Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-06-2024 10:50
Behavioral task
behavioral1
Sample
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe
Resource
win10v2004-20240226-en
General
-
Target
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe
-
Size
2.5MB
-
MD5
6d97ecda69a3b949d29fe88d2f31d95d
-
SHA1
e6730ad822f7c91d3501a401aca1b1c323ca73cb
-
SHA256
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879
-
SHA512
4ba4460b9d3a8e1e8575efcfc1921186894f793e307b3c4b9cfc5c83a291b8cdb982c28fab25240124ead5f74fcf71ffc5c8310fcd7bac573aa1314486b9be72
-
SSDEEP
49152:MxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx5:Mxx9NUFkQx753uWuCyyx5
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Detects executables packed with Themida 17 IoCs
Processes:
resource yara_rule behavioral2/memory/4888-0-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\Themes\explorer.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/4324-10-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\spoolsv.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/2776-19-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\svchost.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/4612-28-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3296-33-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3296-39-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4888-41-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/2776-40-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4324-42-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4612-43-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4612-46-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4324-55-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4324-63-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4612-68-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
spoolsv.exesvchost.exespoolsv.exed68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exespoolsv.exeexplorer.exesvchost.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 4324 explorer.exe 2776 spoolsv.exe 4612 svchost.exe 3296 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/4888-0-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\Themes\explorer.exe themida behavioral2/memory/4324-10-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\spoolsv.exe themida behavioral2/memory/2776-19-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\svchost.exe themida behavioral2/memory/4612-28-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3296-33-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3296-39-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4888-41-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2776-40-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4324-42-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4612-43-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4612-46-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4324-55-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4324-63-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4612-68-0x0000000000400000-0x0000000000A0E000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4324 explorer.exe 2776 spoolsv.exe 4612 svchost.exe 3296 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
explorer.exed68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exepid process 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe 4324 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 4324 explorer.exe 4612 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 4324 explorer.exe 4324 explorer.exe 2776 spoolsv.exe 2776 spoolsv.exe 4612 svchost.exe 4612 svchost.exe 3296 spoolsv.exe 3296 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 4888 wrote to memory of 4324 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe explorer.exe PID 4888 wrote to memory of 4324 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe explorer.exe PID 4888 wrote to memory of 4324 4888 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe explorer.exe PID 4324 wrote to memory of 2776 4324 explorer.exe spoolsv.exe PID 4324 wrote to memory of 2776 4324 explorer.exe spoolsv.exe PID 4324 wrote to memory of 2776 4324 explorer.exe spoolsv.exe PID 2776 wrote to memory of 4612 2776 spoolsv.exe svchost.exe PID 2776 wrote to memory of 4612 2776 spoolsv.exe svchost.exe PID 2776 wrote to memory of 4612 2776 spoolsv.exe svchost.exe PID 4612 wrote to memory of 3296 4612 svchost.exe spoolsv.exe PID 4612 wrote to memory of 3296 4612 svchost.exe spoolsv.exe PID 4612 wrote to memory of 3296 4612 svchost.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe"C:\Users\Admin\AppData\Local\Temp\d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:3296
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:4092
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5f40a76818232bb0e2eafd8263cb89614
SHA1cd4948df94cd067a264a5353dc29795d6b55ebaa
SHA2564670e7fd2479b4a3200186c1a7011ed65ae16925d2103d4a80d75899fd097904
SHA512d0c72f49b3c9f9d3cec0a0dc142acdd335d82b843cb673c4564056994e429b99ef64a0bfce9c3199f239a6d68fee86cafdb4f3da145e63f51f96420a0a99d9a1
-
Filesize
2.5MB
MD5288d084162a242c193e48b915e05eb19
SHA1eb9d179cf5506d9d6c12006461c200cbf9260077
SHA2569c0f7c35584b466ea280add989a9ffbb195c5b791b6b54cce2c959dc5922fe02
SHA512dd6a199229d0a7d055dca87c85c47102de6ef6f9d1ffedc0b6e3f667b80db7743fd82bfe72b56fcde39cfd098ded49383988bb2c652e4ac993cfccd2ea63514f
-
Filesize
2.5MB
MD54deec214943e86c0ed66c8eb02f510fe
SHA10d8a4b02332fd127d47fffdc978eb58c48791559
SHA256439d9b14c20a251ad50344f58ba321681869ab48e0497fffb3dbec68d358e493
SHA51298bc6ed07e66713544375fa8df9ed768a9c6e97147a0997e3af42b4d8e4e27eda3affea6dab9b7d7897e27e3cb64720a0a307a251df67e8d9d0ea73345bbd691