Overview
overview
10Static
static
76a41f27d45...bf.apk
android-9-x86
106a41f27d45...bf.apk
android-10-x64
106a41f27d45...bf.apk
android-11-x64
10callout_11_shadow.xml
windows7-x64
1callout_11_shadow.xml
windows10-2004-x64
3callout_7_overlay.xml
windows7-x64
1callout_7_overlay.xml
windows10-2004-x64
3callout_8_overlay.xml
windows7-x64
1callout_8_overlay.xml
windows10-2004-x64
3callout_cloud.xml
windows7-x64
1callout_cloud.xml
windows10-2004-x64
3callout_de...le.xml
windows7-x64
1callout_de...le.xml
windows10-2004-x64
3callout_shape_2.xml
windows7-x64
1callout_shape_2.xml
windows10-2004-x64
3callout_shape_4.xml
windows7-x64
1callout_shape_4.xml
windows10-2004-x64
3callout_shape_5.xml
windows7-x64
1callout_shape_5.xml
windows10-2004-x64
3callout_shape_6.xml
windows7-x64
1callout_shape_6.xml
windows10-2004-x64
3closebutton.html
windows7-x64
1closebutton.html
windows10-2004-x64
1core_wrapper.js
windows7-x64
1core_wrapper.js
windows10-2004-x64
1help.htm
windows7-x64
1help.htm
windows10-2004-x64
1help_cs.htm
windows7-x64
1help_cs.htm
windows10-2004-x64
1help_de.htm
windows7-x64
1help_de.htm
windows10-2004-x64
1help_es.htm
windows7-x64
1Analysis
-
max time kernel
134s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
26-08-2023 22:04
Static task
static1
Behavioral task
behavioral1
Sample
6a41f27d45308f281b986b4dfed2989781a0b69cbf069bc84f28e333b56d6dbf.apk
Resource
android-x86-arm-20230824-en
Behavioral task
behavioral2
Sample
6a41f27d45308f281b986b4dfed2989781a0b69cbf069bc84f28e333b56d6dbf.apk
Resource
android-x64-20230824-en
Behavioral task
behavioral3
Sample
6a41f27d45308f281b986b4dfed2989781a0b69cbf069bc84f28e333b56d6dbf.apk
Resource
android-x64-arm64-20230824-en
Behavioral task
behavioral4
Sample
callout_11_shadow.xml
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
callout_11_shadow.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
callout_7_overlay.xml
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
callout_7_overlay.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
callout_8_overlay.xml
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
callout_8_overlay.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
callout_cloud.xml
Resource
win7-20230712-en
Behavioral task
behavioral11
Sample
callout_cloud.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
callout_dest_bubble.xml
Resource
win7-20230712-en
Behavioral task
behavioral13
Sample
callout_dest_bubble.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
callout_shape_2.xml
Resource
win7-20230712-en
Behavioral task
behavioral15
Sample
callout_shape_2.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
callout_shape_4.xml
Resource
win7-20230712-en
Behavioral task
behavioral17
Sample
callout_shape_4.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
callout_shape_5.xml
Resource
win7-20230712-en
Behavioral task
behavioral19
Sample
callout_shape_5.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
callout_shape_6.xml
Resource
win7-20230712-en
Behavioral task
behavioral21
Sample
callout_shape_6.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral22
Sample
closebutton.html
Resource
win7-20230712-en
Behavioral task
behavioral23
Sample
closebutton.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
core_wrapper.js
Resource
win7-20230712-en
Behavioral task
