Overview
overview
10Static
static
7AgileDotNe...me.dll
windows7-x64
1AgileDotNe...me.dll
windows10-2004-x64
1ChangeLog.html
windows7-x64
1ChangeLog.html
windows10-2004-x64
1CraxsRat.exe.xml
windows7-x64
1CraxsRat.exe.xml
windows10-2004-x64
1GeoIPCitys.dll
windows7-x64
1GeoIPCitys.dll
windows10-2004-x64
1LiveCharts...ms.dll
windows7-x64
1LiveCharts...ms.dll
windows10-2004-x64
1LiveCharts.Wpf.dll
windows7-x64
1LiveCharts.Wpf.dll
windows10-2004-x64
1LiveCharts.dll
windows7-x64
1LiveCharts.dll
windows10-2004-x64
1MetroSet UI.dll
windows7-x64
1MetroSet UI.dll
windows10-2004-x64
1NAudio.dll
windows7-x64
1NAudio.dll
windows10-2004-x64
1SimplicLoader.exe
windows7-x64
10SimplicLoader.exe
windows10-2004-x64
10System.IO....le.dll
windows7-x64
1System.IO....le.dll
windows10-2004-x64
1Vip.Notification.dll
windows7-x64
1Vip.Notification.dll
windows10-2004-x64
1WinMM.Net.dll
windows7-x64
1WinMM.Net.dll
windows10-2004-x64
1res/GeoIP/GeoIP.dat
windows7-x64
3res/GeoIP/GeoIP.dat
windows10-2004-x64
3Analysis
-
max time kernel
107s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-04-2023 13:16
Behavioral task
behavioral1
Sample
AgileDotNet.VMRuntime.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
AgileDotNet.VMRuntime.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
ChangeLog.html
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
ChangeLog.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
CraxsRat.exe.xml
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
CraxsRat.exe.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
GeoIPCitys.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
GeoIPCitys.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
LiveCharts.WinForms.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
LiveCharts.WinForms.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
LiveCharts.Wpf.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
LiveCharts.Wpf.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
LiveCharts.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
LiveCharts.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
MetroSet UI.dll
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
MetroSet UI.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
NAudio.dll
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
NAudio.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral19
Sample
SimplicLoader.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
SimplicLoader.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
System.IO.Compression.ZipFile.dll
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
System.IO.Compression.ZipFile.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
Vip.Notification.dll
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
Vip.Notification.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
WinMM.Net.dll
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
WinMM.Net.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
res/GeoIP/GeoIP.dat
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
res/GeoIP/GeoIP.dat
Resource
win10v2004-20230220-en
General
-
Target
CraxsRat.exe.xml
-
Size
7KB
-
MD5
dd5a0508827ec5ef25064c18fbd73c79
-
SHA1
32f9a8803107d28418437312fd0e52e564f0f753
-
SHA256
fdd077b07e6edd22678b2a29beee104daffdf56d545bbae1f39c632208a61d74
-
SHA512
6fa7e2407b412e471c42162d460625e17a7dc7b76b0a236db1746645f75cf38806026f1084b254da204ce149e960da1a7897e472c58fe71151435fb94ae012e6
-
SSDEEP
96:ur71tp7K0rjtHyZ90nDP9SbujEBKgFAnuAnznVuupxZAEcHn4abLQAntYIWVv/xb:ur7rp7vrjaHyv
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "389373597" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30aa1c671b79d901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F6FEFB1-E50E-11ED-AAFE-C6F40EA7D53E} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc45899000000000200000000001066000000010000200000000806218b028e07861051a37e98cfd1a425f6a53e2ce79b8f5dda5284c566d163000000000e8000000002000020000000c877d0006dd556e12de08661067f4607959abe72418c65566ff79062e925995620000000346df638e60d155463f5d4328438cdc4b0cd686e255ca04a483a9b5f42251a48400000006dc9246408cdc55f857e9cc8fffdfd3834d04f0fcac0cd4c3dc793fbe8feb455640a1df1d5e23c17019ff5d398f7792a1263bb5e2cf2ee62c846d71cdbe0a3b9 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc458990000000002000000000010660000000100002000000096e857115dd535fe86a0683fe2bb4761247a1750dfe4959c6e5aa5bec6e764ff000000000e800000000200002000000055d466d1142921ae35f4341870b9955e71f90c7baa1fabb55d596fc7e2eb4dd99000000072e43d2fb507d7825cdd6ef9975c49318295598069da04cff829bbb4253f970f8470a8109518885054048bf03e1468a710dec3159f63e57326f80dde3b2d70ca6d641c737231b887c933008db67ec15db9ea894aae7ca6949461f5dfd9f59798062bcfba15d687dface928ce1c1b51ffb4c23bc717940d47de4e398feb36c8070d2fcae193249d51a0493f167846090c400000002fb3cd0cda74f0b60551403fae61b6a7e26b7e55c79d76948c641d30f7ae6d8665d946f54a5f5e7efd7268ec19d74ffef879f7b08a62b1ab9e9c13137f7f1153 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1088 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 1088 IEXPLORE.EXE 1088 IEXPLORE.EXE 1140 IEXPLORE.EXE 1140 IEXPLORE.EXE 1140 IEXPLORE.EXE 1140 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1956 wrote to memory of 1624 1956 MSOXMLED.EXE iexplore.exe PID 1956 wrote to memory of 1624 1956 MSOXMLED.EXE iexplore.exe PID 1956 wrote to memory of 1624 1956 MSOXMLED.EXE iexplore.exe PID 1956 wrote to memory of 1624 1956 MSOXMLED.EXE iexplore.exe PID 1624 wrote to memory of 1088 1624 iexplore.exe IEXPLORE.EXE PID 1624 wrote to memory of 1088 1624 iexplore.exe IEXPLORE.EXE PID 1624 wrote to memory of 1088 1624 iexplore.exe IEXPLORE.EXE PID 1624 wrote to memory of 1088 1624 iexplore.exe IEXPLORE.EXE PID 1088 wrote to memory of 1140 1088 IEXPLORE.EXE IEXPLORE.EXE PID 1088 wrote to memory of 1140 1088 IEXPLORE.EXE IEXPLORE.EXE PID 1088 wrote to memory of 1140 1088 IEXPLORE.EXE IEXPLORE.EXE PID 1088 wrote to memory of 1140 1088 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\CraxsRat.exe.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD501200b5903771b5a72cea12ef541f6e9
SHA176bbbe6e4b1e3d8d7ab40656afcc895ed4ef6b00
SHA256589aec5546ff749e2c4ad9917353b1d1297824a92e8f6cb19169e0928f44ea11
SHA51252b3629903b3457c8edff2616b6b9fe1fe7e24a72467afbef8f55086c7ad1bad573e318a4c2b1ffbc6b04f127365e300e7745301d336c7086776039ba540e22d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50cfa0c2e3f4d2ed5b346b49dfc033b25
SHA19e87560d6288ba338ac4cb42ab01ea01b3a908f6
SHA2566a6a94f3e888b2abe49aa3fbd94c72b77455bf85ded3d3e566c44fe4f1d343ae
SHA51237b316072ec62915fd82f6b3002d8806ffbba407bae0b57e0745b37bde5d65cd8dae167a3d8bfc3b566b07604ad44982005a7ac8f7b0e13370c4dc43f35e9b13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5440ee78cdf830321fbd0b633c0b325eb
SHA17225efe984ea6e73b62642892b01284aa821d3c4
SHA25683fc26d9edfd63988c0a3f19b10db4312691afeb85071018a8f85022e5a52538
SHA5126d995888830f2a954f0538df4b4de84157cb7f728dddc2442c4cbcac2f16abbe5f57055ef3ce8d60dcad8430cb668cdf998cca807d7e80e31904fef8e2076537
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD502a45cf6d6500adf82ed3946d336cbc6
SHA168c8e9ef12338ded7054b07781a44f877830d86b
SHA256226c5cf1af57e573a3aa358f3fd0202de345adfa8d5cec279b58e04a9927ec8a
SHA512558d95fd7fa93100c45f891511145c72647d5d103b75022a4d023e2a6f599bf787c7ad3ec6a7763dd9e1d0851dd9204030156b6f202fd4a2acc9cc11352d328a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5336ca25bf0ee2cb4c2d1167320ec6b56
SHA1a1971430c00a4ca55b6ad2681c7c8cc1f3cd116b
SHA2567b86a8c4f6c33158fe3c0fc68a1cfec0f80f43aab10960d23ba087605449f055
SHA51214bf3e20d60fdac0c621b2f19457d68411c0db81ccd40e0801373fbf168659ca9e259ae16c9edc5add7645fc103f58e4aea10ec8759d86e3a764a7380a6826c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f08c5c4e22068c06a2ba06418b9d52d1
SHA1b828a38378e8569525f3844db739d10439f342aa
SHA256cdfb1b638b21263a736efc60f1791c97a93f1cda9d054b12fe412408b1a06249
SHA512fced2d3c0a4bf5bff51af62688a1dd2fbef8c81d4ed767410438a832f034774d1217970006db376d79b9cfd76031f7be55090b7f2906d7ca05b7fccbc9da4bbb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYXN1WWD\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\Cab741B.tmpFilesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\Local\Temp\Tar7B14.tmpFilesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9BIR3OEM.txtFilesize
608B
MD5d1e8e3902e8ca5ed4845b0ce7a68f9c9
SHA16adcae23c4d93b7ca638579b4f5649a2b83e5e0d
SHA25620ae60259be77e44a819fad3070799508b4f1a2ac50c2c294a40a0afb813ea0f
SHA5124e0f383dcfa7c451c4c6a395074c0c14cb8d210fa970feba8094846bb788063541df3066eb31cdc21f694ca768b525b1c99dfe58e4d596dd1af7bc3d3f744f59