Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2023, 13:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.52e6873faed9c27983bb4ed9ed6a9e50.exe
Resource
win7-20231020-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.52e6873faed9c27983bb4ed9ed6a9e50.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
NEAS.52e6873faed9c27983bb4ed9ed6a9e50.exe
-
Size
92KB
-
MD5
52e6873faed9c27983bb4ed9ed6a9e50
-
SHA1
6cbc68c018cfbbcbf2ece8063eefb665ad8d001b
-
SHA256
0294aa8670f06445d963a77147c98753bc9160b5da0cf27cc88f9f80ab08897e
-
SHA512
f1a1ec0283802b039945ce1f44df1a100b3f5155156c0fc79088f14617ec12929a161d41c6e900790b2fb31d27bda149c40fa5eca79d9c61c388618a054bf3f2
-
SSDEEP
768:eweJK9nvPCasW0QWH8cnW0ecO7fchJh51cTDge1VY/q45C2T1G+mt5QDbn0Pb:ew68cn3ZeMaauCDbn0z
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fypuas.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation NEAS.52e6873faed9c27983bb4ed9ed6a9e50.exe -
Executes dropped EXE 1 IoCs
pid Process 3064 fypuas.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /m" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /P" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /g" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /C" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /X" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /S" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /t" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /B" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /O" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /T" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /i" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /r" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /x" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /N" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /d" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /w" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /D" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /h" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /J" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /V" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /R" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /Z" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /Q" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /f" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /M" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /I" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /e" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /K" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /l" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /p" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /a" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /b" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /H" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /j" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /L" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /v" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /u" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /z" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /n" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /s" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /G" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /E" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /k" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /U" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /c" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /Y" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /F" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /W" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /o" fypuas.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fypuas = "C:\\Users\\Admin\\fypuas.exe /A" fypuas.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe 3064 fypuas.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2292 NEAS.52e6873faed9c27983bb4ed9ed6a9e50.exe 3064 fypuas.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2292 wrote to memory of 3064 2292 NEAS.52e6873faed9c27983bb4ed9ed6a9e50.exe 92 PID 2292 wrote to memory of 3064 2292 NEAS.52e6873faed9c27983bb4ed9ed6a9e50.exe 92 PID 2292 wrote to memory of 3064 2292 NEAS.52e6873faed9c27983bb4ed9ed6a9e50.exe 92 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84 PID 3064 wrote to memory of 2292 3064 fypuas.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.52e6873faed9c27983bb4ed9ed6a9e50.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.52e6873faed9c27983bb4ed9ed6a9e50.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\fypuas.exe"C:\Users\Admin\fypuas.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5d778a175aa6cb7dcabfd1b0ff2414fcc
SHA158d0f8b804a41902ee54398fcd393ddc822a1eb5
SHA256890ca54adae0d2addaddf03c879f80e38bcf7bc7277a3f41ebb717a160e28152
SHA512b4398bdfe9f01babc55027d4b67c9d96c52c534045ed43937e444b465a94bce14158ed75e5d732acbfb3ea64444fabc177ccba82333c04e8438099929fad4e30
-
Filesize
92KB
MD5d778a175aa6cb7dcabfd1b0ff2414fcc
SHA158d0f8b804a41902ee54398fcd393ddc822a1eb5
SHA256890ca54adae0d2addaddf03c879f80e38bcf7bc7277a3f41ebb717a160e28152
SHA512b4398bdfe9f01babc55027d4b67c9d96c52c534045ed43937e444b465a94bce14158ed75e5d732acbfb3ea64444fabc177ccba82333c04e8438099929fad4e30
-
Filesize
92KB
MD5d778a175aa6cb7dcabfd1b0ff2414fcc
SHA158d0f8b804a41902ee54398fcd393ddc822a1eb5
SHA256890ca54adae0d2addaddf03c879f80e38bcf7bc7277a3f41ebb717a160e28152
SHA512b4398bdfe9f01babc55027d4b67c9d96c52c534045ed43937e444b465a94bce14158ed75e5d732acbfb3ea64444fabc177ccba82333c04e8438099929fad4e30