffe281dd8b4f000845d60fc4c4d888648f
SHA256512cef1680f79ac0e37578b2b7630ea54a2edbdfb4bd80f2dfe587d9326feb21
SHA512158c5e3bab0d0d536446defc77cf1e449765f5644bf63dfd8eb41e250d9d7ca03a895121b90a79975388842eae740d231a1b2005ffc90d934b2eed433177092b