Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 13:00
Static task
static1
Behavioral task
behavioral1
Sample
509f5303eaba495fa0d5b4f051714c03.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
509f5303eaba495fa0d5b4f051714c03.html
Resource
win10v2004-20231215-en
General
-
Target
509f5303eaba495fa0d5b4f051714c03.html
-
Size
71KB
-
MD5
509f5303eaba495fa0d5b4f051714c03
-
SHA1
aa9832ad60444d045c47d467a25fb577e11bb281
-
SHA256
8981e95c041fd51122ccfe04f0a5e82e59ab53cf4b6a64f8f2f08219ed929935
-
SHA512
56420e451056cccc0f3090d7416e5557acf062d288963af10feee29ab3d7f4fb86a975137f57d3648fc336ca4bfda0d1d69a1755c70409bb51c62dd4bbc9f31c
-
SSDEEP
768:+Vr4DyHHFPkzxuA5J2CXvJYnKzbsFT0oA5kYTQmNnR7Yw3194nxG:+VjHHCzxuA/Iio/KkYEuR7Yw3196G
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46EC5241-AFB8-11EE-AC1E-72D103486AAB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000af3d9062ad6d487b0ce5410f951cd0c88af1081c1d8fb89e23517769ebbccb85000000000e8000000002000020000000d4998d7f2489f7df361fa3547eb2a359cb46e389ca68758f014ea7ad3ef37206200000004c470a067ece7c96d6872d8271ed7aadd7745ef4b7653b7180b461cf4e69120540000000c2fcc4c61c767188b6692084e4cdc8028c35e1614b38523b9ca3b099849a17f719bc36b1d0777a45de5319b3bdb02af741ffee77fbe7bd4ccf179cd2d64a5c0d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000007a4d2264cc27820b1b384b0e434d9b57acd582253eb177c64c9feb3ffc73adb4000000000e80000000020000200000005a4d786c04f5935632505261b3efc86b3295c240b86c14957cc26dc75b10b21490000000490374f66c5a07d8b4f078eaa9b03ec6de185911047cae32394c276a539591c4e81ff2c320b025b7457a378fa2f1e1b0c9c4b2b4830092831cda0a3bcf286ad042b22758dde713094c5f8756f891198a7d05351929f2dd3e70ceeb21c350bd2c4b7fd236dc53e8f2894a04f55d85b47a0669547fb5779996f839421440b805ef35ad459ca4d33e6f5ec1809a4792e84b40000000dd64d2b5d9893f826555d94a438279287d87c91322ee79fe0a9fcb3eab8a6b5fa2d00cff0385bbf36214fd434727d392ba85e9b8557564f0adcf9e20ea1cf55e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411053518" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904bc826c543da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2268 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2268 iexplore.exe 2268 iexplore.exe 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2268 wrote to memory of 1712 2268 iexplore.exe 28 PID 2268 wrote to memory of 1712 2268 iexplore.exe 28 PID 2268 wrote to memory of 1712 2268 iexplore.exe 28 PID 2268 wrote to memory of 1712 2268 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\509f5303eaba495fa0d5b4f051714c03.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
889B
MD53e455215095192e1b75d379fb187298a
SHA1b1bc968bd4f49d622aa89a81f2150152a41d829c
SHA256ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99
SHA51254ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5b3ba5a6bffad25b6ef400dc7824b9571
SHA13c3a268e7b236cccfcdf866828eaebcfa45e5e55
SHA256f6dd3484f1000ffd24526493675fab99e4e6988ca44a77bfa3a6c0a7f4c11544
SHA5120f104e390e9167a7d8c38f34dc598a15f5b11bf2be8d9f04a3201c9d5530150c4024305b80eae27038b03b87262123d8cd1e14ab041d486abd96496d0510b5a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a74e110475975cf753be5930845cbe38
SHA15ca2f1a8a199e68def0195d6efa1490f18144f1d
SHA2563f7f660f4b88a42275ea8d70ab03a5f1330ad8fd309c60da90d153c26755b15b
SHA51207e41930c9fa6b6cb027a755c186ad18b7e4205d70d0dbe32082393a4c90f83f0d34d4897683405de087bcd83a45fee0f512e277fe8e28924fb6370708b99267
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550a931e4ccff95e0ba173d12f8961903
SHA11353ba3bf8b079d241242eb54d66d5ad3795f276
SHA2566890891f91ab237a0b57673dddedf58dbb9dda9e80d678c4a5d152e6421fb072
SHA512f4f3696e123d0ffdfb4092e306760f5cbf5bae0870f866d700cb55c2f0d7047289d285f6db8cfb0a888053bddf778a6bdaff149aca3fa8ed217b71a04ef25eae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56897c0b7128b6688aa1e19a2f0bbfeb5
SHA163e096298ae6fb07510e47ce13749a5a0fde9a0a
SHA25637ef5b97f0d0566f5bd32ab5b0e9cac9b6c42ac35f2daafd1f3c9f7c5556307b
SHA512948842fda990f86f1259794168dbaeeaf55fc10e6e382204635116e8ce6c37eeee708e60abd0d9a23f3adc0d450cfcb22f832b1d17760f9bfacfea899793bb30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c071aa2720906cfeb8933dea002cb37b
SHA1df61e9d062ec478e8a92b7e5d8aa38473586fd8d
SHA2569ad56e43b1ce772aa632d17bbdb2417d42cc4cc97616d5d3324a79628037e232
SHA512e8ed09fefe85a87fc5296870017f62db3f8d90bd04b8d70eb61cf5440ff5fe08817eeb3490fb1862ac39c886d469c5b911e07d16449efb94a183f8f5beb47c2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5848bde16f43718779f0e6fc12e0d288b
SHA12a1a3f8372287a555d34df09ea34b5bc5507cd2a
SHA25662ae5bac5509812e4f415615032110e2735de3df3bcc59c0e4f6171edd719fe6
SHA512ae35e9429216251d1ba43d8e771867e6f2ab48925b5e6d774be0fd2c5d97f0f4085ae5c789722d704cbdff94f2e048becc628815d33bda78d4a0c93b2d09058d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de4d1fb60e1c8e13edb89c3b9e7d2e83
SHA13403c8f68b55025ba9c32fe5d2be85fc771d223a
SHA256fe37f926d2fc2b828ca1d69e452b20ac9ace2f157281147168f60db7fa2a2f7e
SHA51271eb228c2ff56e1b720accd2b027727c8b67af35bc6770705e51bf867533f82f0a09c6386bd5208aa927c2a8e532828c1106161ae32c62f8a484fc2044c2f489
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581f586e636bd9b72c18e772cf15e31fd
SHA104655c0545fa120c8fbc0768282866f37d1a79f1
SHA25673cceca0ab56c96d064df4959ad84e751866ebb1831f81b52c44fdea9e10feb0
SHA5129997254b093de2b5a51c6949cf8c3c02cdc29a7345abf07c782b3d591439cb4fb578f90a58c447c1cc750240dd8264de563c27475ab5854031997d5926548df9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD51d3e679d001edba4f4159c38b2d02080
SHA144c86ff7eedb604ff79a8f7e88d4816c2b17f9d7
SHA2568a0ed0afd36760a7eb804dee1e21d3a2ef0f5e603d00e9f424389d1aefac1e54
SHA5126e88182aab8a673450c1ddbaacd9891d4bab0fe698b5bbe51332d8507db3755e5ed8f65b72bb0356608cce1e708112786f7bfb6788c505410e14c34990a2639f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7MLXJ27J\f[1].txt
Filesize34KB
MD5a11a8356036ecfbefc167cc61423e473
SHA1f18cd9061190690d5f88b222f6c8b6727be484ac
SHA25691ce50484e91b49bde8ef16b74e51bc8e09dce8f5d0c906919795ac87b3deaa7
SHA5129324faddc84a97c36c8bd9df72503531cb5a0b18a10be342474952b85d28b5ef14e61b1e0890e19ea73a33e333ae42bbe1ee97d9fe73f8212473292a50b0ba03
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LZMXRSCX\platform_gapi.iframes.style.common[1].js
Filesize56KB
MD5f6140cf2e81a9d5b9bc96970fe1946f6
SHA1e18cb20a08d0c13d44b72e36e9560aec2187abce
SHA25668cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5
SHA5121f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGVFR8HC\cb=gapi[2].js
Filesize133KB
MD5288c5ba5b7001fe841c32f690f62cc93
SHA129aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789
SHA256c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52
SHA512e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06