Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 23:29
Static task
static1
Behavioral task
behavioral1
Sample
78ac357527dae071513e9217734993bf.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
78ac357527dae071513e9217734993bf.html
Resource
win10v2004-20231215-en
General
-
Target
78ac357527dae071513e9217734993bf.html
-
Size
251B
-
MD5
78ac357527dae071513e9217734993bf
-
SHA1
b4c90e48012c540e9dd6e21bb308f4dae886d9f2
-
SHA256
37b30f084fdf4a5fab7be69eb446b4613407eec20326df7349151f91abc63a56
-
SHA512
3aed3f94798535bcdf38a24d4d80520a7637c38673cc55e0a2745e12a17dc8413a9645f7d5aa3e582a7d278c4d0271d4f0def0f39096dd11c2d701b0389ab6c1
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000331c5cdf2e273a87e4cff789d0f129a3b79b769af4a2967b435607b9956c4ad5000000000e8000000002000020000000dc8338da5add0a270bb3222d2805769215fe97c7296f9b75c2f42d93e45b4d9b90000000bcc8b32248f09325d9a8360a8cfb58a7d8823fc4ccdd29ce2da8e7dd39c85acdfd7fbe2a3545716535fe28c58ddbeafcc79c49f3b4ebf4a37d3de11b2b87e8fbc40456b650fe0734779ac76d30444359b0006c359c1e7ee6fbc27e5c9383bd9776af4991495760049e05a6f25fd03eb7d0fb42a6ae543775edfb65b5199156cd5b8699950ed3aeec2a933b0123744a8d40000000f59b47d2d5e7995b618a929c959479ee0bd2995f99c5d9fea394c97455ca881b774013f1fd82584a75e1bb5b9c011bef3489ff452e4d40fa00611f27a1b40217 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000b57adbc7ae2d1b1447ab68c86d4ab8e288518c1c8edda27914ea4658ce175f2d000000000e8000000002000020000000d0f29a7fea05fe979557f4422749f839f8e288f1a7483740bf58025b416e78a42000000015968bd3115eb01ef287f32cdea63a354b75b1697ef6012e7f377df12d4239ea4000000094cecc163501f0ff6f280e4f0dfe8967973c84477dfb0541d75ce43da705f93a05b0b0477b0fe038c9b6a70ffda8973a19fe167ecfe6f8829bf3a562009aa14d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3AD8F61-BCA2-11EE-A835-76B33C18F4CF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412473617" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c1cc88af50da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2872 iexplore.exe 2872 iexplore.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2692 2872 iexplore.exe 28 PID 2872 wrote to memory of 2692 2872 iexplore.exe 28 PID 2872 wrote to memory of 2692 2872 iexplore.exe 28 PID 2872 wrote to memory of 2692 2872 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78ac357527dae071513e9217734993bf.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfe98918cbebbf90e951d478c0150203
SHA154cbc4341e92d16c634339257cdc35a6b568fe4f
SHA256ee432d88c7d678d863b55365150ec5ba005c4779183ef6cf59f4644e6e34529e
SHA5128327d77856525c578597cdd60220e6793dd4ec6f32222694faae59eee958b233caa4b7a31971e69e3d8197bf673c8f775f118f54725f177d42dbba3316688518
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5018ff51a5fa8f0e2d71a3ed48c0b6aad
SHA133a4353e33592ec11bb0bc7731da39f32d99e4e7
SHA2564ec4e11f7ebf04fa8b746e1a838e2e3666b60312a49eeff8bb69391acec4e995
SHA5125a5b53b277290e53f2ca1a6d70934d785d448de9984a9690687f5f0016a2c7ccfc6ed6da4caf133cbf5afd7f9140a223fe4a29a0ae31fd2c875eabb8bf530f6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d09b96ada23a006d67a4576d3cd81a66
SHA12ca4b7ecdcfa2bd32e35952cfd1d73edd9d2a417
SHA256a2b4682470d7d33bc7de6f4f38d419a06bb5d9cfc2ed0d2eb20181c3f10a7e18
SHA5125fdb8675fec124c53ea1c5e985dd71182d67393e74b76bcd859f6464dd6669e8618fd6def80ff48c328d7d694faa9fd173ac1a60f2955ed904bb1f8f5bd2a12a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2c188a2fed1e2e9c295d90a8ac3db2f
SHA1facdbce6c489843117f5ca42912ce36221a1a4d7
SHA25641002d1ffd2d6f0b9b9496091def2dfed846b22331ae9cf8bbb8745c51ac395c
SHA5128d85d9b1d7840667ce4286bec16ede9df223b18491b05bcf31892c22faf437ff69fbc8381ae30c94aaf7995313cf7b5b3aa5b0a8a5ed2ccfcbe83faae035bd7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597b5765a01722cbbf52018bb332f2841
SHA12a4bbae65aebd697dc3e9510a6b91e4a3477c6e5
SHA256eb8a3abe783240664411bf7f40c428d44181a8ed7da9f5b82d8c3e13c40e3039
SHA51268f242a1e8a64d1d1923cc578c4ff742781bfe8e8561561db453e6b242fa0ff1ac8a3531d170766834308bf89f485f9964a4735e65c8e9d9d5ccfe4c2dd24997
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4928b45ce51dd9b54a03f597c1a6b0a
SHA17feb4bc7dc2d4ac5ed589cb1b4ce8a20d66f2e38
SHA256b5e0ba461ddffa7ad64554872f72fc4d7387a2a2ba40a18cdedaa843a3b45337
SHA5120854daf6d29c3615b4aca024298308d8fa5524ce986e117ecb601ef12f65fee776c266d8c72f2be8fb5dc39a8d6e10e5cf56613ba2d08188575b9c60d8f9d48a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58760bf1ba98ca7f02576f884506b87c9
SHA16e9e77e479026a2eb2f14f3ba09b1e77735c26cf
SHA2560905650ea9bbd6987b835fab691f353585f77f9fa78616da5e1abe3f33c3a9da
SHA51297bb5577f4ed0456556d280658294038b7d1a93f7a91a7e89510a1ac2d9b928c726dec6077219fa5b5f1f8be5ca3df0849c441efc7657fa5c1413e36ecbc7024
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b44f058b55ed6435bc165cbb9f7af8d
SHA1267f04316413eb3597541fae52edc7b7d2ce59ab
SHA2566ffbec70e64db7051dcb4ab06ce32ad3c72d2f12dd42228e29376b70509dbf89
SHA5128201ae4d793643356d5159fe1f9e0647fc290a1154e67b3b4856bacfec46ceaba53249584ddefe68a8e10f02e143bffbe41e5e795a78764634616de1b67f8404
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da951e8438c7c9e715c1cbb5a8c21010
SHA132b82f2821c2caa2eefcb3206428e3d902a10f59
SHA256611dfca64c7ff9e023d879f8fb8d091824179ed668c8293024f7c508ed1bfc82
SHA512a998a888e1b3ef392046959c6eb82b7de815efd1ffc4fc25e52985fa5232cb8614c530f9dd501dd9e7ab0cdaf7df9650c3d66a0d1e5b817421b791c4b941952a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cf50e8c450706a37a9504d5031dbf69
SHA172144a12e9eaae76715ab07b147a942eb63e6ec0
SHA2566d00353d181c50603f4d663ffb76ea6ea0a7232159dd5d941cf5fd0733d428c0
SHA51236fc2e77d9286731c693cdb956d04acea28302e7bd915d5a32f54d32194cec2f9433b377e95706da3602dfd024b4ee04255358de2e8d67acc63d53edf8322098
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581fa5a2f75020a0593669d5d7fcb991c
SHA15aed0f0cebbefacbe7393959c75c313de7c70708
SHA256b4946166d65f6c2b7a39398893f61670a94d26436fa11248931988f88c84d813
SHA5127d2a95d51b7d92b7f5c8447afde99032702b602874b1c9b71feecfecded507d98851a40cf1007e6d2169f3462e744a3d719adb863d05aeb08e1b87227dfdc7ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9d767e017a57472f938f5311e78b2bf
SHA11831854e70116406938ae9059156ff63f9a0dc67
SHA256e8082eeb789dc32052355959e1bce649c93bd8c89bddac10cba5814ec479f40f
SHA51200708d22ba1f4e3503a66ad6af06d2231d5d202aaa3367325138a6dd53aa7e9f38fcc84b47c5f645a2568ef38c3f65603ac79417597c1ccc12cee053be3c4f8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aefa65b5a4394818d8fa87a72649e4f7
SHA1b31221014baea71e138683d27b6ee6386c4635ff
SHA256230060b6319b811c5554a94ace018969fa11ef4f36cc7337554662f1501d7a47
SHA51298e95481308275c5815a9c8265ffbdb4093d0f4c29e130aadf7654710f7a7e99e2e54c9eb6a6a478fd24f6ea7cd6f0138c4b4b712f81c7277dd059e60d1c2ead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521939159835202276808a858a9ba347d
SHA1653d46d208a8449399dd7e30ec06e577693a02fe
SHA2561bc75c865fe5ba123bb0d62e8602b1cc4e0d35b831bf01ce1b1e09812b2d0cfd
SHA512e5381e3c0cc1b9418e4eae1a81080242296a49cad16bded1a32044b2814f55e63f20c3d4fddecc4f3ce6c3e22c942f985349f3a7dbd6c1384d54509e82b28ba1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e1840f77f76170bde2b9e5afc06a231
SHA1169c2f0831cd34000ac82dcf25f859ba5ef167cd
SHA256f44bc90c4fc7cc6e5d0521e7b7d175e1dc74019e93bf8ee65e383d2af2f111b0
SHA5122d8d026719a857d0702dc68a0582bfca1327f8cc051f48b5932dea1de9db824e7ac3d66ce917710fe9ead8cdb789758d7a79e075e00850d103fbbbfe1593bca2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cdc8b43a5eb2408c435acd1493ae43a
SHA1025fcfde5f4b8b20fe8ae1c9a5a3fb0bd3b52223
SHA2566bba23b6fc900845e4c29df25ce7cc30daa945c74374ba7b7de3ab29e89f31b3
SHA512108d05ae3521dd4e4a0c64b96d8970c5d3df8a9928b0d5b64747eca3eb09d12fcdd6c036b0df6ebcd42d3032586b8517f965763e691a728075601084fd92eddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a014910401ea72a949ce00b8b69765f
SHA19a509ef4a6f791ac0a60420321d79fad9a420fe4
SHA256e80c73090f3cacc1a6355992b5f64db546b5ffd5051bd2e8b2c6a08d8f93f6c1
SHA5128ed26d548944f3ad0beed68874b0859586ec75dd2ef0b4105b35634f929aa815bb1a98e49ae05f16ce888436f775e5e2cbae6ce7e94a8a7cdd259bdd0cf2b145
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff227b247c7eb757ec0c61f3cde3ff77
SHA161b3854665c2c86029d72a0a76fb17e7e439d9db
SHA2562dffff6f169d885bc5e29b22f2ccef7608c3db6f0832d54e8c6de7f6cd989902
SHA512f9099519285c0c52fc5e5997984a34f9cbe6de6ef059a7c1eb4778ccb3d1210bb4092ec630cadc8518cf7ebb01193d403c8f2446133a20d688f887ad8ffd28bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef637c5e1f1abdc10498ab5b950c291b
SHA1a16a1f57a2751c01eb2748490275c78d23858187
SHA256757e2abee142fda1e01c7dfb4b1cc4927afed5c9ac73c4b01d22d08c53eabfc3
SHA512743f8f4a5fd7d5e6f22f332b5702101c9355c22ca5e4886816f29182c40538198d1dde20ba1d9720d660350139bd21e7d338db0bb9c74dd601025469cf1d8107
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5177ef705bb6a803b9153b8e6fdd4bd2d
SHA1acb49acae2621e4abdeb4e0a0517ee63a9e56c2a
SHA25656c06c2cd658d06415f6777cfb3496d5f895475817bc7d1b63d2b0a24e5123ff
SHA5127aa8f7f5de3aebac08d5eea9e2cec392ed5cfc13073b6feb4c1666648676e051b8db60d966a71e256a10ff3a9c46cb19b8bb6be53aa56aae2e8bb6d22e89af51
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06