behavioral25
Sample
core_wrapper.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
help.htm
Resource
win7-20230712-en
Behavioral task
behavioral27
Sample
help.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral28
Sample
help_cs.htm
Resource
win7-20230712-en
Behavioral task
behavioral29
Sample
help_cs.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral30
Sample
help_de.htm
Resource
win7-20230712-en
Behavioral task
behavioral31
Sample
help_de.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral32
Sample
help_es.htm
Resource
win7-20230712-en
General
-
Target
help_de.htm
-
Size
60KB
-
MD5
be9c03c0d46795b87dea0f7555274b4c
-
SHA1
51ed992061218f7cfebdd1a73412db4bf733634b
-
SHA256
407eaf294879c0423363f5220aceaa31078306035324254d4eb667f0331b4cb6
-
SHA512
f809287a14f9a5eec9de0b48af9c4629aa9fe4ef27b951fc82de721d0050750db63adf132cad69e7d9d6dab4f52907f506b9f1bb402da7ddf0394b9eb23d3604
-
SSDEEP
1536:28JNMFKvYrpZc3webMrWbesDyKjhCDwE4g:2WNEKweUsDywCT/
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399249437" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1D250D1-445C-11EE-B4FD-CA145D9C6258} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd69000000000200000000001066000000010000200000004659d2446ded75723426338aaa79bc151274193379a6a14635d665a574030fe9000000000e8000000002000020000000940a008859a15da7c1c196cf2968babe0df7aebf84d963fb200e7ff5c81025e490000000c004bd73d2beb0f2f309b2244ed0a68f1631542b01a195983b904b35a5e133ad8d9b44ee142f6e21db9c2cb60182d59400414951dca09f7f2104a70c1f29080a082bc144b45a707020944d108cd8ce04195cfdc78c4c47c24a8cd1755dcba772ae2b3120f1c74ae68f537cbb84eef6e16fe192520abcede4c58eaf54025d4cb30f62d87ee72019a467694a78e34e16b9400000007556554d96f8fb4bb31522113da2ff834fe68b2703a1c647f703370f8b37fe99b93197a55b8f49e9ebebb597ed679d1ebe355628290f06f328cb9bbf3365e1d9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd69000000000200000000001066000000010000200000002f1c1cd88364a3ef6e2e8fee8a263c4b819bd3f4b7e4e6b52b64e1369d7fa42b000000000e8000000002000020000000552edc1f4d74407f84308d2e842e117b7af3cba4bb87eb8d010586e50275beb120000000de0e5854c355fc84514d1380ef14cbe548a3e9cfd719ef8b14e5df8870c7228f40000000ba833faa5c53949448ac3ffa156fe1c4b1297298f88575b20057aada04dbc3ecc53e25030639d407266ac7219e2cb487dee54e42e886e84610d8f2bd7a2e938a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f084269769d8d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2580 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2580 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2580 iexplore.exe 2580 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2580 wrote to memory of 3024 2580 iexplore.exe 28 PID 2580 wrote to memory of 3024 2580 iexplore.exe 28 PID 2580 wrote to memory of 3024 2580 iexplore.exe 28 PID 2580 wrote to memory of 3024 2580 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\help_de.htm1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD50d3f223b73b1e0bc7427b6d5c4022210
SHA10c5a7e1c4b8e63e92ba811018febd5d42a3fd54f
SHA256237c89f04a2cb64c367527ef7db17d24c1db2a2576a82c7e1a0129cf7e0b98cd
SHA512f9147bda78bd85792d79a1beeeb10e8c5b7b5ca7e719ff793a5860f0e439488ec0dd94e41cb8f78981b4f83625b10b5a0d44b08fa90936cae96fc230030d1265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5963b6df754e61c4d2c423c1ed6d4fee0
SHA12ae3aaaee20a0d4db293720e98012ceb82d13605
