Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
8277a28b42eb820b6003c4e08d0053b4.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
8277a28b42eb820b6003c4e08d0053b4.exe
Resource
win10v2004-20230915-en
General
-
Target
8277a28b42eb820b6003c4e08d0053b4.exe
-
Size
6.9MB
-
MD5
8277a28b42eb820b6003c4e08d0053b4
-
SHA1
968b66c72bb65214cfd57af1ae9eda086a5fbc17
-
SHA256
6f2129b1e154ac4e59778563467a9eac91912d9dc03aa6ab5bfe88cf58dd033b
-
SHA512
116d87e23f64eeb8b917f79408479e348c474097f10a89aff09dc8c8be4ebbe58238bf77252442a667463a6652f0452a8fc06c75925af1a1e91d291a3c59eff3
-
SSDEEP
196608:1OsgMzFzZ/4pz/8X7yuP20nAEhYuz0gUTqfk2S+:1O/M9ZQRYyuhAAYuQTW82S+
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WUDFHostController\Parameters\ServiceDLL = "C:\\ProgramData\\Remote Utilities\\Backup\\msimg32.dll" WUDFHost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation 8277a28b42eb820b6003c4e08d0053b4.exe -
Executes dropped EXE 2 IoCs
pid Process 3668 Silverlight.Configuration.exe 3128 WUDFHost.exe -
Loads dropped DLL 6 IoCs
pid Process 2372 8277a28b42eb820b6003c4e08d0053b4.exe 3668 Silverlight.Configuration.exe 3128 WUDFHost.exe 3128 WUDFHost.exe 3128 WUDFHost.exe 4104 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Silverlight.Configuration.exe = "\"C:\\ProgramData\\Remote Utilities\\Backup\\Silverlight.Configuration.exe\"" WUDFHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 50 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-9216 = "This PC" WUDFHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\ieframe.dll,-5723 = "The Internet" WUDFHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\NetworkExplorer.dll,-1 = "Network" WUDFHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\prnfldr.dll,-8036 = "Printers" WUDFHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3668 Silverlight.Configuration.exe 3668 Silverlight.Configuration.exe 3668 Silverlight.Configuration.exe 3668 Silverlight.Configuration.exe 3668 Silverlight.Configuration.exe 3668 Silverlight.Configuration.exe 3668 Silverlight.Configuration.exe 3668 Silverlight.Configuration.exe 3128 WUDFHost.exe 3128 WUDFHost.exe 3128 WUDFHost.exe 3128 WUDFHost.exe 3128 WUDFHost.exe 3128 WUDFHost.exe 3128 WUDFHost.exe 3128 WUDFHost.exe 4104 svchost.exe 4104 svchost.exe 1680 powershell.exe 1680 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeSecurityPrivilege 2372 8277a28b42eb820b6003c4e08d0053b4.exe Token: SeDebugPrivilege 3668 Silverlight.Configuration.exe Token: SeTakeOwnershipPrivilege 3128 WUDFHost.exe Token: SeTcbPrivilege 3128 WUDFHost.exe Token: SeTcbPrivilege 3128 WUDFHost.exe Token: SeDebugPrivilege 1680 powershell.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3128 WUDFHost.exe 3128 WUDFHost.exe 3128 WUDFHost.exe 3128 WUDFHost.exe 3128 WUDFHost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2372 wrote to memory of 3668 2372 8277a28b42eb820b6003c4e08d0053b4.exe 85 PID 2372 wrote to memory of 3668 2372 8277a28b42eb820b6003c4e08d0053b4.exe 85 PID 2372 wrote to memory of 3668 2372 8277a28b42eb820b6003c4e08d0053b4.exe 85 PID 3128 wrote to memory of 3772 3128 WUDFHost.exe 96 PID 3128 wrote to memory of 3772 3128 WUDFHost.exe 96 PID 3128 wrote to memory of 3772 3128 WUDFHost.exe 96 PID 3772 wrote to memory of 1680 3772 cmd.exe 98 PID 3772 wrote to memory of 1680 3772 cmd.exe 98 PID 3772 wrote to memory of 1680 3772 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\8277a28b42eb820b6003c4e08d0053b4.exe"C:\Users\Admin\AppData\Local\Temp\8277a28b42eb820b6003c4e08d0053b4.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\ProgramData\Remote Utilities\Backup\Silverlight.Configuration.exe"C:\ProgramData\Remote Utilities\Backup\Silverlight.Configuration.exe" f2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668 -
