Analysis
-
max time kernel
160s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 21:46
Behavioral task
behavioral1
Sample
23308f01c50ea43d0d186a664744cbff.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
23308f01c50ea43d0d186a664744cbff.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
23308f01c50ea43d0d186a664744cbff.exe
-
Size
788KB
-
MD5
23308f01c50ea43d0d186a664744cbff
-
SHA1
fad9f0b47f624cb255ba2eb5a43f820f6be13c92
-
SHA256
0468e0f90d6dc5e85961ba7bc5fd1a9a4d6f3fb813a327a7e19d32423cc06e0a
-
SHA512
80e8c1342ebead394baa24e4109fd7e002ea9282edec8e185b4dad983258fef8b6d8f3a585651fb584d2bdfb83ab1f4eadbee3ab9e016f9d4addc41075d0af94
-
SSDEEP
24576:gVGuOL7YaS2Nuc+sLBKgVVxpjOWC7S6ObYy:4OLTucxbVC7SrbYy
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation 23308f01c50ea43d0d186a664744cbff.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation 23308f01c50ea43d0d186a664744cbff.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2264-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x00020000000228bf-5.dat upx behavioral2/memory/2264-39-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/944-40-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4776-41-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1512-42-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-44-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-45-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-63-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-119-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-165-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-185-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-193-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-197-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-201-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-206-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-222-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-226-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2264-230-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 23308f01c50ea43d0d186a664744cbff.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\T: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\A: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\J: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\I: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\L: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\N: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\R: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\S: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\W: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\G: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\H: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\X: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\Y: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\B: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\U: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\O: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\P: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\Q: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\V: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\Z: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\E: 23308f01c50ea43d0d186a664744cbff.exe File opened (read-only) \??\K: 23308f01c50ea43d0d186a664744cbff.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\danish blowjob action girls vagina (Kathrin).mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\tyrkish horse xxx [bangbus] legs shoes .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\System32\DriverStore\Temp\chinese nude xxx [milf] (Sonja,Britney).rar.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SysWOW64\IME\SHARED\chinese fetish gay [free] (Sonja,Curtney).avi.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\beastiality blowjob licking .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SysWOW64\config\systemprofile\russian lingerie cumshot hidden hole leather .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SysWOW64\IME\SHARED\porn uncut boobs (Sonja,Anniston).zip.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SysWOW64\config\systemprofile\spanish hardcore horse catfight swallow .zip.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SysWOW64\FxsTmp\japanese lingerie several models (Liz).rar.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\black cum lesbian ash circumcision .mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\brasilian beast lesbian voyeur boots .mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SysWOW64\FxsTmp\danish lesbian [free] castration .zip.exe 23308f01c50ea43d0d186a664744cbff.exe -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\kicking licking ash black hairunshaved .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files\Microsoft Office\Updates\Download\cumshot [free] .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\german nude licking ash (Karin,Sandy).mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files (x86)\Google\Update\Download\asian cumshot bukkake masturbation girly .avi.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\chinese bukkake [bangbus] (Sonja,Christine).mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\cumshot horse [free] .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\indian horse fucking catfight \Û .mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\beast sperm lesbian (Britney,Janette).mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files\Microsoft Office\root\Templates\bukkake [milf] stockings (Ashley,Sonja).avi.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\indian fetish bukkake sleeping nipples 40+ (Karin).zip.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\nude girls hole ash (Britney).mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files\Common Files\microsoft shared\danish lesbian cumshot hidden cock .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\fetish lingerie girls circumcision .mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\kicking gay sleeping beautyfull .avi.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\kicking porn lesbian 40+ (Anniston).zip.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\lesbian full movie legs Ôï .rar.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Program Files (x86)\Google\Temp\chinese lesbian porn uncut swallow (Sandy).rar.exe 23308f01c50ea43d0d186a664744cbff.exe -
Drops file in Windows directory 28 IoCs
description ioc Process File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\african fetish girls legs mature .rar.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\PLA\Templates\fetish lesbian glans penetration .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\canadian cumshot action lesbian \Û .mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\danish cumshot hot (!) (Sonja).mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\asian action porn licking black hairunshaved .zip.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\lingerie masturbation redhair .mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\animal uncut titts mature .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\xxx lesbian [bangbus] glans .avi.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\mssrv.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\tyrkish nude [bangbus] nipples .avi.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\InputMethod\SHARED\bukkake xxx masturbation hole .rar.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\japanese bukkake fetish lesbian .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\norwegian bukkake horse masturbation titts .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\beast hidden redhair (Kathrin,Melissa).mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\CbsTemp\lingerie lesbian glans (Sonja).zip.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\Downloaded Program Files\brasilian horse voyeur pregnant (Janette,Britney).mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\british xxx uncut .rar.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\russian gay handjob uncut leather .rar.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\norwegian xxx sleeping .rar.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\assembly\temp\danish bukkake trambling several models boots (Anniston,Jade).avi.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\spanish gay uncut (Sandy).rar.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\porn [milf] nipples 40+ .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\assembly\tmp\gay several models high heels .rar.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\african porn public latex .mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\japanese lesbian xxx sleeping wifey .zip.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\security\templates\swedish beastiality catfight boobs stockings .avi.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\indian beast beast hot (!) femdom .mpg.exe 23308f01c50ea43d0d186a664744cbff.exe File created C:\Windows\SoftwareDistribution\Download\brasilian beastiality masturbation cock YEâPSè& .mpeg.exe 23308f01c50ea43d0d186a664744cbff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2264 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 2264 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 1512 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 944 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe 4776 23308f01c50ea43d0d186a664744cbff.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2264 wrote to memory of 944 2264 23308f01c50ea43d0d186a664744cbff.exe 90 PID 2264 wrote to memory of 944 2264 23308f01c50ea43d0d186a664744cbff.exe 90 PID 2264 wrote to memory of 944 2264 23308f01c50ea43d0d186a664744cbff.exe 90 PID 2264 wrote to memory of 4776 2264 23308f01c50ea43d0d186a664744cbff.exe 91 PID 2264 wrote to memory of 4776 2264 23308f01c50ea43d0d186a664744cbff.exe 91 PID 2264 wrote to memory of 4776 2264 23308f01c50ea43d0d186a664744cbff.exe 91 PID 944 wrote to memory of 1512 944 23308f01c50ea43d0d186a664744cbff.exe 92 PID 944 wrote to memory of 1512 944 23308f01c50ea43d0d186a664744cbff.exe 92 PID 944 wrote to memory of 1512 944 23308f01c50ea43d0d186a664744cbff.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\23308f01c50ea43d0d186a664744cbff.exe"C:\Users\Admin\AppData\Local\Temp\23308f01c50ea43d0d186a664744cbff.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\23308f01c50ea43d0d186a664744cbff.exe"C:\Users\Admin\AppData\Local\Temp\23308f01c50ea43d0d186a664744cbff.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\23308f01c50ea43d0d186a664744cbff.exe"C:\Users\Admin\AppData\Local\Temp\23308f01c50ea43d0d186a664744cbff.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512
-
-
-
C:\Users\Admin\AppData\Local\Temp\23308f01c50ea43d0d186a664744cbff.exe"C:\Users\Admin\AppData\Local\Temp\23308f01c50ea43d0d186a664744cbff.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\fetish lingerie girls circumcision .mpeg.exe
Filesize2.0MB
MD599f4f36f0f97698a714b5e50b16b8d72
SHA1792d6ec34b1864c972d83857449f81fd51405492
SHA256e444067b50b90ce013da9e39184df9b9a45906fa1edbeaab1ef5119869c7da5e
SHA512c50104fb71a13d4db57bf4dfba2dc5fd24340978ead87a894537836e8752276305aef91650033aaf4ea5f1f20a7f4a6b91453803d934611a40c031bd10b9b724