Analysis
-
max time kernel
39s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:36
Static task
static1
Behavioral task
behavioral1
Sample
3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe
Resource
win10v2004-20220901-en
General
-
Target
3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe
-
Size
558KB
-
MD5
2800cebb15e5415353b7e507a9a1f708
-
SHA1
2b1a9054374de927cc7b2bb0a0692cfab9bbb87f
-
SHA256
3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb
-
SHA512
8530a21efb063b35f30ebbbe6efc6191ed4c2c9763f58d36d470a2bd1e0febedf67c22d5875872ca31c1980ca83b3a4bae678325a01da91ff4dd6f4a66305eee
-
SSDEEP
12288:Y2hB6D0bf1uAbLwOkFLp7d8TwnoN0zS2YXgzQ1yL:4DAf73kvWUoCHzQQ
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 972 installd.exe 380 nethtsrv.exe 1844 netupdsrv.exe 1512 nethtsrv.exe 1604 netupdsrv.exe -
Loads dropped DLL 13 IoCs
Processes:
3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exeinstalld.exenethtsrv.exenethtsrv.exepid process 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe 972 installd.exe 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe 380 nethtsrv.exe 380 nethtsrv.exe 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe 1512 nethtsrv.exe 1512 nethtsrv.exe 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exedescription ioc process File created C:\Windows\SysWOW64\hfnapi.dll 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe File created C:\Windows\SysWOW64\hfpapi.dll 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe File created C:\Windows\SysWOW64\installd.exe 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe File created C:\Windows\SysWOW64\nethtsrv.exe 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe File created C:\Windows\SysWOW64\netupdsrv.exe 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe -
Drops file in Program Files directory 3 IoCs
Processes:
3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exedescription ioc process File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe File created C:\Program Files (x86)\Common Files\Config\data.xml 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 460 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 1512 nethtsrv.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1504 wrote to memory of 1324 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1504 wrote to memory of 1324 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1504 wrote to memory of 1324 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1504 wrote to memory of 1324 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1324 wrote to memory of 1112 1324 net.exe net1.exe PID 1324 wrote to memory of 1112 1324 net.exe net1.exe PID 1324 wrote to memory of 1112 1324 net.exe net1.exe PID 1324 wrote to memory of 1112 1324 net.exe net1.exe PID 1504 wrote to memory of 888 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1504 wrote to memory of 888 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1504 wrote to memory of 888 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1504 wrote to memory of 888 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 888 wrote to memory of 956 888 net.exe net1.exe PID 888 wrote to memory of 956 888 net.exe net1.exe PID 888 wrote to memory of 956 888 net.exe net1.exe PID 888 wrote to memory of 956 888 net.exe net1.exe PID 1504 wrote to memory of 972 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe installd.exe PID 1504 wrote to memory of 972 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe installd.exe PID 1504 wrote to memory of 972 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe installd.exe PID 1504 wrote to memory of 972 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe installd.exe PID 1504 wrote to memory of 972 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe installd.exe PID 1504 wrote to memory of 972 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe installd.exe PID 1504 wrote to memory of 972 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe installd.exe PID 1504 wrote to memory of 380 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe nethtsrv.exe PID 1504 wrote to memory of 380 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe nethtsrv.exe PID 1504 wrote to memory of 380 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe nethtsrv.exe PID 1504 wrote to memory of 380 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe nethtsrv.exe PID 1504 wrote to memory of 1844 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe netupdsrv.exe PID 1504 wrote to memory of 1844 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe netupdsrv.exe PID 1504 wrote to memory of 1844 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe netupdsrv.exe PID 1504 wrote to memory of 1844 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe netupdsrv.exe PID 1504 wrote to memory of 1844 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe netupdsrv.exe PID 1504 wrote to memory of 1844 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe netupdsrv.exe PID 1504 wrote to memory of 1844 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe netupdsrv.exe PID 1504 wrote to memory of 1168 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1504 wrote to memory of 1168 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1504 wrote to memory of 1168 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1504 wrote to memory of 1168 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1168 wrote to memory of 1320 1168 net.exe net1.exe PID 1168 wrote to memory of 1320 1168 net.exe net1.exe PID 1168 wrote to memory of 1320 1168 net.exe net1.exe PID 1168 wrote to memory of 1320 1168 net.exe net1.exe PID 1504 wrote to memory of 364 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1504 wrote to memory of 364 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1504 wrote to memory of 364 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 1504 wrote to memory of 364 1504 3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe net.exe PID 364 wrote to memory of 1676 364 net.exe net1.exe PID 364 wrote to memory of 1676 364 net.exe net1.exe PID 364 wrote to memory of 1676 364 net.exe net1.exe PID 364 wrote to memory of 1676 364 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe"C:\Users\Admin\AppData\Local\Temp\3a8a390e77980138ddee6f2c489bdc99c9e3656b917489bd5d71edaef396babb.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1112
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:956
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1844 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:1320
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:1676
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:1604
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5c9fa7663ff013255fb36c6196f3f4434
SHA1feef1f8e1645aa968af14cb7da2db615e6b97341
SHA2569ad6ac5e53a704db4461c43673863b36eea205cfa80c2210289c9e401ac9b05f
SHA512d45b44f60d2e3a90fe4902e789b0b306ee90490f9b9d8dce6949cff7d507128f2419c465e1f5920048e3540e3a948f11b351568396c777866f870321b66e7e48
-
Filesize
244KB
MD540a9d25fdfdf2831afb55fbdc6700a95
SHA14acfad1db00c3f6c6bb2420e127f29084d97cc47
SHA2562c23fe0778d157120069ecee4d64e9e861f6d85acd601b7646bc7077734ce691
SHA51248fdd86a6df9442a36248706c6824b0e84253c0a341e7bf4575a8ee3253cc06189d1d8cfc523a09d096536013297ab7c3b120daef2c387793dc0b72bade9d0ab
-
Filesize
108KB
MD58b1fe3f49d77f8309441f2488d9600a2
SHA158f650ae688f6483b99cdd468ec79fe9a2c14ad4
SHA256b690ad2281f48a8d22b30d9471933b800a101f5490e6d1ed4844b5725c08c2c3
SHA5120b855a96c82d44871548db0a4fc4bf2f310b377ee359f2d6d3743aa39afc6482bce07087686421046b613955fb890b589c031bc9904c70d4bc1776d9dd7d0da3
-
Filesize
176KB
MD5e5b2e1c468f29101ab634d4938c88027
SHA15e44b564e6a0844918e8528051a91babeff16d7b
SHA25660d60c7edc1fcd7356fddf18d78a97bd47b2ad788e35267c44106cb92ef0dc2f
SHA5123643bc7f52eb9ca4307bd65f438871a7784ce4137353a7367ae4982e7f9e82117a72a3d72de1b6662284fbd7a965de754dfdbb515693a878679ccd8b53929b1c
-
Filesize
176KB
MD5e5b2e1c468f29101ab634d4938c88027
SHA15e44b564e6a0844918e8528051a91babeff16d7b
SHA25660d60c7edc1fcd7356fddf18d78a97bd47b2ad788e35267c44106cb92ef0dc2f
SHA5123643bc7f52eb9ca4307bd65f438871a7784ce4137353a7367ae4982e7f9e82117a72a3d72de1b6662284fbd7a965de754dfdbb515693a878679ccd8b53929b1c
-
Filesize
158KB
MD51564880d91edf0673a4c41304c3e1964
SHA1413333772a5ab5e6fb053d76b77ef6b3fd933f99
SHA2569f759bec75e654057d7e4eee96b7e31a5bcb45f009e404791e43f28ef13e6078
SHA512d43c5dfa03b73058e353a905caf2c81595275cfa64b46cbcb6ed3d1a0f8d81493e6c5eea29f3d6a788c91caa944439b56f51f7eaa23a8d327d6f12b7b61c768e
-
Filesize
158KB
MD51564880d91edf0673a4c41304c3e1964
SHA1413333772a5ab5e6fb053d76b77ef6b3fd933f99
SHA2569f759bec75e654057d7e4eee96b7e31a5bcb45f009e404791e43f28ef13e6078
SHA512d43c5dfa03b73058e353a905caf2c81595275cfa64b46cbcb6ed3d1a0f8d81493e6c5eea29f3d6a788c91caa944439b56f51f7eaa23a8d327d6f12b7b61c768e
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5c9fa7663ff013255fb36c6196f3f4434
SHA1feef1f8e1645aa968af14cb7da2db615e6b97341
SHA2569ad6ac5e53a704db4461c43673863b36eea205cfa80c2210289c9e401ac9b05f
SHA512d45b44f60d2e3a90fe4902e789b0b306ee90490f9b9d8dce6949cff7d507128f2419c465e1f5920048e3540e3a948f11b351568396c777866f870321b66e7e48
-
Filesize
106KB
MD5c9fa7663ff013255fb36c6196f3f4434
SHA1feef1f8e1645aa968af14cb7da2db615e6b97341
SHA2569ad6ac5e53a704db4461c43673863b36eea205cfa80c2210289c9e401ac9b05f
SHA512d45b44f60d2e3a90fe4902e789b0b306ee90490f9b9d8dce6949cff7d507128f2419c465e1f5920048e3540e3a948f11b351568396c777866f870321b66e7e48
-
Filesize
106KB
MD5c9fa7663ff013255fb36c6196f3f4434
SHA1feef1f8e1645aa968af14cb7da2db615e6b97341
SHA2569ad6ac5e53a704db4461c43673863b36eea205cfa80c2210289c9e401ac9b05f
SHA512d45b44f60d2e3a90fe4902e789b0b306ee90490f9b9d8dce6949cff7d507128f2419c465e1f5920048e3540e3a948f11b351568396c777866f870321b66e7e48
-
Filesize
244KB
MD540a9d25fdfdf2831afb55fbdc6700a95
SHA14acfad1db00c3f6c6bb2420e127f29084d97cc47
SHA2562c23fe0778d157120069ecee4d64e9e861f6d85acd601b7646bc7077734ce691
SHA51248fdd86a6df9442a36248706c6824b0e84253c0a341e7bf4575a8ee3253cc06189d1d8cfc523a09d096536013297ab7c3b120daef2c387793dc0b72bade9d0ab
-
Filesize
244KB
MD540a9d25fdfdf2831afb55fbdc6700a95
SHA14acfad1db00c3f6c6bb2420e127f29084d97cc47
SHA2562c23fe0778d157120069ecee4d64e9e861f6d85acd601b7646bc7077734ce691
SHA51248fdd86a6df9442a36248706c6824b0e84253c0a341e7bf4575a8ee3253cc06189d1d8cfc523a09d096536013297ab7c3b120daef2c387793dc0b72bade9d0ab
-
Filesize
108KB
MD58b1fe3f49d77f8309441f2488d9600a2
SHA158f650ae688f6483b99cdd468ec79fe9a2c14ad4
SHA256b690ad2281f48a8d22b30d9471933b800a101f5490e6d1ed4844b5725c08c2c3
SHA5120b855a96c82d44871548db0a4fc4bf2f310b377ee359f2d6d3743aa39afc6482bce07087686421046b613955fb890b589c031bc9904c70d4bc1776d9dd7d0da3
-
Filesize
176KB
MD5e5b2e1c468f29101ab634d4938c88027
SHA15e44b564e6a0844918e8528051a91babeff16d7b
SHA25660d60c7edc1fcd7356fddf18d78a97bd47b2ad788e35267c44106cb92ef0dc2f
SHA5123643bc7f52eb9ca4307bd65f438871a7784ce4137353a7367ae4982e7f9e82117a72a3d72de1b6662284fbd7a965de754dfdbb515693a878679ccd8b53929b1c
-
Filesize
158KB
MD51564880d91edf0673a4c41304c3e1964
SHA1413333772a5ab5e6fb053d76b77ef6b3fd933f99
SHA2569f759bec75e654057d7e4eee96b7e31a5bcb45f009e404791e43f28ef13e6078
SHA512d43c5dfa03b73058e353a905caf2c81595275cfa64b46cbcb6ed3d1a0f8d81493e6c5eea29f3d6a788c91caa944439b56f51f7eaa23a8d327d6f12b7b61c768e