SHA256f6926fe1c4c8904fb827d5856ac252eb19efe1bc7d0e4bbfd05b8b0737117ff4
SHA512e894529057f515c467f663ddb07f95cede068776d9464c1bc837042bde9b1ff726f2074226456a8d9171b93cccd7600ee83410aff2dcdab71b2b89a57205c2a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591d7b0e205102a737e7c66cfabaa439d
SHA106f45d7fea05d4f5535b526b926e44f6ba42641d
SHA256a1ad288e9cb78f5f8746435c4dbc526c3f1fd5c79c44409b20b3d7070fce385f
SHA5127e86fb44a6d2fcde709e24cba801f17252291376a9c17c7d46798aec20fa410898979fb4099b716d53c3228def5fa6e644a9732bfd2bf4efb3d693343a25ca30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5250948d17496476cfd687fc3395c0aa3
SHA10399262da75a86efdd31f3cda3835bcfc77895b9
SHA25665f6209bbdfb419e65f1eb0e7065341237041c3f28142558a4006719390d2198
SHA512f7b2818ebcb9616c6ec6ea7f028dbed9df9a18ce9b3ff8533aceb1c5e16bbc522be0d574fa7030b37fd9db800ed381ec9db0fa5fff72f6862f215d1338a1a6db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51295224ec0b7c80791930ee1ad235830
SHA1861bc7d70a3a3a526ae9b0cac0116c2dc7720814
SHA256a7a5bad41b8b6987cbb75941f18d24330e732181b5baf49e1902584dc9670e21
SHA5120b5aaddea5f759f8f7856775fb96b1583d961425270cd7b9439a75deceaccee82083a520a54e267860f5bb99aa171ab815ff1f40d00de3257f7ac65c5f1648b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf96cc10ee92e33f8716d230e7087709
SHA1dea2a20ce8a133c8da27405d6d42c613c13d9426
SHA2567677dc22ff738968b92e6f7530f88ec6df2e832b239f314f564112945fa7e956
SHA512b950ad23824d99f782e07d532d1e4e8953be6ba034c73f0fa7952b8b58934a95d1a6dd41e4a2ea35b9013471a3d3f38aa4ae5d8b686312791e832cd7fac82906
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52322364f375537f3506b62bc85010d54
SHA10a3daf85443e9d4bbc5218b06bd39954f5706bb5
SHA256d43e83b6bded7a2a4af32152d822688f2c7a99f343aa11f3beabed265bea9d8b
SHA51218512b2aa8040cbcd40a75dbd2108e882381c7a7b1baf2dcd87b1f57133ebe339f58d2b0d06baaee918104c9ef0de492312b08e199bc435952a6e26a890a07d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527852cfc8256e56bb48a3cebf99b3803
SHA1d34de43f2daf1ec73f89098aaac542de7f0b84cb
SHA25676f70c63db188108b1834c7e759c3e86ea4975e88fb1d483edfe52ebd0c0568d
SHA5123c02768881695ac229f4477a03d93cb4dd04241e2019f4d2fbcd1f2f75034a5a4480dcc09deab6207c223913f5d4c05d675691d13ba1cc347c983d2b75e823c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c9fc79225c340fa96e4c6a4ce8a73f9
SHA13f4c76efce0fabd400a7afc6a94d43959c89b29f
SHA256aab9eb25ed485d0ae2ae75783fd748680481d2d12dbc83c60430a46cb596ad3a
SHA512bf7527b864ea5ad9698f2c088fbe12fb8ec347953bc0065f77a005abb30d3551c8cecb9773cb41e589f66987846cd4517d4358687411985314117a6f41149b0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516fc473e6b50a5f7c7bc06a60788a369
SHA1a1cb831c1c837cd3a2c605db7b7f1e4f1a830a51
SHA256cb34df27d07f6a1f12dee79de7c48d92b9a770e080d379aae3525d33930eac2c
SHA5122ba32f713bfd2d53cbbaf861981dfd00a71bc5a5afd7e53a5c2e757f56a39392281cb03be205e0c5ab598cbf8c4a149d9ed14a1d69a79c535e710614de7b6774
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5760d3a1292a4c5c1660b90d6cfb19367
SHA1d8b0426873be1602292ae53a1c002343454cf663
SHA256a689a5902349aac61d8c23cd38cc7a0e3e0256b64b540a20da6135f5c90d111d
SHA512af5febba64bfc95f972326db871aec759053b23c1e7ffb060cc96409660297e4999e1f6338f5f6c02c8ad4a0cd87c41e15fa75772fd62c9be7cccf4feb939b82
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf