Analysis

  • max time kernel
    52s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 04:45

General

  • Target

    https://kso.page.link/wps

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kso.page.link/wps
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef65d9758,0x7fef65d9768,0x7fef65d9778
      2⤵
        PID:1680
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:2
        2⤵
          PID:2964
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1376 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:8
          2⤵
            PID:2624
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:8
            2⤵
              PID:2080
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2232 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:1
              2⤵
                PID:1628
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2240 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:1
                2⤵
                  PID:1244
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1560 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:2
                  2⤵
                    PID:1768
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3244 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:1
                    2⤵
                      PID:980
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3480 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:1
                      2⤵
                        PID:564
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3520 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:1
                        2⤵
                          PID:324
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4228 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:8
                          2⤵
                            PID:3032
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4240 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:8
                            2⤵
                              PID:2872
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4012 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:8
                              2⤵
                                PID:1700
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:8
                                2⤵
                                  PID:892
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3956 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:8
                                  2⤵
                                    PID:2484
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4000 --field-trial-handle=1364,i,2020237105221176438,4434355891157593492,131072 /prefetch:8
                                    2⤵
                                      PID:1596
                                    • C:\Users\Admin\Downloads\wps_office_inst.exe
                                      "C:\Users\Admin\Downloads\wps_office_inst.exe"
                                      2⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Writes to the Master Boot Record (MBR)
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2664
                                      • C:\Users\Admin\Downloads\wps_download\ca53b1e390dcdc2ae376a28532674862-14_setup_XA_mui_Free.exe.601.1052.exe
                                        "C:\Users\Admin\Downloads\wps_download\ca53b1e390dcdc2ae376a28532674862-14_setup_XA_mui_Free.exe.601.1052.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps
                                        3⤵
                                          PID:1572
                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                      1⤵
                                        PID:2480

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              68KB

                                              MD5

                                              29f65ba8e88c063813cc50a4ea544e93

                                              SHA1

                                              05a7040d5c127e68c25d81cc51271ffb8bef3568

                                              SHA256

                                              1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                                              SHA512

                                              e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

                                              Filesize

                                              1KB

                                              MD5

                                              a266bb7dcc38a562631361bbf61dd11b

                                              SHA1

                                              3b1efd3a66ea28b16697394703a72ca340a05bd5

                                              SHA256

                                              df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                                              SHA512

                                              0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              344B

                                              MD5

                                              7531550820f235560380088f1acf442d

                                              SHA1

                                              bfbedcf6898697edc17a4c7bdbbffca1dedfa425

                                              SHA256

                                              a8a0a2f8799a4d07c9ab2e73687057863854f64e8e36309cbc55af2688cec6e9

                                              SHA512

                                              0a3cb17764e5d281d242f92469c52881fba953cc49b71d6f3ee84106c43d812ca3d5df36bd0a7f452e462c8a9ba9dbfc55e3680ec9523eb9a9467648bde6e4cb

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              344B

                                              MD5

                                              765321462fe9a4684553d2372863ba6f

                                              SHA1

                                              f49490a2f6197e40ba2f7f60c2b46fdd28d73df7

                                              SHA256

                                              30db3937fccb7bf04a9fe54dcfd70539c920708b0f6b7b891350b55c302996fc

                                              SHA512

                                              294e19973c44eab13bc57cc2350fb8ec2a519c698583f5ae8643b95ff0c058691477698483e563c81dab5dc0923f66d463a59f95dd1294051b4609947b1bfb34

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              344B

                                              MD5

                                              8d5b38828040021beba0fc8175f08297

                                              SHA1

                                              478b6013898b76cb2f35ae90b85aea91bc58dc2c

                                              SHA256

                                              88dbfbff59d66ecc2a2f7ecbc43ed09dfad67e28549f777717a674f21922d177

                                              SHA512

                                              7eb8c8026c0163e8bb52c8303e4084cf587d63796208c2730bed40056dd5fec452b7045d90f65f1be617d28e4f28d995075211f3c11fdb161fd1ded17b5cf85e

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

                                              Filesize

                                              242B

                                              MD5

                                              83f467766db5c51f55f300943aca901a

                                              SHA1

                                              d1f89f0af129e3d5afe6e7423c5fc83ec904c8fc

                                              SHA256

                                              6d9fecef28505965a844baf9d12d3586fd11567fd143b1b344d66f3af2ad6905

                                              SHA512

                                              59d872a39a7c7991796bb012a1b50a056d000de11ee7a7aed3b47ff60b385e7cbb5151e1e72a05acdd0c732f732a4554a7bbe6245596e29a00a651cbb562c55f

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                                              Filesize

                                              16B

                                              MD5

                                              aefd77f47fb84fae5ea194496b44c67a

                                              SHA1

                                              dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                              SHA256

                                              4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                              SHA512

                                              b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                              Filesize

                                              264KB

                                              MD5

                                              f50f89a0a91564d0b8a211f8921aa7de

                                              SHA1

                                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                                              SHA256

                                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                              SHA512

                                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.wps.com_0.indexeddb.leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              46295cac801e5d4857d09837238a6394

                                              SHA1

                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                              SHA256

                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                              SHA512

                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                              Filesize

                                              2KB

                                              MD5

                                              5a7a2470cbb81a43c9e8123b17c7e409

                                              SHA1

                                              5718d23544f19d2bde250970a562306eaf86cf7a

                                              SHA256

                                              da695d9ade517282866258d315584c43957f9b5c8d258b597fec133a4bc1b795

                                              SHA512

                                              72e1f45c0625762c1768434f3135f4b95ec03ecc735980a355c63dd9010fab30c3296ae458d22c6e8bde78fcfbae287ef3d96be6fc84ab45518daa06c5cee433

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                              Filesize

                                              111B

                                              MD5

                                              807419ca9a4734feaf8d8563a003b048

                                              SHA1

                                              a723c7d60a65886ffa068711f1e900ccc85922a6

                                              SHA256

                                              aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                              SHA512

                                              f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                              Filesize

                                              111B

                                              MD5

                                              285252a2f6327d41eab203dc2f402c67

                                              SHA1

                                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                              SHA256

                                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                              SHA512

                                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              27b510ab7a398f30c5fdd79ed75464c0

                                              SHA1

                                              a5d57581371b0261b0818cbcf7d581e186d7a8f0

                                              SHA256

                                              56646e657a8bc7168b2358c2d8d0a0ffdd3728e1fb36561631b497f14f083853

                                              SHA512

                                              3ad989fbb51eca8a7fb0df5604f2860f138573b07aee291001945ac8e5bca32a988b46a02e32584c1c069c0de34213020dab9d5f2cedf1b33339ad4a5137f295

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              43974646f3d7bc35ee25f64a57827226

                                              SHA1

                                              925d1f66fd1fa0852736b83982d6ca5f1e1c8436

                                              SHA256

                                              088e6b7a1b7397dc9181b20eb7f71731e3ac2dd1871680d8194aef37f7759324

                                              SHA512

                                              b330e9b8816085b32aba69b9b7270eb054fee32eace39c932d7760b3b99f99e7e0e7214143dd56079e938087f408db62530f2368b0dc42f4e2848cba25f4090c

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              eb6dd7ba0bde77711b4ce6b1b7b1814c

                                              SHA1

                                              73d92ef3a3f49204d1da5c2202488467ad9097ab

                                              SHA256

                                              b7426c8fc28fb4125dee93fb82c976bcb0c24c0cef572049be4a705178d30a9c

                                              SHA512

                                              58e229d1b311727d6261b73fc75011b9902dfb6c0b3327e2450452154e40624989be53b7ad85c9d9944d057f659070b9e7fb716c44407758f288c735a5788a33

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000002.dbtmp

                                              Filesize

                                              16B

                                              MD5

                                              206702161f94c5cd39fadd03f4014d98

                                              SHA1

                                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                              SHA256

                                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                              SHA512

                                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                              Filesize

                                              16B

                                              MD5

                                              18e723571b00fb1694a3bad6c78e4054

                                              SHA1

                                              afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                              SHA256

                                              8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                              SHA512

                                              43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                            • C:\Users\Admin\AppData\Local\Temp\Tar591.tmp

                                              Filesize

                                              177KB

                                              MD5

                                              435a9ac180383f9fa094131b173a2f7b

                                              SHA1

                                              76944ea657a9db94f9a4bef38f88c46ed4166983

                                              SHA256

                                              67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                                              SHA512

                                              1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                                            • C:\Users\Admin\Downloads\Unconfirmed 838979.crdownload

                                              Filesize

                                              5.4MB

                                              MD5

                                              b91d53742f7ac31b5f33bcbf9c4ed1db

                                              SHA1

                                              9ab77c5a937117658f081abea51a7147dfea02df

                                              SHA256

                                              8365a2027aecd86c18cd55405596d59df61e140c508614c036daff8175dd53e8

                                              SHA512

                                              daad0d0b41092a34b0dfc0a97f53d48e11bf7fa4cc648fde8d02a4e46a83eb521382c2c3d9887f07ab98092c301db754b5dfa2e2536639b6cc7a0784caf1b570