Malware Analysis Report

2025-01-19 07:50

Sample ID 240609-hqg9tsfb7w
Target indus.apk
SHA256 2abd77540e0f6e59c1a36d0b6a4db50570d98d3037ee592458dda38d19da30b1
Tags
discovery evasion persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

2abd77540e0f6e59c1a36d0b6a4db50570d98d3037ee592458dda38d19da30b1

Threat Level: Shows suspicious behavior

The file indus.apk was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion persistence

Queries the phone number (MSISDN for GSM devices)

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests dangerous framework permissions

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries information about active data network

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-09 06:56

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 06:56

Reported

2024-06-09 06:59

Platform

android-x86-arm-20240603-en

Max time kernel

148s

Max time network

131s

Command Line

com.bank.lead.owzlmjgmgy

Signatures

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.bank.lead.owzlmjgmgy

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 nkrr-43670.firebaseio.com udp
US 35.201.97.85:443 nkrr-43670.firebaseio.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.206:443 android.apis.google.com tcp

Files

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb-journal

MD5 db8b352b7021b1957c9e5d4b7860b8a2
SHA1 08ed7098305fc5a7440dcae2eda5c5e426fce107
SHA256 702232129cf621da23d13121419c66712cfe8bed3e05abfbf359b682b9c6a642
SHA512 e24eeec38ff933186a2995d169114b3e5f532e8ac0c4b200acb23c5cbddd1e1a4d3b5cf7fab846309a5fbe2e8049f621f21e62a9ed21592fd1d1e82a44a99468

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb-wal

MD5 d13f505a19aaf193b0645bf90a54cf46
SHA1 14410f903b53ea7cc94e4aee2edeef63a32e111f
SHA256 02ae332891fc915711fdad8e979c275202aad3623446b7b5604dc8e22e09c87b
SHA512 ad201611029dae8345cb8027d2eaa40fb9111895e66cff37e58c71175a3357343ef5e0c22479d82940bfbab167a073da7f04566f173dd43dee2d66b33d0dc29e

/data/data/com.bank.lead.owzlmjgmgy/files/PersistedInstallation8367093562513082642tmp

MD5 fd21c6b3504bb9c8015b3476497eaca9
SHA1 a65dd4d7746b47c9319456e5cf7943cd0e84e50c
SHA256 edb6bbad7bc1fa218e355642d4ffac5e5c130f0c45d28866de58f29afa508305
SHA512 17fe050066759dcecec34ac183ddb5c4453b5fc8cb00e1f9d75751ab60003932369a5817e656ab752df4eff7bbc55289e96640e994ba7831b2a2eb56aeb5aaac

/data/data/com.bank.lead.owzlmjgmgy/app_sslcache/nkrr-43670.firebaseio.com.443

MD5 8a0b2b04b07e6478a619431402c2974d
SHA1 826bf6899330504b46ecb984a7edd151f502ba39
SHA256 1d6bce8e5847b1af393e15c098c8500d1ae9d042ee31eed11980e28fb05439e3
SHA512 63d5506d74e3c6a0873428c1bf4be76ebb3cd81f43a2d890659fd84b7ef2cd0d68762413491b9f637b66b54b31376aae367740a8fc6517bcb6bef1f6692970c4

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb-wal

MD5 1c8a206ba1fa744be8c013665593f6bd
SHA1 e4c1d3299977ee3821208e3e16b0e8948035019b
SHA256 c75ae8c049f80a2797eb586ce883b41967535d00c26911aa940594c8c2a313be
SHA512 fb44860b74c386b1a21a33d32ec71c3ba7a79c3e78b390b05d031ade26ee77192231434dec71d8fec0da361725a7cecccc8f66504aad73da4c1c378e213376af

/data/data/com.bank.lead.owzlmjgmgy/files/PersistedInstallation8642019794004293142tmp

MD5 c39637f16b408d221809000ab91e4b5f
SHA1 09b990919db69ed7a026a971716951a8bdf1fd2d
SHA256 a44d426c941ad3a40888d8cfc3a096516b46b0aeb6158a7e36db5dd59bbd83a6
SHA512 1b36e93e08a02d3b10eab078d3059531f8790a89beabe8a5f63cfba96c1d51a9f3a7769a24742d5e7f56c73762cd5e3fed200aacfdfd95fcc6d92f47e837bf5f

/data/misc/profiles/cur/0/com.bank.lead.owzlmjgmgy/primary.prof

MD5 5c05bd6f582fa8e0d8941ecc17b3b9e8
SHA1 9c4a94f749b426ec8bcd7cd7839346ec9d8539ad
SHA256 7e6b7519acc6d815be103dc093959ed8ef1858da80a939c14ff16c28b2975681
SHA512 0ba3b8363db59daecb0a0cd91c22c37fc1b5ab629121591d5abd26eac70ad123e18775e90c3cedd853b18a5d30ee906d7e1f1eea36ae301800400ebf1ccb7efb

/data/data/com.bank.lead.owzlmjgmgy/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 0fb03bc8110f2b2bc31b239f3e4ad360
SHA1 61121ca07a7ce0b54e792fc4333b6330eaf8eee5
SHA256 01956d875fa5999defc4a108b0696fc82b9deb2f797dd27cec6c84c29ff9b1a7
SHA512 ca6f12cd02f81f64ec7c8153a3311d89ac0bd3c118121f0df3f3fa458f5d51147e8fb0c9821e3aa02d2bef867f39793ea589e961b39c1e2e4bd155c197084ee6

/data/data/com.bank.lead.owzlmjgmgy/files/profileInstalled

MD5 2965041205c68f845b5480c1d83c71f9
SHA1 9b76dc3cd12a4653f28181002f391857cc03450b
SHA256 69f2dcada54bd6264e6b2268328dfdef58789225d3031cbccddd6921740c6008
SHA512 f9b64f1b1dc4928b54905e9bd2491539b4005276e1423c6f8f35228f846a1f2721d9ec41fae7232069fd88b4d0d9164d68280982f15fbcc1fa4d26350a98bcfb

/data/misc/profiles/cur/0/com.bank.lead.owzlmjgmgy/primary.prof

MD5 26e81ce28d2d0954b77b690bff04baec
SHA1 3a10f56ddf5e15a3ecbeea85981cd4b2b732162d
SHA256 d2334eaa3f9b768f69a7dafd40673053a156e94e93353ccf8d39ad58cad30597
SHA512 022df4bf23d7eba874f7baa99e0e15a8271432d4ccecb578d510b3bce7c35d8036b31ef35a5e1f91b58608f640d7405751e29a1594038d8f96fb1b9d97448602

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-09 06:56

Reported

2024-06-09 07:00

Platform

android-x64-20240603-en

Max time kernel

76s

Max time network

152s

Command Line

com.bank.lead.owzlmjgmgy

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.bank.lead.owzlmjgmgy

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 nkrr-43670.firebaseio.com udp
US 35.190.39.113:443 nkrr-43670.firebaseio.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
GB 172.217.169.14:443 tcp
GB 142.250.187.226:443 tcp
GB 142.250.187.228:443 tcp
US 1.1.1.1:53 www.google.com udp
GB 172.217.16.228:443 www.google.com tcp
GB 142.250.200.14:443 tcp

Files

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb-journal

MD5 03960b9b42d9141d07f411e414a88a51
SHA1 b2766228db414c11c13023210133f580532d523b
SHA256 5b92660497fe775a64b527af23e1356ebaad517dff7997a13e67ddcfbb6d01f2
SHA512 ca756ab8b7ebbebd499922781098076b8305601e09bf2204d5b900510fe20b82077fd3b65b25e88ed038515df0edc69ea6618556aec080f0dd9d14bd1a4047ec

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.bank.lead.owzlmjgmgy/files/PersistedInstallation4288716349682409379tmp

