Analysis
-
max time kernel
123s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 00:08
Behavioral task
behavioral1
Sample
080a0ad2df17ac9dd59cc8ef147bfca5.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
General
-
Target
080a0ad2df17ac9dd59cc8ef147bfca5.exe
-
Size
97KB
-
MD5
080a0ad2df17ac9dd59cc8ef147bfca5
-
SHA1
775816a230700d0175c8fbc0bf7da366ab48ccbd
-
SHA256
4d1614923a37156eae9c67113daeaf5b0c9fc2946b79c50ff76af319cdae52c0
-
SHA512
70266f30ae98f18f3e3445d0672d6353f3a94bc64ad585d31d5b9f97b91d77330237a385a23dbe57d082347c0c799c0892a84f2f015264182f97ec3381e28d1e
-
SSDEEP
1536:mb0UmA5JWTmHxJtUlAn9IO+sGyfYaInyuddxnpF/iuDUR57Zld5KATgty7V4hxfs:q7mnTmRJSQWxyudf2T5KATgKVVQYi
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1692 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2112 PostTip.exe -
Loads dropped DLL 7 IoCs
pid Process 2888 regsvr32.exe 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 2112 PostTip.exe 2112 PostTip.exe 2112 PostTip.exe 2580 regsvr32.exe -
resource yara_rule behavioral1/memory/2132-0-0x0000000000400000-0x0000000000448000-memory.dmp upx behavioral1/memory/2132-27-0x0000000000400000-0x0000000000448000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PostTip = "C:\\Program Files (x86)\\PostTip\\PostTip.exe" PostTip.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C4BF6897-41A2-454b-AC3B-437F30BEA671} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C4BF6897-41A2-454B-AC3B-437F30BEA671} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C4BF6897-41A2-454b-AC3B-437F30BEA671} regsvr32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\PostTip\PostTip.exe 080a0ad2df17ac9dd59cc8ef147bfca5.exe File created C:\Program Files (x86)\PostTip\PostTip.dll 080a0ad2df17ac9dd59cc8ef147bfca5.exe File created C:\Program Files (x86)\PostTip\uninstall.exe 080a0ad2df17ac9dd59cc8ef147bfca5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\CLSID\ = "{C4BF6897-41A2-454b-AC3B-437F30BEA671}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ProgID\ = "SideTab.SideTabCtl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib\ = "{A12EF54F-2691-4C32-AC1B-F65D144A3988}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32\ = "C:\\Program Files (x86)\\PostTip\\PostTip.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\ = "SideTab 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PostTip\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ProxyStubClsid32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib\ = "{A12EF54F-2691-4C32-AC1B-F65D144A3988}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ProgID\ = "SideTab.SideTabCtl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ = "PostTip" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CLSID\ = "{C4BF6897-41A2-454b-AC3B-437F30BEA671}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ = "PostTip" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ = "ISideTabCtl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\TypeLib\ = "{A12EF54F-2691-4C32-AC1B-F65D144A3988}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\ = "SideTabCtl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\VersionIndependentProgID\ = "SideTab.SideTabCtl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\ = "SideTabCtl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\TypeLib\ = "{A12EF54F-2691-4C32-AC1B-F65D144A3988}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\CLSID\ = "{C4BF6897-41A2-454b-AC3B-437F30BEA671}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\ = "SideTabCtl Class" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\ = "SideTabCtl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CurVer\ = "SideTab.SideTabCtl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\0\win32\ = "C:\\Program Files (x86)\\PostTip\\PostTip.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CLSID\ = "{C4BF6897-41A2-454b-AC3B-437F30BEA671}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CurVer regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\VersionIndependentProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\VersionIndependentProgID\ = "SideTab.SideTabCtl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32\ = "C:\\Program Files (x86)\\PostTip\\PostTip.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ = "ISideTabCtl" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe Token: SeBackupPrivilege 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 2112 PostTip.exe 2112 PostTip.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2888 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 28 PID 2132 wrote to memory of 2888 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 28 PID 2132 wrote to memory of 2888 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 28 PID 2132 wrote to memory of 2888 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 28 PID 2132 wrote to memory of 2888 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 28 PID 2132 wrote to memory of 2888 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 28 PID 2132 wrote to memory of 2888 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 28 PID 2132 wrote to memory of 2112 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 29 PID 2132 wrote to memory of 2112 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 29 PID 2132 wrote to memory of 2112 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 29 PID 2132 wrote to memory of 2112 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 29 PID 2132 wrote to memory of 2112 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 29 PID 2132 wrote to memory of 2112 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 29 PID 2132 wrote to memory of 2112 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 29 PID 2132 wrote to memory of 1692 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 31 PID 2132 wrote to memory of 1692 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 31 PID 2132 wrote to memory of 1692 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 31 PID 2132 wrote to memory of 1692 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 31 PID 2132 wrote to memory of 1692 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 31 PID 2132 wrote to memory of 1692 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 31 PID 2132 wrote to memory of 1692 2132 080a0ad2df17ac9dd59cc8ef147bfca5.exe 31 PID 2112 wrote to memory of 2580 2112 PostTip.exe 32 PID 2112 wrote to memory of 2580 2112 PostTip.exe 32 PID 2112 wrote to memory of 2580 2112 PostTip.exe 32 PID 2112 wrote to memory of 2580 2112 PostTip.exe 32 PID 2112 wrote to memory of 2580 2112 PostTip.exe 32 PID 2112 wrote to memory of 2580 2112 PostTip.exe 32 PID 2112 wrote to memory of 2580 2112 PostTip.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\080a0ad2df17ac9dd59cc8ef147bfca5.exe"C:\Users\Admin\AppData\Local\Temp\080a0ad2df17ac9dd59cc8ef147bfca5.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\PostTip\PostTip.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2888
-
-
C:\Program Files (x86)\PostTip\PostTip.exe"C:\Program Files (x86)\PostTip\PostTip.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\PostTip\PostTip.dll"3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2580
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c \DelUS.bat2⤵
- Deletes itself
PID:1692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
243B
MD537812690ca2b3461f97c80f7619be96a
SHA16b2db3d2988946173f72106c7081663acb1a672f
SHA256b963b05b272d6b6359f510c4340ca33bedf76b7e1c8677ce372d8f6730cba72d
SHA5125fc85a9f94b18fa96d1262e63e55e0164129583a23ec88fde68bd1c1569f87fd8f014b06093e130fece17c08b80333f8ff0bfd33c48e2809060d3a24de0118b6
-
Filesize
38KB
MD5c2b5be376cac31c0b01603105ae4ea89
SHA14fcfa0181ca5478103c6999199957be40f4a937b
SHA2568ec9ca043b655d4bf868ccd7d9d5fdd4e23ad8610aed2fb983370437b7851feb
SHA512d17e798a414a6d2295f13339a10151f2a34cff5a7d6c81862c26a0c4ac831bf9f867f9f2bf028fa15f189a93f8d8883a334a9857a33bcabac916376267c9da72
-
Filesize
148KB
MD52167d7da34645bcd929a9f699f2a8914
SHA1ac6b268328965ac07b07cf7fdd799d3a2e857881
SHA2562ddf796d6079b1b645f5abe8082a40a50dbad0279ca30156f43576cc752a74e0
SHA5126eee4e34159b9e66fbbd4cd327a11e6b333a40591c06041b16de22bf3188a4ab8c077b1b8eb3689cb322b57b15a8694236e22f7986d26afc23d061e7ecabc0af
-
Filesize
162KB
MD5dc62c2f61a803bd1292b0b169fa6f8d9
SHA1117ecef652f645ab87a611eab5bc16ae085d6ffb
SHA2567434776f552dde651370f0e43026def6c56c412eb1c62d5214406b34144319af
SHA51255f22c83fcfccf10bb799af214b456392f43b7c394a7dcebbe2fe7059c65ba2fad859c9709b4ca2ab28ab55f03e054196a5b3857a0ec09c3b603a3458cb212d1