Overview
overview
7Static
static
7CraxsRat_V...g.html
windows7-x64
1CraxsRat_V...g.html
windows10-2004-x64
1CraxsRat_V....7.exe
windows7-x64
1CraxsRat_V....7.exe
windows10-2004-x64
1CraxsRat_V...rk.dll
windows7-x64
1CraxsRat_V...rk.dll
windows10-2004-x64
1CraxsRat_V...ys.dll
windows7-x64
1CraxsRat_V...ys.dll
windows10-2004-x64
1CraxsRat_V...64.dll
windows7-x64
1CraxsRat_V...64.dll
windows10-2004-x64
1CraxsRat_V...tm.dll
windows7-x64
1CraxsRat_V...tm.dll
windows10-2004-x64
1CraxsRat_V...PS.dll
windows7-x64
1CraxsRat_V...PS.dll
windows10-2004-x64
1CraxsRat_V...ms.dll
windows7-x64
1CraxsRat_V...ms.dll
windows10-2004-x64
1CraxsRat_V...pf.dll
windows7-x64
1CraxsRat_V...pf.dll
windows10-2004-x64
1CraxsRat_V...ts.dll
windows7-x64
1CraxsRat_V...ts.dll
windows10-2004-x64
1CraxsRat_V...io.dll
windows7-x64
1CraxsRat_V...io.dll
windows10-2004-x64
1CraxsRat_V...on.dll
windows7-x64
1CraxsRat_V...on.dll
windows10-2004-x64
1CraxsRat_V...le.dll
windows7-x64
1CraxsRat_V...le.dll
windows10-2004-x64
1CraxsRat_V...et.dll
windows7-x64
1CraxsRat_V...et.dll
windows10-2004-x64
1CraxsRat_V...7z.dll
windows7-x64
3CraxsRat_V...7z.dll
windows10-2004-x64
3CraxsRat_V...7z.exe
windows7-x64
1CraxsRat_V...7z.exe
windows10-2004-x64
Analysis
-
max time kernel
240s -
max time network
352s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 06:13
Behavioral task
behavioral1
Sample
CraxsRat_V6.7/ChangeLog.html
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
CraxsRat_V6.7/ChangeLog.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
CraxsRat_V6.7/CraxsRat_V6.7.exe
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
CraxsRat_V6.7/CraxsRat_V6.7.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
CraxsRat_V6.7/DrakeUI.Framework.dll
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
CraxsRat_V6.7/DrakeUI.Framework.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
CraxsRat_V6.7/GeoIPCitys.dll
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
CraxsRat_V6.7/GeoIPCitys.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
CraxsRat_V6.7/HVMRun64.dll
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
CraxsRat_V6.7/HVMRun64.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
CraxsRat_V6.7/HVMRuntm.dll
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
CraxsRat_V6.7/HVMRuntm.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
CraxsRat_V6.7/LiveCharts.MAPS.dll
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
CraxsRat_V6.7/LiveCharts.MAPS.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
CraxsRat_V6.7/LiveCharts.WinForms.dll
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
CraxsRat_V6.7/LiveCharts.WinForms.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral17
Sample
CraxsRat_V6.7/LiveCharts.Wpf.dll
Resource
win7-20230831-en
Behavioral task
behavioral18
Sample
CraxsRat_V6.7/LiveCharts.Wpf.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral19
Sample
CraxsRat_V6.7/LiveCharts.dll
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
CraxsRat_V6.7/LiveCharts.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral21
Sample
CraxsRat_V6.7/NAudio.dll
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
CraxsRat_V6.7/NAudio.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral23
Sample
CraxsRat_V6.7/Newtonsoft.Json.dll