MD5 ad6bbaf9e60e0415d44ebae3559a48a9
SHA1 e5fe07b299329bba34a245fb45d79df9a02b16fd
SHA256 dc4f8f30b6637dd35e889a5f9d814c41748c7d85bb75d369025e60e3264a6bdc
SHA512 e1a0652125512b350cea1e293214e961a8b7067c56bf8b4016c2787ce8e7be88b0e40a41bb783774c4f2b4ac1dbd2e93c5f5d3b8634d5c272fb02bf69a11ed82

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb-wal

MD5 4c7f4f20c35027199ad506f196fa88ce
SHA1 d78069be12529a184dd0f018528a67ce99b292a8
SHA256 891ecbfbd35c5eb078e36a9bb2c6898128544486fcfd8a44ceecbd89a800818d
SHA512 3b5c361549945c3fe408b32876613e8548914ded6c07ae51af6181c00542f533aff40db481f9c5297c11af27aa86453dd43fbf70108569e230cb1f2cf34c80f8

/data/data/com.bank.lead.owzlmjgmgy/files/PersistedInstallation5298585980952123284tmp

MD5 8420c2b71df04af7ef1bb18b381a6db2
SHA1 48956ff3e1c4cb59d78bedcc751cfa8130737323
SHA256 8e2b7c367f8ce5d8b8eba4c30db3636bf462957c245a100d9de684df694a6e54
SHA512 7411e0f6efa20d2bde369476a1deffda5ed2a3cbc818c55b5d86eddce29e126698838a3ebcd21a0a1b8ad18277da2f2c6398ccd869dbfbdc3d2e8648361dc4bc

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb-wal

MD5 052ca06db62acfacfe570730989c8224
SHA1 a7f1bea11e9a3fca6e0ae70bd2cd1000b6513de5
SHA256 f51816f291ea67f91e58d1a98c3f8f1e01577ead3ee65fbddadd327c21b63642
SHA512 88599ad5951e4ef710e09ef4057c5dc8e831c172c33036c8b6c275d1ad2343a10c3f266f69e2bb6a27f872abb5a462f402b901983c8eb3ad77d4e1d105478031

/data/misc/profiles/cur/0/com.bank.lead.owzlmjgmgy/primary.prof

MD5 5c05bd6f582fa8e0d8941ecc17b3b9e8
SHA1 9c4a94f749b426ec8bcd7cd7839346ec9d8539ad
SHA256 7e6b7519acc6d815be103dc093959ed8ef1858da80a939c14ff16c28b2975681
SHA512 0ba3b8363db59daecb0a0cd91c22c37fc1b5ab629121591d5abd26eac70ad123e18775e90c3cedd853b18a5d30ee906d7e1f1eea36ae301800400ebf1ccb7efb

/data/data/com.bank.lead.owzlmjgmgy/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 81aa7d75280c48aeff70e9d8b42cb4d9
SHA1 2e0b8246f15a21eb119dab9b8c7b86d2739f655a
SHA256 bde8d65a206a107005277c5b5283246f742fadd14ac68560ac98eb40c00e947c
SHA512 946e61ae7947d4bf7d249eb949f55f148a7cf68473b398c14afb6713d750b08c0fd4cf6166205c960933871740ec4b7412315c09dc3a13f93be0c45e2feadc1d

/data/data/com.bank.lead.owzlmjgmgy/files/profileInstalled

MD5 bc24866c0d8bfae639ad265a29575ae8
SHA1 261ed57a6a061f9eab917a7aa8b62b844d7647ff
SHA256 d9b037456c0d64cffef4bd99a8ed2053451ef5a529fa92548777392abacb014b
SHA512 71e3717bc4d7132345a9ced13b40037ffa05d1c057b160a3693b3c3ed99b06dc102929a8e8bee031b8af9f570b2c5eb114c628b13087c9f64c1bdb4f0d2e5442

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-09 06:56

Reported

2024-06-09 06:59

Platform

android-x64-arm64-20240603-en

Max time kernel

120s

Max time network

132s

Command Line

com.bank.lead.owzlmjgmgy

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Processes

com.bank.lead.owzlmjgmgy

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.179.238:443 tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 nkrr-43670.firebaseio.com udp
US 34.120.160.131:443 nkrr-43670.firebaseio.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.8:443 ssl.google-analytics.com tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp

Files

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb-journal

MD5 394ce709adcc4653763a300ad3abe0b8
SHA1 29f9bad6f53d62965674484fd52c570b72cad7b8
SHA256 2871a4f92540296a29621f5a76efcb914734869067ec7b046cb0018ce51b0db2
SHA512 69f8a98d12850629f0af1a1e585d6fb4525ea6765e89d1464ea129e79c80e54853b00a56d8ebbb41585798b80e572d5d6778a6dad210d13c4883a3f5bf90df52

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb-wal

MD5 479e3945e035a898c35e6931298336a6
SHA1 2861c96f5b36e1b866920fbe0aaf2320576556b5
SHA256 18e28d26090d4f2e6c7da053f54855322b28e0507a9f5fd0163cc3682c228ea2
SHA512 663a8c952b66b6fc6a10f342f36059fc1eed1cae15a1fe01600dbe18d72f5723bf2147ae80138353913d9a07773d34e0ba2bb5b6d91706f63d7b5caef47fb8e0

/data/data/com.bank.lead.owzlmjgmgy/files/PersistedInstallation4841345664930035687tmp

MD5 f5e29eecdc7749d1a979f8695163790d
SHA1 01e9191955dac9b26fa8e82cc051ba21f3cf1825
SHA256 78dc6b9c14921f90d5163dd37cee21fbdc988ea665ff9bd32fe624fc8a509aff
SHA512 2e4ee67887beff09fc72b36a30f507eb2f523fc07e1fbb656f3daf87833c2eb829fecb3358de327e76f387dacd634ac0279fb328f5b7373861ad6f297c8b7577

/data/data/com.bank.lead.owzlmjgmgy/no_backup/androidx.work.workdb-wal

MD5 88694c32d00836e97c3f48545884e9ac
SHA1 c5c8e0f0698f65750805c9fb665dce62d17680c5
SHA256 50fdb494ed1113676fe60c3b8186750d364efd990035279a94eafa91d13173e7
SHA512 ab5bba52aee359fc45bde26f0576c8554990be713ba469236f7061c6584731d8b904430121a240e35286ad43ff9b4aafcc47f0bcaad13582c339516aaf3bc059

/data/data/com.bank.lead.owzlmjgmgy/files/PersistedInstallation5274907996223617649tmp

MD5 d720641d09a540215d6a55cfc977bfb2
SHA1 57aa147521ebb35c609a4a604cdfe50b05bca61b
SHA256 64022e834ec7c341462e572ceb0723c017b8f8ebdf608e263ca02928ae29f6f1
SHA512 9532368c5afd9390e05f9eba7c3eec31cf071daa5d16dd39687e94f4fd6bcd3a61b66f2909e9c49b88627e84aa218ca9cd7580fb76f6f6bdefdf5da8bf715110

/data/misc/profiles/cur/0/com.bank.lead.owzlmjgmgy/primary.prof

MD5 5c05bd6f582fa8e0d8941ecc17b3b9e8
SHA1 9c4a94f749b426ec8bcd7cd7839346ec9d8539ad
SHA256 7e6b7519acc6d815be103dc093959ed8ef1858da80a939c14ff16c28b2975681
SHA512 0ba3b8363db59daecb0a0cd91c22c37fc1b5ab629121591d5abd26eac70ad123e18775e90c3cedd853b18a5d30ee906d7e1f1eea36ae301800400ebf1ccb7efb

/data/data/com.bank.lead.owzlmjgmgy/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 c677631e0b65be9fed11b6b4cfb11f2c
SHA1 7460295e3b36f775ae525fb6ef28dc80d93adc82
SHA256 cf9d0ba106ec2b8f7f0cf4b1752256ae9cc32a0df0fb8d80f0326e49c6568c62
SHA512 d8f3713c2d26787c07667c3f89f051245e134e8ae5fecfc0f472f39096acfeade6193c100634c666c53b4ab63148a06a2b317e9aa7c4fb6c32be4de7d49c7743