Analysis
-
max time kernel
140s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:21
Static task
static1
Behavioral task
behavioral1
Sample
8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe
Resource
win10v2004-20220812-en
General
-
Target
8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe
-
Size
602KB
-
MD5
4d4e9ca6ea2eafac158ad8dc347468f5
-
SHA1
8ab2790ad786a769b3837855d9d98c82c4fa1c19
-
SHA256
8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5
-
SHA512
81e00726956d196db6abd2abce5a9de9f1e617eeaed11252eba566c6a245f1dc595367fd8e959f2161bb35fafc98b7daaa453209e68e5837726b1f032876f312
-
SSDEEP
12288:hIny5DYTSIro3+iR5ghgnqv9nKqGqrEwtDZ7UgGUG8AGQd:dUTSYoOiugnqvTGIEmlwG
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 1400 installd.exe 2316 nethtsrv.exe 1552 netupdsrv.exe 320 nethtsrv.exe 1848 netupdsrv.exe -
Loads dropped DLL 14 IoCs
Processes:
8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exeinstalld.exenethtsrv.exenethtsrv.exepid process 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe 1400 installd.exe 2316 nethtsrv.exe 2316 nethtsrv.exe 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe 320 nethtsrv.exe 320 nethtsrv.exe 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exedescription ioc process File created C:\Windows\SysWOW64\hfpapi.dll 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe File created C:\Windows\SysWOW64\installd.exe 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe File created C:\Windows\SysWOW64\nethtsrv.exe 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe File created C:\Windows\SysWOW64\netupdsrv.exe 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe File created C:\Windows\SysWOW64\hfnapi.dll 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe -
Drops file in Program Files directory 3 IoCs
Processes:
8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\ver.xml 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe File created C:\Program Files (x86)\Common Files\Config\data.xml 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
Processes:
nethtsrv.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 648 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 320 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3480 wrote to memory of 3268 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe net.exe PID 3480 wrote to memory of 3268 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe net.exe PID 3480 wrote to memory of 3268 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe net.exe PID 3268 wrote to memory of 1780 3268 net.exe net1.exe PID 3268 wrote to memory of 1780 3268 net.exe net1.exe PID 3268 wrote to memory of 1780 3268 net.exe net1.exe PID 3480 wrote to memory of 4964 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe net.exe PID 3480 wrote to memory of 4964 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe net.exe PID 3480 wrote to memory of 4964 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe net.exe PID 4964 wrote to memory of 3596 4964 net.exe net1.exe PID 4964 wrote to memory of 3596 4964 net.exe net1.exe PID 4964 wrote to memory of 3596 4964 net.exe net1.exe PID 3480 wrote to memory of 1400 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe installd.exe PID 3480 wrote to memory of 1400 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe installd.exe PID 3480 wrote to memory of 1400 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe installd.exe PID 3480 wrote to memory of 2316 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe nethtsrv.exe PID 3480 wrote to memory of 2316 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe nethtsrv.exe PID 3480 wrote to memory of 2316 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe nethtsrv.exe PID 3480 wrote to memory of 1552 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe netupdsrv.exe PID 3480 wrote to memory of 1552 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe netupdsrv.exe PID 3480 wrote to memory of 1552 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe netupdsrv.exe PID 3480 wrote to memory of 740 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe net.exe PID 3480 wrote to memory of 740 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe net.exe PID 3480 wrote to memory of 740 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe net.exe PID 740 wrote to memory of 204 740 net.exe net1.exe PID 740 wrote to memory of 204 740 net.exe net1.exe PID 740 wrote to memory of 204 740 net.exe net1.exe PID 3480 wrote to memory of 1532 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe net.exe PID 3480 wrote to memory of 1532 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe net.exe PID 3480 wrote to memory of 1532 3480 8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe net.exe PID 1532 wrote to memory of 4988 1532 net.exe net1.exe PID 1532 wrote to memory of 4988 1532 net.exe net1.exe PID 1532 wrote to memory of 4988 1532 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe"C:\Users\Admin\AppData\Local\Temp\8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1780
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:3596
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:204
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:4988
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:320
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:1848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5b50ef438bc9bd7de27438e06c42129a7
SHA1e69df164ee0a0017053e1d9717e055f5bae7160a
SHA256a31f55698bd16c88b209e9fd40dbc2842b666bd4333c3a22849f78de125a1dfe
SHA5123bc18317db8d0c2c673a1c53226f82aec2179fc225b29f9ae05429abd7a0187f34e205080dcd3005f3735214d1697f5044fdae2e2f8c3d8bce55ff667582e397
-
Filesize
106KB
MD5b50ef438bc9bd7de27438e06c42129a7
SHA1e69df164ee0a0017053e1d9717e055f5bae7160a
SHA256a31f55698bd16c88b209e9fd40dbc2842b666bd4333c3a22849f78de125a1dfe
SHA5123bc18317db8d0c2c673a1c53226f82aec2179fc225b29f9ae05429abd7a0187f34e205080dcd3005f3735214d1697f5044fdae2e2f8c3d8bce55ff667582e397
-
Filesize
106KB
MD5b50ef438bc9bd7de27438e06c42129a7
SHA1e69df164ee0a0017053e1d9717e055f5bae7160a
SHA256a31f55698bd16c88b209e9fd40dbc2842b666bd4333c3a22849f78de125a1dfe
SHA5123bc18317db8d0c2c673a1c53226f82aec2179fc225b29f9ae05429abd7a0187f34e205080dcd3005f3735214d1697f5044fdae2e2f8c3d8bce55ff667582e397
-
Filesize
106KB
MD5b50ef438bc9bd7de27438e06c42129a7
SHA1e69df164ee0a0017053e1d9717e055f5bae7160a
SHA256a31f55698bd16c88b209e9fd40dbc2842b666bd4333c3a22849f78de125a1dfe
SHA5123bc18317db8d0c2c673a1c53226f82aec2179fc225b29f9ae05429abd7a0187f34e205080dcd3005f3735214d1697f5044fdae2e2f8c3d8bce55ff667582e397
-
Filesize
241KB