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
CraxsRat_V6.7/Newtonsoft.Json.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral25
Sample
CraxsRat_V6.7/System.IO.Compression.ZipFile.dll
Resource
win7-20230831-en
Behavioral task
behavioral26
Sample
CraxsRat_V6.7/System.IO.Compression.ZipFile.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral27
Sample
CraxsRat_V6.7/WinMM.Net.dll
Resource
win7-20230831-en
Behavioral task
behavioral28
Sample
CraxsRat_V6.7/WinMM.Net.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral29
Sample
CraxsRat_V6.7/res/Lib/7z.dll
Resource
win7-20230831-en
Behavioral task
behavioral30
Sample
CraxsRat_V6.7/res/Lib/7z.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral31
Sample
CraxsRat_V6.7/res/Lib/7z.exe
Resource
win7-20230831-en
Behavioral task
behavioral32
Sample
CraxsRat_V6.7/res/Lib/7z.exe
Resource
win10v2004-20230915-en
General
-
Target
CraxsRat_V6.7/ChangeLog.html
-
Size
38KB
-
MD5
68be5f2305d89845ae9c4e81e5b493ef
-
SHA1
e6467906b143472331b6184ddf6471e3cb698502
-
SHA256
6b7feccc3c61f99c5db7890187c9564be846253a09fee88b599b7d7ec14f9713
-
SHA512
e9e38898d379f45b333ee505a93234b772c642edcf2acb3363e920a9bccddb6017407d0f40ddde3671656c058cf2a29436f8bacb1c6e4198746f87f65ef393f0
-
SSDEEP
768:aXBgQ5S40stgDDTos12kMhmAmCA2Q/CgjL8gYPCIOO8vP3zMryFF:aeQw40g0Tbe0Ama+Cg/2D7GMm
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608122cf18fcd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c300000000020000000000106600000001000020000000301e05fe967ef933f37a4008cc5ffe53feb90ef6c13086a3fb313d60875c9020000000000e8000000002000020000000b9f1f168eb2e28bcfc681095374fd77f8b942497a5b3b6cfd59a860707af341790000000e2efa8715c7785395c4b2524bfc9df948a0febd17d9315ed7213358dc3f5280e48f409a3d769c846c68bdd0890966fc5b9f91d5368d4c2ef5031341fc9e03c3f20f014913beeed799741f2c822959968eea309ed9bed68c3e8a6664e191f37c16c0c7eed8c5c62ee30af0e8776b92c198fbc8888008944c0c57d55f77e0aa66707711040f739731a3d73272e6ad6acfe40000000f36716e8cf153f56b9dece3a794a298030ebbd30ef8beb2f6fdc0392a42dffab210d45b3479b179cddcd24ed322cc5d81974db4def498612b20e083d743fae15 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403172986" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c300000000020000000000106600000001000020000000f24f16a951eed3389e00b75c75fd0ebc2d56e6cb92f249c91b90cdeb015883fb000000000e8000000002000020000000d6d5933f13e3665393626061aafd2207b0924ea2a465563f9400d0bda803afac2000000004cbcab2586a1b15fbdce2246b20129421e083f835c35f36a7f5ccf802f360e64000000074ba1be4d9d56152b1856be3b545094cdd1ad4fa8f9597a567d827500ccd6302931100c0393d66f4e1fd58942c671336824c37b9b0ff0f37bf9bb6f6315d271f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA3B2870-680B-11EE-AB25-5AA0ABA81FFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2856 iexplore.exe 2856 iexplore.exe 1204 IEXPLORE.EXE 1204 IEXPLORE.EXE 1204 IEXPLORE.EXE 1204 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2856 wrote to memory of 1204 2856 iexplore.exe 27 PID 2856 wrote to memory of 1204 2856 iexplore.exe 27 PID 2856 wrote to memory of 1204 2856 iexplore.exe 27 PID 2856 wrote to memory of 1204 2856 iexplore.exe 27
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\CraxsRat_V6.7\ChangeLog.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5088371ae4446c7cd5b814899a3e1d227
SHA199a983f807257778bf2fb474c4cca8c11e998ef0
SHA25644c8db345bf13b68200cca59fc4a9612391d8d4eea417545247493ca305831b9
SHA512e183ba9f259a76f9c25894413bc66a1f9a64afb38e878ada4c3e29fa6186a661023517d9e51c4924fd709076f263fda7e6459f26f808617694bedb4515f119e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bac9941f23ed3fae86cf011fc258afd5
SHA1addf1b2cfd135194777f4047596deb78fe934f63
SHA256989b4d59184071607860c00947acbf588537f87133b5a2d1be9d885e2706adb1
SHA512c88ed4fa9714f61ba2af306381f36ec835a8e6465c4e8497a2586aeea08d218b038ee6c5fa78ce8df16ef9c816cdb99d3d0d3d0381ac35a1dec8238acdfbf420
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d171ae45c53b0b472b24fb570217d0ee
SHA164f94cb2190f6b022fe21a2445a3e4f4b6534663
SHA25627586e0a8c0282023dc743592802d94f6256344dd5e89d164e03a429fd052155
SHA5122a63e4ebd3de3d3b43ec4f5cf3425ae0a5385f6fa26158f2cabcf05b9e6ade0091cfb49bd68a84bf9565f13714ad09bc4b953554d06f5a8d398d4434298672fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5d3a5fc8b3d3ff1aa86785a825988d3
SHA125c3cb375ad415ceb333737340573edd48b7d639
SHA2569598faeecf99c8a5f5fe53a56a789c6d6c5fe2b7872d3d5cf859b6f9ea56a0d7
SHA51223dc741b5991b5b4bc703d831dbb43a8fe2d58a1e0d6ceb82938d41c7bcddcc16f6072dda846624ba91f90a5fd5f5ee9ea561323214a0bf838ae3353e4a1e7ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5166c2ed1b56c87a4d74c6ff0ea2d8073
SHA1de25338e06dc6dcf593db08dabd57ed0e9f2002b
SHA256c92169ac74b7536389f594f18d1cbd1e9c9c9d7a8b3b56391d54a7e3382efa6b
SHA512745f614abc733c870c420db0a1da04b894c30bdc5ec0d773779d86c27c49e51bff4e8f9928f68c05660504e38a98f2bbfa34013f23a0795eda9b8965e5a13f4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5515b66aa774b2429b5b3a131744254e2
SHA11abdce34149d95610a9e78317d7c8806a129d1f4
SHA256c8fe6a66d24ea1334d036ba25f08e42130daba5cd2652d1bdd8517e4a56a1a37
SHA512e78004b9ac57d953f8f884626df2228c79db27f843facb474522f259fc11a5c789bc9c0a66dd900ea8fd92ab586fd37b342a59e2382f87329299be6b79296526
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce0dc9d322098558d414de5ce56d2717
SHA18eb9cb1ae4c48f6f76b8f2c362be8eeabeb3c746
SHA25652368382f7a989e0c4fa85e0e40a5f6a2a4e754d5a1581f86ff4f3eb71247da6
SHA512f4c2b982b96891e854bdc70ef5330fb163011fd4b9a3e75577dc99e3973bf4a20a35a76b8584cdd1305ab0f10c0c38248447722079cd90d0d8fa2e7cf30b9257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d5cf90c62476735df64c378597526b3
SHA1384ac449c2b4603f1135f6da28fcf41f557000a5
SHA2563926694920ae02c8cc844f9cf8a543cc3b038a510ba5c09aec3781486e9e42bf
SHA512975b69fe1dda50b0b4aa4c27c4eba758bafc79f36599df85be8efeba93ef8118d45498b8703bf5ce1492e10d2ae5a8315bb5820cf0c916ccfc863f97e188bba7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd8518b3317f1cb9a61efa818f479038
SHA1a31975e7125118f7111009bc037e79d5a807d47b
SHA256e5426d1e92b3cc1777e798f5a96335ecf04f626e639f59c994b7dd51ffb4b5ed
SHA512a2fef0689c44ea48c9be1fb99825a6d310330e76446f117fbaf0d8ac7993c4ec05892b9637042814ff8b7d36c9949031758cf56de7b4512233adc954c2e45879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566acba7e6a3d7101bbda3230f903c603
SHA1c1220f2ea0fdbc4cc0f12ed9a563aa5be5111df9
SHA2561ccacf60e07d7194d9f1bd1583b4f50684f7ca46a0c81fd46679763abad11d69
SHA5120fdc481e87fc7e430dcfce1e35a6691c792213e6014888a788facf7e9074c5da002254cc2138dff25b11200f3d1a8f5ee39c5d37b09797850a06ae773539afcd
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf