Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    01/02/2024, 10:03

General

  • Target

    2024-02-01_34017a6d882654d577ea103beacf1aeb_lazagne_ryuk.exe

  • Size

    11.3MB

  • MD5

    34017a6d882654d577ea103beacf1aeb

  • SHA1

    ccb2317ca566732c1f39cbc2e30816cdfd875164

  • SHA256

    1b4be79b92b91838e42c9345f652b0c961c0c0864772062b2ff684527c2839f6

  • SHA512

    9c18abec4252c25308166aa89d10e0720dccafc0e59717cf409803a4fecdfaa66e50eba2065df6661a8e43a5decf3acfa6f3453e22565f4a8249c45be1fe6a4c

  • SSDEEP

    196608:9cHu78K//UoEkXuWJysVYvsOfhumHhtdIQLOMIdiwXa6vTVzy/BOfN1XZuoJnB:Cu7L//HEnWJIuahtaL/dg67RywfNxZuu

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-01_34017a6d882654d577ea103beacf1aeb_lazagne_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-01_34017a6d882654d577ea103beacf1aeb_lazagne_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1540
    • C:\Users\Admin\AppData\Local\Temp\2024-02-01_34017a6d882654d577ea103beacf1aeb_lazagne_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-02-01_34017a6d882654d577ea103beacf1aeb_lazagne_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_socket.pyd

    Filesize

    74KB

    MD5

    10cd16bb63862536570c717ffc453da4

    SHA1

    b3ef50d7ac4652b5c35f1d86a0130fb43dd5a669

    SHA256

    e002a1bd6fba44681d557b64d439585dba9820226e1c3da5a62628bbaa930ae3

    SHA512

    55ee581c4005901661efaf9aad6ea39b2b2e265579539d464d62e4209638567b3b9fdd945d0bed0a1047f977d374a5707a970c621ca289077e2d6c5aeca491b1

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    22KB

    MD5

    20ae5bab58dbf000696a24d009c24cf9

    SHA1

    a601c57c4b357a183a962007448ae6a47c066c98

    SHA256

    aaaea589cd89555c7e5eb464d1f98a1e47443767d2d7571bb11e924afde9b1a9

    SHA512

    d9e5443d7e7a63fe1d380e38add178fdbc080f67614f13882c8b0f933b01c5f35f213859dcc772e6068f5b24345c707834f4aba374deea0de339206f65404134

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\base_library.zip

    Filesize

    645KB

    MD5

    30f2468ef0404a10584685495005442f

    SHA1

    bab36c3e076af8420549e64a6f297fc3f9b5b5c3

    SHA256

    a85755601c42b1599aeecb472b6be9f6db87b05884836eebe812587d241df990

    SHA512

    fc84cc06286b32d36b1157cf7f89e21419c8bad3ee8b6eee1f5aa9dc8a8cf39e56d363e4dfac11e3259a2f0078443049cd4617e4710803af3add28e54d520d14

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\lazagne.exe.manifest

    Filesize

    1KB

    MD5

    6fe7232e13f5f8307c037b54fe0dcc10

    SHA1

    510075454d9179d1c6669df67f126213aabcb99f

    SHA256

    4996109560a79774034a05b398d64b1b441c49f0f03682c4683554c59dd47e5c

    SHA512

    8893febd884f6411025ff9df7d0ef2dbc756baa93903423e805b5e981273838567f2ea60d072d4d98fe9b2f2c25a85800522cebc5e832a3256d4c10605085725

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\libcrypto-1_1.dll

    Filesize

    339KB

    MD5

    6415b9a7f34cde435cdb79ecd3b63b0f

    SHA1

    9be0a2aaeac12d8506962b184bf3339b34da43c9

    SHA256

    780bfec1211a1e714f09d7dcde2515cad607f6966fbdfe1773df4b25951e3ab5

    SHA512

    58f095c63eafc4d88928b2f96c46e63ae487091fdaad027b97bfed0bdff6d4dbd18ef0d985c0b44f22b0ec9f522d0097dc2c92673c351d44f55683edc22fa9e8

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\python37.dll

    Filesize

    385KB

    MD5

    4b71ef85bcdb81aba272fb1813d13912

    SHA1

    d2b545d64fe95c784da6a6f1162057cf4953a0a9

    SHA256

    7fbd39a2245723bd088ee9a865f686af518a7680ab5da4ce849e4f58bf3f4ef3

    SHA512

    f8734d3b01fc8f730941f775f49274947187539d8e8494006b171f878c92b2c50643a1ae9ef1566421576640ffdb7e4ec616b8ca3c211e687b3fcdac84d6018b

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\ucrtbase.dll

    Filesize

    355KB

    MD5

    58300c65bdbf9a9712def92438e02edd

    SHA1

    38f9cd8f58dfe5aa5d5c4629383382c46e250781

    SHA256

    9381c4c7791712afd5e3b2e3d4d3fb66830b5d33e684c7f324a963c672188e67

    SHA512

    ea0eda2b739a2b1718eb076859f39b0df490d8214f55fde7928c32de585d1463c1360a97f2bcef4735c03641d736de7fea5f34dab6b0295300d95686ae28e1d0

  • \Users\Admin\AppData\Local\Temp\_MEI15402\VCRUNTIME140.dll

    Filesize

    87KB

    MD5

    0e675d4a7a5b7ccd69013386793f68eb

    SHA1

    6e5821ddd8fea6681bda4448816f39984a33596b

    SHA256

    bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

    SHA512

    cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

  • \Users\Admin\AppData\Local\Temp\_MEI15402\_bz2.pyd

    Filesize

    87KB

    MD5

    92075c2759ac8246953e6fa6323e43fe

    SHA1

    6818befe630c2656183ea7fe735db159804b7773

    SHA256

    e7af6119b56ddd47fd0a909710f7163d7ef4822405fc138d24e6ce9de7a5022f

    SHA512

    7f3a4409859695f53291c96dd487bca2649815bad5f4610c2c6f92777411d39210e293d962573a20dfe73ea15331de7e6c18b017ae1d6f226387eab1fc1f586c

  • \Users\Admin\AppData\Local\Temp\_MEI15402\_ctypes.pyd

    Filesize

    131KB

    MD5

    2787764fe3056f37c79a3fc79e620172

    SHA1

    a64d1a047ba644d0588dc4288b74925ed72e6ed4

    SHA256

    41c593c960f3f89b1e1629c6b7bd6171fe306168f816bef02027332a263de117

    SHA512

    1dc5bb470be558c643a3f68e23423697384bc547b1192cd398dff640e28f7df85563bc87643cdcde9b8b4f880f272e13a673a018ae251e100bd99790f993afa0

  • \Users\Admin\AppData\Local\Temp\_MEI15402\_hashlib.pyd

    Filesize

    38KB

    MD5

    7808b500fbfb17c968f10ee6d68461df

    SHA1

    2a8e54037e7d03d20244fefd8247cf218e1d668f

    SHA256

    e2701f4e4a7556adab7415e448070289ba4fe047227f48c3a049d7c3154aff0b

    SHA512

    b4239e792141bcf924f61bfd46033934337079b245f423b34820d36c6599ca35ab06bc525acfff4cafa75e31975fcd0409dedd203377d642fc5dc55ec2c1fa27

  • \Users\Admin\AppData\Local\Temp\_MEI15402\_lzma.pyd

    Filesize

    251KB

    MD5

    ab582419629183e1615b76fc5d2c7704

    SHA1

    b78ee7e725a417bef50cca47590950e970eae200

    SHA256

    5a45f7cd517ad396a042bc2767ae73221dc68f934e828a9433249924a371ee5e

    SHA512

    3f38441dd0b88b486dafaa1e15d07f0ee467a362c1603071a2fa79de770fa061ced25ca790f0d3139f31178c719cc82ac88601262e2a0ca809708dfa3f6f76ca

  • \Users\Admin\AppData\Local\Temp\_MEI15402\_queue.pyd

    Filesize

    27KB

    MD5

    a48af48dd880c11673469c1ade525558

    SHA1

    01e9bbcd7eccaa6d5033544e875c7c20f8812124

    SHA256

    a98e9f330eeaf40ef516237ab5bc1efac1fc49ed321a128be78dd3fb8733e0a4

    SHA512

    a535dadb79c1ca10506858226442d1d1fb00e5d6f99afa6b539e2506a6627a7bd624a7ee2bc61f55c974113de80fd7a95e6c18e9402736d32d5099077ca1b913

  • \Users\Admin\AppData\Local\Temp\_MEI15402\_sqlite3.pyd

    Filesize

    84KB

    MD5

    244d92824ef54b139ecd4f2b58a5d9d5

    SHA1

    ff5696f6e3dc42e578a580299ac53d8c5e11d917

    SHA256

    fd55c3e3b2863425050619b8d42fe19cf06c1c8e2e11f7076e1f4422663e6851

    SHA512

    10fba938064bca2b9163d6c0d0a0361d0ebd896e32346cade3e4a439475c223ced59ac8f9c51727d5556149b14990ab62ee6769c35cf067aaac5d63dd5d4688f

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-core-file-l1-2-0.dll

    Filesize

    18KB

    MD5

    f58b1e1f6168d526473289f5f15cc66f

    SHA1

    ef9d3d6307dcbfc3b357b2dd30a75b08998c09b5

    SHA256

    ee778641ebc47383926d62d56612f25487151a183d76e3a2d013f658f6917918

    SHA512

    1278a6be2baaf05696c22db325faf2c90bc319fcb57daa6fcd2f2d95c1074797247d4a5df4d7e46f7177f1da07e9133f45c61c28e16a71b8d82ff627671b52f9

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-core-file-l2-1-0.dll

    Filesize

    18KB

    MD5

    6a6f368802fefdd7c62cfa942e07ae51

    SHA1

    1012e2163d64b374fc784cb15205010492879d5d

    SHA256

    b7e6f1144d596ee1784359f384a3498bab32804add8c24bcf65964b413fb508d

    SHA512

    0dd5fb0bd23c8215254447d6e77d5bf95df8bf1c2e9f6f27dea1040ca496bd4135b40efe7f3bd4f8ab8300456a582b1596aeaea495dccab8fd4c7acf3c0034d0

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    21KB

    MD5

    ac718755753807cef7c5026dd8a58027

    SHA1

    4b39d0a3d442fbebcc7ac5fe35d3752dad87f58b

    SHA256

    b0418241a1c8c2ac1a230d586b0200f9e1033d1833dfd5f48719a1b611ae3fbc

    SHA512

    ef9b9f04ec1da1c63e1d1e8bdcf3d929dab9725383f58c94554aea801ef39f47c1a97115a57b4ae7390db59a979478940ea9e2b41003796745c0bfb159955a1e

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    19KB

    MD5

    833aa996973b87eff6cdfea246d22999

    SHA1

    b89dc8d3f4aa772e32de79bb485c48054aa64361

    SHA256

    8831b1419c675ac71305ed616fa6aad97b068cc55796d1afc7593a1df2491226

    SHA512

    dfd12536e519f45294daa070aa35a8b1d32660e718e894f5e782d8bc093911b32f01052a1a9a79746e604b861d3794a4fef3b5bcad900c63460f243ff31fd416

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    18KB

    MD5

    efc8f224ea2f4af24b13329971cf551f

    SHA1

    a16fdedefe4bc6201243301624329525199e4f8d

    SHA256

    fea7c286fb3140a8d8739f2961a524c00dd0ad086f1d4517b74a84d7bb7dc18b

    SHA512

    5405abb3a52489b0c6a94cc1b840dfae2bded14e53f39bdcd4b8d8f0d8bfa9b43138d5a6eba1a1804d6fc2efe4dd21df1e223d4c77dd07bcafdedd7a4031512e

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-conio-l1-1-0.dll

    Filesize

    19KB

    MD5

    5e7d46dd3aa282ea86a4e35f4753461b

    SHA1

    5a7d5ddb39b8c75f4cf6a8724dc2c6b33393ed1f

    SHA256

    07cc434e4af6d72a0e2e4313ca2be77dfe0b3a7de9d71e08131f840e0a6028d1

    SHA512

    9522b5aa48fe5098d72ec85dec7aaf02ff8394caf967a5b67d9c88033a248a22715b159ff3ccf58e1b9e6d3470c403c6c45ba17527ee9f4f1c302e161c0cfac1

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    19KB

    MD5

    08bae65704d7f953c89be68fe2f27f85

    SHA1

    e09579903b7fb9ed8fddd4ea7af800c71d4278e5

    SHA256

    8fd3e70e50f9087d73c29fffd0e16bc644c9e0e5802f2a5f07b6d3b5c0b4b0dd

    SHA512

    34bd09c7a22e34ce75ad3f4ff7cf93143600c9bbee24207d9711f731f68f49804ad2ac4843d58f224d22100da3ee779c86c6df1a87179cd74b8df74b7fea4e65

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    20KB

    MD5

    baac525aac4f2735d60692a6b9e3ba52

    SHA1

    ef9188a8daf0d7d1740aad8c225845ca2fb82c66

    SHA256

    92baddffec31289e7dafc15ab56a49d93ceb266e0f0d120a5ef0fb1bce20dca1

    SHA512

    0fda206266e44181f83b4ab49ac9b0a3e75a3fc8e86dedc74e3ed7517a6af950e7f196bcb2cd50ae220cc5ce4c2d58ad4047f8aa9da57ff3645a97aa653618f4

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    19KB

    MD5

    5bff09fe93358508fe966cf8ca0f81c5

    SHA1

    da0e180079ed9a23a03b6181f44a6db40f7bba22

    SHA256

    1ff08dae5644a72047772e616537f4bd80414134944eb49168447e14b83ea9b4

    SHA512

    cd01bf9db64cedc6ee1abce8e4cc880aa3473961d3c4d5a93b61b514ff9665ed8929b8f2cb4000994bafcd07ae708fec6ae99115e5940b4f95acc0bc865c6cdb

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    19KB

    MD5

    8636ad6ba8c5c9efcd5afea665ead4ca

    SHA1

    858865f45405a99f50838806de75cc1cf06cce64

    SHA256

    7788524de88adae43062d96d50a912ddb5ca2afbb527a628a87f842a98bc5e0b

    SHA512

    bd9d55ddcecd1631c29f1ced8a1e7a82ff4435253095ee6bbfaacca60f6321fc3cd5f67d632e35a35dcc8b604cb7a13b378a0bfed340bb7f77ac207ed10cbbe3

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    27KB

    MD5

    08fea493e6cb3cdd267b9fc9fd0c6fd7

    SHA1

    447427cb9edb6ca4bdfc6a63a95b326a0ab6d55d

    SHA256

    93b7d156846ef90e76fdfc05987c28b437644f0592acd82b179fc72b8cf9c395

    SHA512

    ad78ab3774d79c400229db56202e15ad22e5a14d20e9d5e554f6edbcb01ef18c9c1bcbc6569ed6b698cce1428e15c63a970b8f350c862a580b468a67401793dd

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-process-l1-1-0.dll

    Filesize

    19KB

    MD5

    d911e8d952088498848600dcb20efb2c

    SHA1

    e5afdec39480e945c12ef86f77bd719ccf4b1de9

    SHA256

    9ce47ff49fc0dcab1ad8ee594e218d8cce299d5e23473ff1ecb868023bfcc533

    SHA512

    88fd72d76f57af3d925e757532bc29317a7f35b7eb0d00b6534647fee6162e789d9a03ab9fed9e1af357745bc6e765bbc648f5ffac49c11a6d7f2bae2c071a09

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    23KB

    MD5

    3424b3cad00b22c071b2bd376084b8b0

    SHA1

    92cdc77411fa5515d188bd34d921b45e1005b4f8

    SHA256

    9d42ee159384e8b1aa98bfc5b59a4dcdd808cac13d0ee9457dc5c19d3020c55f

    SHA512

    69a71d9dc3a27f2a5253ec98cb32d8961a596606c6f260704a7bcfe77aafa590df9da9ebb88b259926e20efbca18f0bbdac5d18ce97e467540591f8e9a5f4b98

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    24KB

    MD5

    c9dc0be8cb2970e4c49094ccfa16adac

    SHA1

    2a38ce151ce9c93ae0737d29fd358224f535f566

    SHA256

    9e531d7ced9398b85730e9887fe986aabbbe0247f35db2a7a728c0b9278495ff

    SHA512

    efa3b09de2d4ef3783dbb8db37820dd5e203a679666b821cdae356b0571ffc8ff6f364f3e4c37bbafcf0b024b4a2d2976326b646492d5d6d3dcef5a4ecd94a7f

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    24KB

    MD5

    742d61ebf0e70756fb017f80ea8cebcd

    SHA1

    6cc4d970c3ffd313b57c87a67ce1dda2a8b67432

    SHA256

    9a14823aa0cbefb03bf9debee20e0f593af5e78d0fe0a6de679146a680e99f29

    SHA512

    6fc30b6d060fcb3a4dd4852d8e3a2bff405954d17dd8d8b6e0d1ddac7fbe40246836d0785c3ea730eb8dbf17fd3d2dfba68ceef2a798efd846cf23c107335996

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    21KB

    MD5

    21cdb83da91bcedb3ea3463f736ce6dd

    SHA1

    de1b0764b7eaaaea2a88fc1fa564464bcc4bd218

    SHA256

    dcd26dd5137208abdfe22a81c0d97037c62aff59202db4e8328266a4b46ba2eb

    SHA512

    e9a72842284abd51b10df2a9c0ba38cd45704e4bc025c5e8c84c4e8afa98f164e7d051b113b35a8b3a691ad424557ea4074a827c18465ab01bded54abe22eb62

  • \Users\Admin\AppData\Local\Temp\_MEI15402\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    19KB

    MD5

    c681ce55db1faf84ee05e7b2ab3b6ed1

    SHA1

    aedd0a0c47602984ee3123a8e765ce847f5cff15

    SHA256

    b9fb517638bf7fed24177a16015e447527475531463f5a3c2a8e71224ed4d75a

    SHA512

    f45b4deb290bba6edbfd56d898adf164ae17af4284daae98c4d02b202acd9d2fb3eaf2d87544e912aa43c8f7b11fc176043bd243e5059612cf2287a14e97de6a

  • \Users\Admin\AppData\Local\Temp\_MEI15402\libcrypto-1_1.dll

    Filesize

    305KB

    MD5

    89da4c465ef3d94c9c867565bfd2fac8

    SHA1

    0a8128047fe20f51a7ab87ceedcd2678349ef197

    SHA256

    27d30339706e341c66a2091e91f68d5d4ebbe965fd95f3fdd1e01e588f036c49

    SHA512

    f8606f79a0c9e89ef0daabc44ac91e21ae91049f408dde2fef78593928b4abbaa74e3aedc4d881bc9a8fc44da3f11e4799be38bc73724bb37103b6608b8c637d

  • \Users\Admin\AppData\Local\Temp\_MEI15402\pyexpat.pyd

    Filesize

    194KB

    MD5

    02d615171b805cc573b28e17611f663f

    SHA1

    2e63b78316b4eae6ee1c25f1f10fbbb84ecef054

    SHA256

    e60b5cbdf7480db1fc829e05ce45703d43d5ba25fdf7fba21cca1d38b1f3b3a4

    SHA512

    b61cd3d16d1a192016a50342ae71fee8f764c4c156e275a320f74cc4ec65755c91c022231d09a76b59d6225960f5a930f1887003b1d6984beeb5a9648b045427

  • \Users\Admin\AppData\Local\Temp\_MEI15402\python37.dll

    Filesize

    338KB

    MD5

    3e3ea131f1454d14d17b9d102e783b68

    SHA1

    667f956182c3b1e2216b9735363eab2ac5febb67

    SHA256

    8dbdaf3644b8605a1731b7362141255261eed9f931df926530242de15f138439

    SHA512

    729c741bdc5e7f646de7c38e5e5849c73dde9bd135e13d21b50c635417117c9ea44fb7cb1241fb52e8987fc331968346d3aa28aa5dc8133a2c73bc4d155a391d

  • \Users\Admin\AppData\Local\Temp\_MEI15402\select.pyd

    Filesize

    26KB

    MD5

    39b7c056bca546778690b9922315f9ff

    SHA1

    5f62169c8de1f72db601d30b37d157478723859b

    SHA256

    9514b4c40c35396b1952a8acf805e993a3875b37370f44ef36ed33c7151412ef

    SHA512

    229538131d83299ea90652818c99972c1ee692c070e7fea9599420c99dd8ae75fb2367e9509aad23984fe0a8d21221a59bd57493b5cd1d6c7391c3c55d714e94

  • \Users\Admin\AppData\Local\Temp\_MEI15402\ucrtbase.dll

    Filesize

    317KB

    MD5

    da1536aa3e45817a1b182045c312c34b

    SHA1

    b78f505326a52310323ca9997021d577aaa68885

    SHA256

    7ccf39b2b6e2027ee31aaf4bdb5c2401ce0e49446e9a076b8f45143abd1942b7

    SHA512

    540e6f1f78a39c302d2467fba7d2eef5b358dc5e516bac157bf559541b5efd4bcd8d127454b3ee4dd135fcef184fae25bf24d4ecef2c6af96e113dadb585b94f