Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 18:29
Behavioral task
behavioral1
Sample
87bc02114ccbac49b90aca860fa12186.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
87bc02114ccbac49b90aca860fa12186.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
87bc02114ccbac49b90aca860fa12186.exe
-
Size
227KB
-
MD5
87bc02114ccbac49b90aca860fa12186
-
SHA1
e0ae0bc513125379e1a110c6350061ae2a138a65
-
SHA256
e983456a1a1e3aea56c3eb4e982ce90daa1ad4e77b7948c71c3dae3b83ae0a99
-
SHA512
d74f11b4127491cf8ba7ab809f03993f33033e96a1bb9fbb2f641605ac7da6946f5ecb98beb89b3215d3f329d6687cdb0581e58ab7a9672be321af1d0b848ad9
-
SSDEEP
3072:gjbLl/gvQoutp1Tj4mYWR/RMvaw3PWsiCs1qiBeLNlO8hAg4pAXqmoaBUFCIGGmm:gjluQoS3Io5RJW4ATJHupAgaZGjRSjI
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 87bc02114ccbac49b90aca860fa12186.exe Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 87bc02114ccbac49b90aca860fa12186.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4836-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x0003000000022765-5.dat upx behavioral2/memory/4836-14-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1544-15-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4808-13-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4836-12-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4836-21-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4836-83-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3852-86-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1544-85-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4836-88-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4836-103-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4836-114-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4836-180-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4836-192-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4836-214-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4836-225-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4836-233-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 87bc02114ccbac49b90aca860fa12186.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\O: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\U: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\V: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\W: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\Z: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\Y: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\I: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\J: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\P: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\Q: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\R: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\S: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\X: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\E: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\G: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\K: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\N: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\T: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\A: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\B: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\L: 87bc02114ccbac49b90aca860fa12186.exe File opened (read-only) \??\M: 87bc02114ccbac49b90aca860fa12186.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\sperm uncut feet hairy .mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SysWOW64\config\systemprofile\brasilian cum lesbian lesbian .rar.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SysWOW64\config\systemprofile\danish porn beast catfight (Melissa).avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\System32\DriverStore\Temp\indian handjob fucking [milf] ejaculation .mpeg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SysWOW64\FxsTmp\american gang bang xxx full movie .avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SysWOW64\IME\SHARED\horse licking titts stockings .mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\american nude fucking voyeur cock 50+ .zip.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\japanese nude xxx several models castration .avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SysWOW64\FxsTmp\american gang bang gay licking cock .zip.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\lesbian hidden titts mistress .avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\blowjob [milf] YEâPSè& .rar.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SysWOW64\IME\SHARED\japanese gang bang trambling voyeur stockings .zip.exe 87bc02114ccbac49b90aca860fa12186.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Temp\gay catfight shoes .mpeg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\japanese handjob horse hidden bondage .zip.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\lesbian big .avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files (x86)\Google\Temp\horse catfight glans redhair .mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files (x86)\Google\Update\Download\hardcore [milf] (Janette).avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\fucking lesbian feet .mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files\dotnet\shared\brasilian beastiality fucking voyeur .rar.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\trambling [bangbus] glans shower (Melissa).mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\brasilian nude horse hidden granny .mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\danish handjob lingerie hot (!) .mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files\Microsoft Office\root\Templates\horse uncut glans .mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files\Microsoft Office\Updates\Download\japanese kicking trambling lesbian .mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\tyrkish fetish fucking [bangbus] cock .mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\horse [milf] (Samantha).rar.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\african beast uncut pregnant .avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files\Common Files\microsoft shared\trambling licking feet stockings .mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\japanese beastiality lingerie catfight (Sylvia).mpeg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\beast several models glans traffic (Sylvia).avi.exe 87bc02114ccbac49b90aca860fa12186.exe -
Drops file in Windows directory 28 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\hardcore big latex .mpeg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\PLA\Templates\russian porn trambling several models cock penetration (Liz).mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\sperm full movie hairy .avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\horse masturbation 50+ .mpeg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\brasilian cumshot lingerie hot (!) hole (Christine,Sylvia).avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\Downloaded Program Files\lesbian public leather .rar.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\american handjob sperm several models (Karin).zip.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\mssrv.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\indian horse trambling catfight (Karin).avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\lingerie big .mpeg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\russian horse horse full movie shower .rar.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\CbsTemp\trambling [milf] (Melissa).avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SoftwareDistribution\Download\tyrkish cumshot fucking several models upskirt (Kathrin,Tatjana).avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\japanese beastiality trambling masturbation feet .mpeg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\swedish porn xxx girls glans (Sonja,Jade).zip.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\lesbian catfight .mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\italian nude blowjob hot (!) hole (Sonja,Sarah).rar.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\danish horse bukkake public cock (Britney,Sylvia).rar.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\security\templates\italian action gay lesbian feet bedroom (Melissa).rar.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\japanese porn lingerie [bangbus] (Melissa).mpg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\brasilian beastiality lingerie licking glans mistress .mpeg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\italian horse trambling voyeur cock .mpeg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\assembly\temp\japanese cum blowjob hidden hole beautyfull .mpeg.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\assembly\tmp\fucking [bangbus] (Jade).avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\InputMethod\SHARED\lesbian [free] feet ash .rar.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\brasilian kicking lingerie hot (!) high heels (Sandy,Curtney).avi.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\indian kicking sperm hidden feet .zip.exe 87bc02114ccbac49b90aca860fa12186.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\xxx catfight femdom (Britney,Melissa).zip.exe 87bc02114ccbac49b90aca860fa12186.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4836 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 4836 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 3852 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 4808 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe 1544 87bc02114ccbac49b90aca860fa12186.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4836 wrote to memory of 4808 4836 87bc02114ccbac49b90aca860fa12186.exe 94 PID 4836 wrote to memory of 4808 4836 87bc02114ccbac49b90aca860fa12186.exe 94 PID 4836 wrote to memory of 4808 4836 87bc02114ccbac49b90aca860fa12186.exe 94 PID 4836 wrote to memory of 1544 4836 87bc02114ccbac49b90aca860fa12186.exe 95 PID 4836 wrote to memory of 1544 4836 87bc02114ccbac49b90aca860fa12186.exe 95 PID 4836 wrote to memory of 1544 4836 87bc02114ccbac49b90aca860fa12186.exe 95 PID 4808 wrote to memory of 3852 4808 87bc02114ccbac49b90aca860fa12186.exe 96 PID 4808 wrote to memory of 3852 4808 87bc02114ccbac49b90aca860fa12186.exe 96 PID 4808 wrote to memory of 3852 4808 87bc02114ccbac49b90aca860fa12186.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe"C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe"C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe"C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3852
-
-
-
C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe"C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\lesbian big .avi.exe
Filesize92KB
MD5c9e7af3137e8bee2bf766f7e4e29bdcf
SHA15e554f52ab55d6142ea1c662ff0131e56c7d8fce
SHA256bdc7386f4200e23d034ba77d9d65fd813342eed524f669509390ea4917f67825
SHA512e990d4aa120b361463c08cb4a80c580c08da7fc4613ad842840746f5ab310fa227f7fe21f4a5dfe7dad568410ebfbd042e84a4093711ed79b77253549900e867