Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 15:33
Behavioral task
behavioral1
Sample
7a9d8452bd42b564f5d7f002800e2f16.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7a9d8452bd42b564f5d7f002800e2f16.exe
Resource
win10v2004-20231215-en
General
-
Target
7a9d8452bd42b564f5d7f002800e2f16.exe
-
Size
13KB
-
MD5
7a9d8452bd42b564f5d7f002800e2f16
-
SHA1
bc9f331365078095baf8d5c5a0351127d9d28acd
-
SHA256
9db76a27ef225c7f3128d2fb0da7960e72f14d7402b4727111c1c406b0234edc
-
SHA512
740bdb976183e100122ae13cf73887c4fba27bc9c59fb4e6d30491369f4072d116a8fbf6b841028959292358215289e007e416ecb95366dd31499b2ba0ca42ca
-
SSDEEP
192:Lu5POEuXky9UAMG5Twv7E6wVU2D5r9ZCspE+TMwrRmK+vhOrRn:0uXkymAMCo7Nw2TeM4mI
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2364-0-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2364-1-0x0000000000400000-0x0000000000408000-memory.dmp upx -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3040803d3651da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66FA13F1-BD29-11EE-9D16-6A1079A24C90} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412531469" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e1def4944e6a1ffe532652db854412eb20394a63e13b393671ab6adec23a869f000000000e80000000020000200000002f036e5b806c6b6d85d77831bc4d0d1ce05c383ece2a5477b422400e94d4430520000000830eb3ba7c53c279de14898f5119bf425a0af54920f1b6b1fa9854f09066f84a40000000e5e5395f33636ad3bdd91b2e8e1a7e09764c1221380a943e39bb2d2a8b2bfd32ac8a8dce08eae1409d5817415f325a18dd7dfd6a8c20a11808741af2579efe13 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000009de2b2b962061a4bddbe84c5e1abb0fecb9053f4643a17ca2948ded9db26c348000000000e80000000020000200000008c3046b7142488f05f628f2cd057bae21fea0f5f7b1e061434c250e2fba2f2d6900000006fb5b833ce770e4db706b815428edfe94ba7c5232b23bc59a9908ad544bb03807d84e3ee73429b898fe7b85d2fe530289ad6957c40ccf1876453e83561673e7cda7adea86c00671ebaa454684b7be226da20c1809fd5cde92e562d7cebd80483a31c449fb2c756f33e8d91e5e8e6f6f471cb8a6c5d036c49599fa7dfc570638d797cf23dc628b679c65b0490eb9e607040000000f7fff19b2e60c5d400a781fa4990a69f392e23f355fc26a8097c9cfeab5ddaa2937c64fb58fedf5127a62573cc5234f010600f18f61a38aaaf296847938768d4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2484 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2364 7a9d8452bd42b564f5d7f002800e2f16.exe 2484 iexplore.exe 2484 iexplore.exe 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2484 2364 7a9d8452bd42b564f5d7f002800e2f16.exe 28 PID 2364 wrote to memory of 2484 2364 7a9d8452bd42b564f5d7f002800e2f16.exe 28 PID 2364 wrote to memory of 2484 2364 7a9d8452bd42b564f5d7f002800e2f16.exe 28 PID 2364 wrote to memory of 2484 2364 7a9d8452bd42b564f5d7f002800e2f16.exe 28 PID 2484 wrote to memory of 2740 2484 iexplore.exe 29 PID 2484 wrote to memory of 2740 2484 iexplore.exe 29 PID 2484 wrote to memory of 2740 2484 iexplore.exe 29 PID 2484 wrote to memory of 2740 2484 iexplore.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a9d8452bd42b564f5d7f002800e2f16.exe"C:\Users\Admin\AppData\Local\Temp\7a9d8452bd42b564f5d7f002800e2f16.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://ads.eorezo.com/cgi-bin/advert/getads?did=4332⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2740
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd42ed205c23fce00171486293d2718e
SHA182ee7e107d97e4299ea81046e2003376a9e197bc
SHA2566e54c3bfdeca60a11b9d3074d8298807bfd60a7a1c05bf32c5ec03c5e55ea487
SHA51260c3ddf96a1eee5b2052bb38019063c3ab056c6798858daf42383da5b19747a45fd46f74fecf61a2fc1b9706749dcc5bacab1433c85b5b8503c5a5d813068656
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b489748f195ccd044e33298fc8188c9f
SHA1d8554609ec85330bc54d9a00362ba20040564fa1
SHA2566cf9e4161bee593aa108fa0eb043ee96a3a9f2a5d04ac7ff3f7d782bf78826be
SHA51284cc4648b37d62db7b3fde6e110dbdce117b2c9d66ebdb27d3dc8008bf08ede90de3fd2ac5e9932ef26978455f69f2258209c1c7a9f93cbb70df2fed107af3d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f40e32b491d86351e808f400a398864
SHA110ed63cfe754cab44322bd33d65265348661b1e2
SHA2561774047aa51fbbe7742eab4595b7ef8ff4b7b5a5e2e4c1a1bbaa092edc4cea0b
SHA5126b80506b29846c12d916101d4cedf6138d411f4c63bb631fa696dfdeb18a32058d87b473fdef82a8ce9da20a59be0d3fe6fa9042c7110cf74d5adf84a3a0d059
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5134d6ceca91acc56cbecfc4aa4020f4f
SHA193f6dcd82e248b87f2608e30a8b2a616af397425
SHA2568dda29027dc585ec9055f94203b63e96f8eec1172a7442fdf71c1f4aa70c57d9
SHA5127dee54d19fc6d48bae0cb133dcccceaa168825c144da7d52fe1c47572ef0381ff611e0ae7d707b1a512df10c86f0da6fca4ea41dcb5f1fa6676f5a646032de6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de51b8b0d2d20c912932c8b960b5aa06
SHA152950c9bfa16c4f9e0811f8c9d0361aaa7c874b7
SHA256344615cec0571e2498a12c1c0b8113e15164a19c62ac6b7cb3e3777113e758b2
SHA5127db0bc5daabae4adba7693631f24b277c7b478f80601a63279204f23d23ef290c422cacc76f3df4940d740bef7b23da274ed0a840d9ba5d4049819afb54c23c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50619d3fb4e3ebafe5caf656fd0190730
SHA1ba5bf8f95ad192031c8edb4c1fa83d9da8e6dc7e
SHA25671b3febbdf41625fff08ccc216e0625623ef6dc69d779debcc8e8fa128adfb7d
SHA512ef95b5d7c136f2c67c944903e134819980063902257db2f22d82aef88b234168b3fb3c454d65da5126887e2b2b10276e9a024643b2fc0a16413153c313d09ee1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5644a4dd1be161837ccf85b3749a02d85
SHA1f203f915104c818f1189a7fda7692d40aa5eb20d
SHA256bf74de98df12676ab5d40e941880d9d0cb56d86847ff360578fdb96fa9e5259d
SHA512aa26f17ce910c49ac1c9c88b1bd322a20a9b6bea5b8cbe435adaa036ca20f992e0d4bcb8c915548e71ff86b5f04231cffaaacd5cb046f0f33fa83fc0abcfcfb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5522527c02021fee1251cb421993e905a
SHA11a71b121deac9db677687cd396dcfacb2c19ea2b
SHA256eedb14f4d01d1c96070b993173191356c69d07e1f3931bec14e7e5ad96b17e32
SHA5123962cddcbe8233883e1abe31b2a508a02c3dfdfd31ec488d5823fc4fcb9289b41eb9aebc77899e334d81659db5591c38dc60d7f4c32b6bd80c595fa2b3dff5d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54eca1fc1834ee09545f54659aff39d36
SHA16c6fd98839f61808777f083cce033e3c7d18bae7
SHA25672f565282ef48bccabd18ee439409cb7c965e7a2ac6454cc1690b032e33956d1
SHA51272407f91e8b55a08ef23e73b852007dcb474eadf6517ec220b5e8cb844b067202b41d8665f00d5cb1b7871cba0f77a42a8bc574ecdfede9341f72806ddef0e3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528e33aa0f317f4102602e8fde166ba2a
SHA1b26199e90f86ffe1e7b46a7112abaf747b9342ae
SHA256478a76ba293f73ba89542b1745b3eb4233759e4e90a2e8f50ca45d2251414a86
SHA512162118c0cafde87a61263ab7293fd173a5fd84c9f8f9929c788f1a7b6996aace82acce3799cd4128297ac44e3d6fd84c1939a75bd32cd5a87447aff92b37f341
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512cd30dccc61fe41587caf0ae633a09c
SHA148ce6621366b1a2613673170cc949f58683dd282
SHA2564e698fb24c97fa2a3374f9feb4c41d0a05b216a7bf33d72f2b845ffb983fe385
SHA51245aa6edd2f46013be8bb3a24e0f762fa65e30395efef6edbe91abfa4fac2d85f41ca8a3d1fb9f9b2302c804d31b2678a4da608415d4e069934e0e4752555ef90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509cec15ff1d482e1c62f775e73ff7987
SHA182b6b1be2fd41d45558517420d52ac0682458c38
SHA2565298d1b854a36855633fe47de39e799f27da856d7494ea5c70bf5aae1c7eee9d
SHA512a413bfcba6a0cfe8c77ebd6b741aba50b8a4cb2168829c625c39fcacaf543bf2af3fc4517031fd711d88ca946fdb324c21d43fc33cb81291e828e2127e33ecf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1765b7a57003ff0833f0d9fec0a0a34
SHA177f949211e404e32310d54c126ced0e580b91313
SHA256845896d4c060f457e9e3d309f548262efed423dc81bc2a8547cff37266644bdc
SHA51237ad1f11863c97cb6bc6d8d172c1a67f4c02c68ce10cc2e27bc199b53ce9efdbec1c0b0045745f6a5379bea1d57a085aef78c2a498a4f899912d38a530c09a7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d16b956925f509f3f0dd6c46a97cd36
SHA1ccebc042f51accf86d44ee8b4aa9eb52b070adcf
SHA2567e6ea2a0ead73f71be9b0c5f9d8d9ac5c0a6bd43f1c180449b95f87ac551103e
SHA512c0e13224c2d7fc9fe77577545d2c61a2d26deafac2cdc37a367588ee0d8a1297d600641cd835f896c47f009632274fa6c1b514db410675131d061f3e9f32867d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb5d1383801c4fccd377c6efa41ba150
SHA15fededa1a836cb25599f5b7044eeeabf73210186
SHA2567c47a7f83c09a23a573abe007c37cea6f2df680e9aba00944ab0315b516504cf
SHA5122c2ca2b73df4870401abef4d7639b84e37b7e8ef31cb0e785ed3dfbca78d50de68f56281ea030fa55874d472ae952f9a6c3ddb30833c6c9f2434a29f12ed3946
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7e50c2560d4c622b8297fb1ed248f46
SHA14b2416f6ac618549308b59d4d846edcae96ed6e7
SHA256f08d1a69964efdf505e16962fb4a64e18df8d3f46f010266c0334ddaeed3f109
SHA512a028bc1e68ab84ff29dd1f9a6be5fd73fb97252532a5c7853e7f48352e1740dc2a9878d5d18a1071df1c19ab0e5456ca0e653e265704f051ded0899ac41ef047
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ceb292ca075aaeb21ef76d4586576f0f
SHA12ed1c1add41d562a6c7d34544b33e904f65ba207
SHA256a4394973f901686a9100f1999c7a8ad34f3de3f0372b7e960429c0718459fd4f
SHA5129f2671526dac26bb07a9aa71280917c67e5c7746e91be145a5e1622a7f34c97f661696ba518d3965cb9d5e25dac16450349ba97926e940c1d02cf66d8aacb469
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e94d256f7a9666637b7031d9445c228
SHA19e2f839f8568053402644bdf19ed763f0e540101
SHA25631cfcc8f2e3b019fa307d4fe95413c75c1845453eac220b52af0f4a3fcede966
SHA51203f2eb9dab940850c460bf0427ac4a84492693dcae08d14816fc18476a8a38136017b10757363ac5f1ad79a3cc9794742f2b5e5eb3d0b927e2616891e107c262
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06