C:\ProgramData\Remote Utilities\Backup\WUDFHost.exe"C:\ProgramData\Remote Utilities\Backup\WUDFHost.exe"3⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell.exe -command Add-MpPreference -ExclusionPath "C:\ProgramData\Remote Utilities\Backup"4⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command Add-MpPreference -ExclusionPath "C:\ProgramData\Remote Utilities\Backup"5⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "WUDFHostController" -svcr "WUDFHost.exe" -s WUDFHostController1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD59e20a938438c276ee36acecef977364b
SHA1288816e2f027075966d0a8b86387ff7fc5f89e80
SHA256a1b6b6d949a861237aa8a4972e6e41dc1ed5b82df7d0c8c371edae199fda85da
SHA512424c7bd662d63357650bc9cfa465ce62da9c09213601561021785666e25da6ef2a71cb2886c071450a5887830137f481ff37e887438e3b43dd35816c90f694cb
-
Filesize
820.1MB
MD5d0cd39f988fb6694d8a59e0afe8627f5
SHA149227ab4aed6aad36ce2c82357054eb7c8936947
SHA256d9132456691cf68a153202d4e1dc9920a70565aeef8eb011f1d600082ff394e8
SHA51295c9f731543b327275b5f50688f22d7b474e6bc6963a45c12a9db017c75d6d4fee052d23fce358fd8b6793797f789fe31dd28e12e3b44b0b913c66550477e824
-
Filesize
700.5MB
MD5094f4360937ccf38db39e01e8b261029
SHA15da41036e51a17a8a1e8e0a865b26e1f10a460c6
SHA256b70e798b5768c5582f0d07819c59ddc54bd083c126dded386987489234c18c65
SHA5129a6219c6825e75e182ad439b33e465bc0010315e12138ab0c458db37900426c561edd94b44b14515a8ede05e6d0117c9921ffa7a8f155275464fd348ea5523ba
-
Filesize
231KB
MD517e40315660830aa625483bbf608730c
SHA1c8f5825499315eaf4b5046ff79ac9553e71ad1c0
SHA256f11009988b813821857c8d2db0f88e1d45b20762f62a3cf432339f352b12cefe
SHA5120a3468dcff23ccb2458a8241388b7092d0711a4ebb491d5d8141cc352db8008fc6afc9af1e668104ac657fb4b3651ebcfdf1575557ff918d0f0905cd88c59e85
-
Filesize
231KB
MD517e40315660830aa625483bbf608730c
SHA1c8f5825499315eaf4b5046ff79ac9553e71ad1c0
SHA256f11009988b813821857c8d2db0f88e1d45b20762f62a3cf432339f352b12cefe
SHA5120a3468dcff23ccb2458a8241388b7092d0711a4ebb491d5d8141cc352db8008fc6afc9af1e668104ac657fb4b3651ebcfdf1575557ff918d0f0905cd88c59e85
-
Filesize
231KB
MD517e40315660830aa625483bbf608730c
SHA1c8f5825499315eaf4b5046ff79ac9553e71ad1c0
SHA256f11009988b813821857c8d2db0f88e1d45b20762f62a3cf432339f352b12cefe
SHA5120a3468dcff23ccb2458a8241388b7092d0711a4ebb491d5d8141cc352db8008fc6afc9af1e668104ac657fb4b3651ebcfdf1575557ff918d0f0905cd88c59e85
-
Filesize
19.8MB
MD531c0bafc3f6e6c7322a7a32ac1bd87da
SHA142fd1a41e1eef5998de674ec068c702f1ee3b4f3
SHA256f2a5023cd559597a1b70a7e02345fb9c80b740377fcf7341d5df2d462efafda5
SHA512ab8dcda75a2e9c4d7dfcc23e76b3ca76b4ec5f1fbf24007bf0e9707de17461c5016ec9005dae3f62e34f586452aa145871d371536572365b35bf33b43a8d24ab
-
Filesize
19.8MB
MD531c0bafc3f6e6c7322a7a32ac1bd87da
SHA142fd1a41e1eef5998de674ec068c702f1ee3b4f3
SHA256f2a5023cd559597a1b70a7e02345fb9c80b740377fcf7341d5df2d462efafda5
SHA512ab8dcda75a2e9c4d7dfcc23e76b3ca76b4ec5f1fbf24007bf0e9707de17461c5016ec9005dae3f62e34f586452aa145871d371536572365b35bf33b43a8d24ab
-
Filesize
1.3MB
MD5d9871a6ba02aacf3d51e6c168d9c6066
SHA142012a0116a9e8aed16c7298bd43cb1206a0f0cd
SHA2567975ac81130ae8fe09caf6bef313c44fe064b67ed9205f0bd11ac165386e2f95
SHA512ae9118dac893097cd0e388ce45ff76c26b99b1cc9aea59547cc1dedf00bfbaf575f3d05317fac2f3f8b5c97896f6080bea9a90425333dbf02013eb01a002e43f
-
Filesize
1.3MB
MD5d9871a6ba02aacf3d51e6c168d9c6066
SHA142012a0116a9e8aed16c7298bd43cb1206a0f0cd
SHA2567975ac81130ae8fe09caf6bef313c44fe064b67ed9205f0bd11ac165386e2f95
SHA512ae9118dac893097cd0e388ce45ff76c26b99b1cc9aea59547cc1dedf00bfbaf575f3d05317fac2f3f8b5c97896f6080bea9a90425333dbf02013eb01a002e43f
-
Filesize
103KB
MD59e20a938438c276ee36acecef977364b
SHA1288816e2f027075966d0a8b86387ff7fc5f89e80
SHA256a1b6b6d949a861237aa8a4972e6e41dc1ed5b82df7d0c8c371edae199fda85da
SHA512424c7bd662d63357650bc9cfa465ce62da9c09213601561021785666e25da6ef2a71cb2886c071450a5887830137f481ff37e887438e3b43dd35816c90f694cb
-
Filesize
736.2MB
MD5c41fbd8a841321065e02dac5bd951159
SHA1582582f8cffd800e2ae4de598981169447bd9310
SHA256d76b6137d16f6ce95c37f7e0ec3d4552f21d26e6482f5962152067ed7f5103d5
SHA512e18cc7bd7036a1fc01c01c31d29566ec286db71b1fb8a250c0f1f62acc05c1adab4dfeaadf4b5df4c18c399fd7ba6496b048d02081164947be1de13321664f95
-
Filesize
5KB
MD50e7ba2cb293b0068f7016063f1724d50
SHA10a1fbad5c284cde95559e2ceb1a59579336337ff
SHA256d36aa23d6d4d64937fb02f67da38a03f51221ed68917e7148ff005ba8bc4454d
SHA512eb1a7309846c0cd614bb0de519248a2c17a3cbc6f06f8f45df4b1d04786687e1923c0ff2cdf08e7cf74a1071687160445ee6e76be8364b4a27befccab7e4fe5e
-
Filesize
337KB
MD5fe6d8feaeae983513e0a9a223604041b
SHA1efa54892735d331a24b707068040e5a697455cee
SHA256af029ac96a935594de92f771ef86c3e92fe22d08cb78ebf815cbfd4ef0cb94b0
SHA512a78b1643c9ea02004aabefc9c72d418ee3292edb63a90002608ac02ad4e1a92d86b0fc95e66d6d4b49404c1fc75845d0e6262821b6052ab037b4542fcaf2047d
-
Filesize
337KB
MD5fe6d8feaeae983513e0a9a223604041b
SHA1efa54892735d331a24b707068040e5a697455cee
SHA256af029ac96a935594de92f771ef86c3e92fe22d08cb78ebf815cbfd4ef0cb94b0
SHA512a78b1643c9ea02004aabefc9c72d418ee3292edb63a90002608ac02ad4e1a92d86b0fc95e66d6d4b49404c1fc75845d0e6262821b6052ab037b4542fcaf2047d
-
Filesize
166KB
MD52c5e106f847b886979cc5e1b7941f3b0
SHA1abb94f3c804554f332d537cc13ccdee776f4cbe5
SHA256d9ce77ebcd40b8790ff625a5682bcfc8667f3fa99dcba72bd3078d6f94e52277
SHA512521521f95ba53f84c9d11819f3f828b72123905a0bbd6e891ce33f2354c6370e1e23e73e583d5c065b7de5eba329fa7f2a87d3ad23f8d588e1393ed402a973f5
-
Filesize
195KB
MD52bc32883b924395a4a9b6429e150d12a
SHA189d6a753e466406b70c5b9bce3617a6b96c7c817
SHA2563a0ff1e04417b15dca13bf11277655a231ab50cf1c3ed9d6313d94e8e02fc1f9
SHA512e58823785f27adc50fcf922937b2e8471326e8eaf39343c4697fd1069c605889be2577d0e328284bdccc6ca8ba9c64536746fbd4dd6ea94cdc5ca4137cfe4ae1
-
Filesize
436KB
MD5d7778720208a94e2049972fb7a1e0637
SHA1080d607b10f93c839ec3f07faec3548bb78ac4dc
SHA25698f425f30e42e85f57e039356e30d929e878fdb551e67abfb9f71c31eeb5d44e
SHA51298493ea271738ed6ba3a02de774deef267bfa3c16f3736f1a1a3856b9fecc07f0ea8670827e7eb4ed05c907e96425a0c762e7010cb55a09302ca3cfb3fe44b2b
-
Filesize
436KB
MD5d7778720208a94e2049972fb7a1e0637
SHA1080d607b10f93c839ec3f07faec3548bb78ac4dc
SHA25698f425f30e42e85f57e039356e30d929e878fdb551e67abfb9f71c31eeb5d44e
SHA51298493ea271738ed6ba3a02de774deef267bfa3c16f3736f1a1a3856b9fecc07f0ea8670827e7eb4ed05c907e96425a0c762e7010cb55a09302ca3cfb3fe44b2b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82