Analysis
-
max time kernel
138s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/04/2024, 00:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
-
Target
2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe
-
Size
721KB
-
MD5
414f2335ced597f8a3af61124f8b2e34
-
SHA1
cb63fc99d1b4ebc17f671b4801ee662f90074142
-
SHA256
5f293e98ffc282192341df950f56e105eccf2787bb7f506e02bdb63d86a9fbef
-
SHA512
929719017c73ee47722411dfcdcca4cb8050d7af06bf945d045696a0bdee8d8564225cf7b31bf1272bdc21496ebe1553c13cd23f77b06a5db423a93dbdd801d1
-
SSDEEP
12288:nYMZZ0xAUiX3+Zr3QDKaeOHJSko26oDOIcTvtI8+GJijTCGC6najpVliDydWfk:nJ2EKBkJC2xOIGvtIC8CGCKcTl7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2188 A757.tmp -
Loads dropped DLL 2 IoCs
pid Process 2076 2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe 2076 2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\atl100.dll A757.tmp File created C:\Windows\SysWOW64\msjtes40.dll A757.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll A757.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll A757.tmp File created C:\Windows\SysWOW64\rdvgumd32.dll A757.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll A757.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll A757.tmp File created C:\Windows\SysWOW64\dplayx.dll A757.tmp File opened for modification C:\Windows\SysWOW64\mfc110.dll A757.tmp File opened for modification C:\Windows\SysWOW64\mfc120u.dll A757.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll A757.tmp File created C:\Windows\SysWOW64\msxbde40.dll A757.tmp File created C:\Windows\SysWOW64\setupSNK.exe A757.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll A757.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll A757.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll A757.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll A757.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll A757.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll A757.tmp File created C:\Windows\SysWOW64\regedit.exe A757.tmp File created C:\Windows\SysWOW64\crtdll.dll A757.tmp File created C:\Windows\SysWOW64\ivfsrc.ax A757.tmp File created C:\Windows\SysWOW64\msjet40.dll A757.tmp File created C:\Windows\SysWOW64\d3dim.dll A757.tmp File opened for modification C:\Windows\SysWOW64\FM20.DLL A757.tmp File created C:\Windows\SysWOW64\iac25_32.ax A757.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll A757.tmp File created C:\Windows\SysWOW64\sqlunirl.dll A757.tmp File created C:\Windows\SysWOW64\dpwsockx.dll A757.tmp File created C:\Windows\SysWOW64\ir41_32.ax A757.tmp File created C:\Windows\SysWOW64\mspbde40.dll A757.tmp File created C:\Windows\SysWOW64\mswstr10.dll A757.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll A757.tmp File created C:\Windows\SysWOW64\dplaysvr.exe A757.tmp File created C:\Windows\SysWOW64\mfc40.dll A757.tmp File created C:\Windows\SysWOW64\msexcl40.dll A757.tmp File created C:\Windows\SysWOW64\mstext40.dll A757.tmp File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll A757.tmp File created C:\Windows\SysWOW64\FXSXP32.dll A757.tmp File created C:\Windows\SysWOW64\msexch40.dll A757.tmp File created C:\Windows\SysWOW64\msjter40.dll A757.tmp File created C:\Windows\SysWOW64\msvcrt20.dll A757.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll A757.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll A757.tmp File created C:\Windows\SysWOW64\InstallShield\_isdel.exe A757.tmp File created C:\Windows\SysWOW64\audiodev.dll A757.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll A757.tmp File created C:\Windows\SysWOW64\msrd2x40.dll A757.tmp File created C:\Windows\SysWOW64\msvbvm60.dll A757.tmp File created C:\Windows\SysWOW64\mswdat10.dll A757.tmp File created C:\Windows\SysWOW64\olecli32.dll A757.tmp File opened for modification C:\Windows\SysWOW64\VBAME.DLL A757.tmp File created C:\Windows\SysWOW64\sqlwoa.dll A757.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvwgf2um.dll A757.tmp File created C:\Windows\SysWOW64\d3dim700.dll A757.tmp File created C:\Windows\SysWOW64\dmscript.dll A757.tmp File created C:\Windows\SysWOW64\explorer.exe A757.tmp File created C:\Windows\SysWOW64\mfc40u.dll A757.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll A757.tmp File created C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll A757.tmp File created C:\Windows\SysWOW64\odbcjt32.dll A757.tmp File created C:\Windows\SysWOW64\d3d8.dll A757.tmp File created C:\Windows\SysWOW64\expsrv.dll A757.tmp File created C:\Windows\SysWOW64\ir32_32.dll A757.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1XTOR.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NL7Data0011.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLPH.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDCAT.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEES.DLL A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IMCONTACT.DLL A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OISAPP.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll A757.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACER3X.DLL A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll A757.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api A757.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHEV.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\Synchronization.dll A757.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MOFL.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNoteSyncPC.dll A757.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7.dll A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE A757.tmp File opened for modification C:\Program Files\7-Zip\7zCon.sfx A757.tmp File opened for modification C:\Program Files\7-Zip\Uninstall.exe A757.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONTAB32.DLL A757.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OFFXML.DLL A757.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PSTPRX32.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBCONV.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XPAGE3C.DLL A757.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ContactPicker.dll A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSODCW.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7FR.DLL A757.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll A757.tmp File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OWSCLT.DLL A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMDOS.FAE A757.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\rt3d.dll A757.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll A757.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSetupPS.dll A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\ANALYS32.XLL A757.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll A757.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe A757.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKPowerPoint.dll A757.tmp -
Drops file in Windows directory 48 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfdll.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordbi.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\sqmapi.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupEngine.dll A757.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100_x86 A757.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system_data_dll_gac_x86 A757.tmp File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\FileTracker.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\webengine4.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.OracleClient.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.Thunk.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\PerfCounter.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SOS.dll A757.tmp File created C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll A757.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\9.0.0\ul_msvcr80.dll.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E A757.tmp File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\alink.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsecimpl.dll A757.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_atl100_x86 A757.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system_data_dll_x86 A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AdoNetDiag.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationHost_v0400.dll A757.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcr100_x86 A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUi.dll A757.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100u_x86 A757.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\wpfgfx_x86.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtilLib.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.Activities.Compiler.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe A757.tmp File created C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll A757.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PresentationHostDLL_X86.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\CORPerfMonExt.dll A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe A757.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MmcAspExt.dll A757.tmp -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2076 2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe 2076 2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe 2076 2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2188 2076 2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe 28 PID 2076 wrote to memory of 2188 2076 2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe 28 PID 2076 wrote to memory of 2188 2076 2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe 28 PID 2076 wrote to memory of 2188 2076 2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_414f2335ced597f8a3af61124f8b2e34_icedid.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\A757.tmpC:\Users\Admin\AppData\Local\Temp\A757.tmp2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666
-
Filesize
148B
MD595c5d25b7f35cbf2cf26d855fd4f76ed
SHA170e0d1680f51408a6e3ae6b7f3484572e15974c8
SHA256d0831f2200071283fffd9b14a1bf307b83239fb3aa4f401667435ffbd213ef61
SHA512f241be7e796b8dadc92d6c11836d18b231a53d4c619feb926bcb43566231dbc3f2a004cc6fc794d0caf79235deefbfe43bfe718de85b43e901104c74989be02a