MD5f919d4f693bb61fbda44505cebef17f2
SHA103b5abe74bb0351ab0e065f235a3ba4c84cef293
SHA2560134e864b966a252af752a15640fbdc0140b32594c35527418e5f973a17746a0
SHA5126762f87208b8007c8a5919ef07dcf1f4f0a5fbc6684018eb0c48ac7cd72b2c7e7630fcb3d89593ba2811a4732cdfaa4dec445ce598858c436605315879dcd718
-
Filesize
241KB
MD5f919d4f693bb61fbda44505cebef17f2
SHA103b5abe74bb0351ab0e065f235a3ba4c84cef293
SHA2560134e864b966a252af752a15640fbdc0140b32594c35527418e5f973a17746a0
SHA5126762f87208b8007c8a5919ef07dcf1f4f0a5fbc6684018eb0c48ac7cd72b2c7e7630fcb3d89593ba2811a4732cdfaa4dec445ce598858c436605315879dcd718
-
Filesize
241KB
MD5f919d4f693bb61fbda44505cebef17f2
SHA103b5abe74bb0351ab0e065f235a3ba4c84cef293
SHA2560134e864b966a252af752a15640fbdc0140b32594c35527418e5f973a17746a0
SHA5126762f87208b8007c8a5919ef07dcf1f4f0a5fbc6684018eb0c48ac7cd72b2c7e7630fcb3d89593ba2811a4732cdfaa4dec445ce598858c436605315879dcd718
-
Filesize
108KB
MD5cb13ad2dd6b031f1393db9332e6f2d9a
SHA18a8decb047293f1a60c46c9931f12d6bfd327a60
SHA256c63782961e18dbfcf10993c1a328e7b9b9d49d96cfa1201c348c790b2f6b76d6
SHA5120f848a3bcc55c1b5886411f597461fc0e440dc017f30442cd07f94ae1c535ec394885c67a1b05c2f9582a054383719ad8f1f49101c2751580af2445d43d8cf8a
-
Filesize
108KB
MD5cb13ad2dd6b031f1393db9332e6f2d9a
SHA18a8decb047293f1a60c46c9931f12d6bfd327a60
SHA256c63782961e18dbfcf10993c1a328e7b9b9d49d96cfa1201c348c790b2f6b76d6
SHA5120f848a3bcc55c1b5886411f597461fc0e440dc017f30442cd07f94ae1c535ec394885c67a1b05c2f9582a054383719ad8f1f49101c2751580af2445d43d8cf8a
-
Filesize
176KB
MD5ddfe3ab72caf337b73f89f6540be0e42
SHA15940a9568c81b71640f6092c158916d492b323a6
SHA25640a87db235ef3548bdab1138de2a89ce5d531f39372006303d1985a8d6c1f9a2
SHA512dc74e955c1f391b9828932681de68edda8a560822545facaf9030f7c41c73538c6232632346246269323a4db76e53e5cbf36a8585b3988bed3e501a1981ea3ed
-
Filesize
176KB
MD5ddfe3ab72caf337b73f89f6540be0e42
SHA15940a9568c81b71640f6092c158916d492b323a6
SHA25640a87db235ef3548bdab1138de2a89ce5d531f39372006303d1985a8d6c1f9a2
SHA512dc74e955c1f391b9828932681de68edda8a560822545facaf9030f7c41c73538c6232632346246269323a4db76e53e5cbf36a8585b3988bed3e501a1981ea3ed
-
Filesize
176KB
MD5ddfe3ab72caf337b73f89f6540be0e42
SHA15940a9568c81b71640f6092c158916d492b323a6
SHA25640a87db235ef3548bdab1138de2a89ce5d531f39372006303d1985a8d6c1f9a2
SHA512dc74e955c1f391b9828932681de68edda8a560822545facaf9030f7c41c73538c6232632346246269323a4db76e53e5cbf36a8585b3988bed3e501a1981ea3ed
-
Filesize
158KB
MD5c739866d589d0a75d2052f476c2a935f
SHA1c6ce49c2a0ce3d19c3cd8e7b54de4b7e7ddc159c
SHA25660992f8d4dcd8432e1b9b1d20dbed611e42e777dded6220f8b0b16922d3cbb41
SHA51253c6390c181f36d4cbb07ff067bab565c6d42f66de436c897e330d0d2971c5d5441e161bd79ae4710f1b8b9a56ac520724d0b7a17a2ac7741147d8312e80b0ab
-
Filesize
158KB
MD5c739866d589d0a75d2052f476c2a935f
SHA1c6ce49c2a0ce3d19c3cd8e7b54de4b7e7ddc159c
SHA25660992f8d4dcd8432e1b9b1d20dbed611e42e777dded6220f8b0b16922d3cbb41
SHA51253c6390c181f36d4cbb07ff067bab565c6d42f66de436c897e330d0d2971c5d5441e161bd79ae4710f1b8b9a56ac520724d0b7a17a2ac7741147d8312e80b0ab
-
Filesize
158KB
MD5c739866d589d0a75d2052f476c2a935f
SHA1c6ce49c2a0ce3d19c3cd8e7b54de4b7e7ddc159c
SHA25660992f8d4dcd8432e1b9b1d20dbed611e42e777dded6220f8b0b16922d3cbb41
SHA51253c6390c181f36d4cbb07ff067bab565c6d42f66de436c897e330d0d2971c5d5441e161bd79ae4710f1b8b9a56ac520724d0b7a17a2ac7741147d8312e80b0ab