Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-03-2024 23:33
Behavioral task
behavioral1
Sample
2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe
-
Size
153KB
-
MD5
825cef6d5ce0cdd0543e62e3a5a0da11
-
SHA1
c710f8bcaaa734051ea9d7cd6a2e8e557e754c16
-
SHA256
a056607887510431f2be95f0b05cc385b193da4efdd5c2bd13467101f81597b8
-
SHA512
3ae5fe770cc84c2d03591164857c387e56beefa489edb6437ca5c08baecf1029f1b73534eba7b363c9ae12bdc04a24b9bfe5678163f20d9102940af80e9c066f
-
SSDEEP
3072:5qJogYkcSNm9V7DryuLi7g9VLa00AA8aSzkvT:5q2kc4m9tDDi7g9VLhfAs
Malware Config
Extracted
C:\6cVesywCa.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (333) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
2ECE.tmppid process 2004 2ECE.tmp -
Executes dropped EXE 1 IoCs
Processes:
2ECE.tmppid process 2004 2ECE.tmp -
Loads dropped DLL 1 IoCs
Processes:
2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exepid process 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\6cVesywCa.bmp" 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\6cVesywCa.bmp" 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
2ECE.tmppid process 2004 2ECE.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.6cVesywCa 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.6cVesywCa\ = "6cVesywCa" 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6cVesywCa\DefaultIcon 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6cVesywCa 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6cVesywCa\DefaultIcon\ = "C:\\ProgramData\\6cVesywCa.ico" 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exepid process 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
2ECE.tmppid process 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp 2004 2ECE.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeDebugPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: 36 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeImpersonatePrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeIncBasePriorityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeIncreaseQuotaPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: 33 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeManageVolumePrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeProfSingleProcessPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeRestorePrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSystemProfilePrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeTakeOwnershipPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeShutdownPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeDebugPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeBackupPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe Token: SeSecurityPrivilege 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe2ECE.tmpdescription pid process target process PID 2952 wrote to memory of 2004 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2ECE.tmp PID 2952 wrote to memory of 2004 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2ECE.tmp PID 2952 wrote to memory of 2004 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2ECE.tmp PID 2952 wrote to memory of 2004 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2ECE.tmp PID 2952 wrote to memory of 2004 2952 2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe 2ECE.tmp PID 2004 wrote to memory of 1884 2004 2ECE.tmp cmd.exe PID 2004 wrote to memory of 1884 2004 2ECE.tmp cmd.exe PID 2004 wrote to memory of 1884 2004 2ECE.tmp cmd.exe PID 2004 wrote to memory of 1884 2004 2ECE.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_825cef6d5ce0cdd0543e62e3a5a0da11_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\ProgramData\2ECE.tmp"C:\ProgramData\2ECE.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2ECE.tmp >> NUL3⤵PID:1884
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵PID:2296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5fad1457dfab07818e52c9ac2707037f5
SHA14da68ec7997191091391b6023a03b358d3910ba8
SHA2562617a23d7b154ba3dcdef8c8af478b38e25f4ad13227a4dd33999f84fe2a8d1f
SHA512f388d7444a4c8e1678972a8662cf61001868e12454884b68fe1a472240fe849453db29c310c7e4fd7baf272d67ad907201e0144bea7cfde18682121f9d416681
-
Filesize
6KB
MD5dd746ace17e44ace00885b91400f11d5
SHA14a0302d2dca400598f396e4230fdae71779cbeaa
SHA256b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA5128ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1
-
Filesize
153KB
MD5d66aa3f7a3053a282a21ea467c0ed737
SHA10be8041eb78cb88c2280f95afc3b6817d0525441
SHA2565569c8c04f0249580a4bf013c2e349fc1aeb421a70061e05f1dcbcd77147881c
SHA512fc5716096e69714f433de58687012ea0513bff81fd4a24d0289dd51adcf7a8d9f18fa82cc0363b2a4cfc01d59b079bbc6babfecc3ffddf971ea7286872c8a899
-
Filesize
129B
MD57b16c27df85e6e12afbedc9747908e4f
SHA1094d4e39bbcb757c7233e25aba63eaebe2474a6c
SHA25654d08aeb7b4f3781b45ffea96746b01f875df89b908dc199f8bc9c17ceb8e44f
SHA512642671a8ce17115687436d494cb8318b562ec1ace5b6d3498962303634383819a8b6cebad59cd9f07cea4617bd29b4ed34f85122104976c955e200b62b09793b
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf