Analysis
-
max time kernel
838s -
max time network
839s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 15:13
Static task
static1
Behavioral task
behavioral1
Sample
MovaviScreenRecorderSetupC_Wmgfpdd_.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
MovaviScreenRecorderSetupC_Wmgfpdd_.exe
Resource
win10v2004-20240226-en
General
-
Target
MovaviScreenRecorderSetupC_Wmgfpdd_.exe
-
Size
4.9MB
-
MD5
24d3f23dcea2155031ab07a7b4a483b9
-
SHA1
ad1f4e8cbf3fbd550d27a150fb7bfb57ee5ebcd9
-
SHA256
e76ab19bd163eee7bcd1353166b62af4063275d788c90cad70fb76d02007fc23
-
SHA512
b853b822e4c19d7a3c642f63dca7f92b558c4eb5b4b6fb757aa58fc53da8252680ecc533cab596798ae00b1aee552e85c4eb09c1b3c1bfb8b728cf3c966f7560
-
SSDEEP
98304:B5vYxaALTHJNaX57AjSmnuUgcPXr9wnRDXmmIAjT:BixNLVNaX57WuUJvZwRD2mIA3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2740 installer.exe -
Loads dropped DLL 45 IoCs
pid Process 2436 MovaviScreenRecorderSetupC_Wmgfpdd_.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2740 installer.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe 2828 WerFault.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2740 2436 MovaviScreenRecorderSetupC_Wmgfpdd_.exe 28 PID 2436 wrote to memory of 2740 2436 MovaviScreenRecorderSetupC_Wmgfpdd_.exe 28 PID 2436 wrote to memory of 2740 2436 MovaviScreenRecorderSetupC_Wmgfpdd_.exe 28 PID 2740 wrote to memory of 2828 2740 installer.exe 29 PID 2740 wrote to memory of 2828 2740 installer.exe 29 PID 2740 wrote to memory of 2828 2740 installer.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\MovaviScreenRecorderSetupC_Wmgfpdd_.exe"C:\Users\Admin\AppData\Local\Temp\MovaviScreenRecorderSetupC_Wmgfpdd_.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\installer.exeC:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\installer.exe "--distrib-name=C:\Users\Admin\AppData\Local\Temp\MovaviScreenRecorderSetupC_Wmgfpdd_.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2740 -s 2003⤵
- Loads dropped DLL
PID:2828
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\FndAppLocations.dll
Filesize39KB
MD57ca71c23f5d1acb12ac4eac4836f1922
SHA1cda580c2ec1662c584cf30ab91abc041207a8a5b
SHA25623e7c7c7c79df37cf02a550ce7a2814ad289252eafe1bc59be84cbf046b6651d
SHA5128e843f7562a22b10e85f90a93edbf92c36d0dcbdad7975e4afa3eafbd14205ebd00f5207132b266f65c816de5299863054cd360cd0a898770bb2d1933a580816
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\FndCrashHandler.dll
Filesize485KB
MD5b7de999306f57e423cee9fb6f416e37c
SHA1ef16bc3ce29c5b84a6c742254506dc3afae215df
SHA256dcbde2341a725d25c60f25ebdc20bee9390d4a83b0fca78f5ddc1caa0d7bab0d
SHA512a5cdad6e4930146fd101b288d2baf8e72676702f256d3615d74dcd685b41fba9f40563d678f1a90d162032f4101b898581c3441b7cefd8dacf2d4c6c5984c0ac
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\FndFilesystem.dll
Filesize289KB
MD57dbd40e3d87c8acb7c414111499ec6fe
SHA15533cc92e27a347adb6f6decb5fdba2cb743c520
SHA256ad618d4e2398c8fd27aec6476058868f71f2d53ebf4e5bc6a4606f251540387a
SHA5123d7c407e3076724215cd6d34e52e5367d555d59e11ebbf316d84b6dd893a8f92e6ba44f84d24644e737d1034d448a78a35569a0dd7ea676284bbfc69e3c65daf
-
Filesize
90KB
MD5c9e5631df9b5121a75869b6e18f63671
SHA14e29be61a29f93e4f20d4fadcca05f929a2c4f18
SHA2563705c81c63b61d450df6061c06894d353ea81eed48091384a8ca96cd3d93ea4f
SHA51289c31586d2d96e4d939c19765dd5bc6afb49b1a67e41b2f6fe0e2e342fe8b8cf7adacc846efc4ce0cfcc24cbb958955351b9d3cd5a75573f0a4301a2903eb28b
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\FndPointer.dll
Filesize24KB
MD5f42310fa2b812047900403fed23fc8b5
SHA106fe3d37638984b4cc17f1cc430675ee9f302dbd
SHA25660301986820f872846b23d84ac4f8f6747ae50e32d27ad7c154022ecd379ae99
SHA5123e41ecc9a9a5157882726bb83fe5257f5a016ee3be8c3f0ab1159cba6c620509cc97072f604b96d52dd0e37e359c6b0d0fbefa890c21fbc0d999d075f7537bf2
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\FndString.dll
Filesize43KB
MD58491008d1bf21800e72d59644c89ddc3
SHA1f2585ddd1b7bc0c8c7a43e742cc551d99fff932b
SHA2569ecf401e2399469024aa6eacd72bedb423fbd8bb6d437117ec1fc19e52d0e71b
SHA5125c4179aeeb6873ebfad80561254687c182431eb92e8fa5093d762c11aad2fe3085cb9ce9a3fc0e6855f17ff92526f3cf986627dcec4e3811214b0e63816d6b1f
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\MSVCP140.dll
Filesize552KB
MD529c6c243cfb1cec96b4a1008274f9600
SHA1c54b10ef6305cc3814c68e6c8fd6daecbb27622a
SHA25644a5af24f8d5f9c50a9e5a200a0486100afb6a0e86377e2e3e622a7bbb57cb04
SHA51239c34554ea7b6d433c2aecfdeff87959e625e943bf7a446ebca8e5878eaf24198c1b188359a0343fb78478f2bc8b986ca4d0e69d39bac6ff80cb901fe4f113ee
-
Filesize
3.4MB
MD5901789a470ff564b1048ff5a33b295bf
SHA108d216ac01fc50d3c5934be536d07d11eefa9fa8
SHA256c03c7cfa8dcd2a9069e9d4b5de73c8606914c84bca911c622fd05e4dd1d1f699
SHA51227a77b4df3eee208ff1eb32a6dffcb76522f7caafd1ebb8bacf692314083337b6e4f1eae6e782f6d477491785471902af69aa48b0826b406e4b9789052588920
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-core-localization-l1-2-0.dll
Filesize14KB
MD51ed0b196ab58edb58fcf84e1739c63ce
SHA1ac7d6c77629bdee1df7e380cc9559e09d51d75b7
SHA2568664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2
SHA512e1fa7f14f39c97aaa3104f3e13098626b5f7cfd665ba52dcb2312a329639aaf5083a9177e4686d11c4213e28acc40e2c027988074b6cc13c5016d5c5e9ef897b
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-core-timezone-l1-1-0.dll
Filesize11KB
MD591a2ae3c4eb79cf748e15a58108409ad
SHA1d402b9df99723ea26a141bfc640d78eaf0b0111b
SHA256b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34
SHA5128527af610c1e2101b6f336a142b1a85ac9c19bb3af4ad4a245cfb6fd602dc185da0f7803358067099475102f3a8f10a834dc75b56d3e6ded2ed833c00ad217ed
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-crt-filesystem-l1-1-0.dll
Filesize13KB
MD5972544ade7e32bfdeb28b39bc734cdee
SHA187816f4afabbdec0ec2cfeb417748398505c5aa9
SHA2567102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86
SHA5125e1131b405e0c7a255b1c51073aff99e2d5c0d28fd3e55cabc04d463758a575a954008ea1ba5b4e2b345b49af448b93ad21dfc4a01573b3cb6e7256d9ecceef1
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-crt-heap-l1-1-0.dll
Filesize12KB
MD58906279245f7385b189a6b0b67df2d7c
SHA1fcf03d9043a2daafe8e28dee0b130513677227e4
SHA256f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f
SHA51267cac89ae58cc715976107f3bdf279b1e78945afd07e6f657e076d78e92ee1a98e3e7b8feae295af5ce35e00c804f3f53a890895badb1eed32377d85c21672b9
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-crt-runtime-l1-1-0.dll
Filesize15KB
MD5f1a23c251fcbb7041496352ec9bcffbe
SHA1be4a00642ec82465bc7b3d0cc07d4e8df72094e8
SHA256d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198
SHA51231f8c5cd3b6e153073e2e2edf0ca8072d0f787784f1611a57219349c1d57d6798a3adbd6942b0f16cef781634dd8691a5ec0b506df21b24cb70aee5523a03fd9
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-crt-stdio-l1-1-0.dll
Filesize17KB
MD555b2eb7f17f82b2096e94bca9d2db901
SHA144d85f1b1134ee7a609165e9c142188c0f0b17e0
SHA256f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb
SHA5120cf0770f5965a83f546253decfa967d8f85c340b5f6ea220d3caa14245f3cdb37c53bf8d3da6c35297b22a3fa88e7621202634f6b3649d7d9c166a221d3456a5
-
Filesize
135KB
MD542ffaab27b6bfb697ebf42b0e6b2c05e
SHA1624e38a7166918d8e77ca1ae765389999a4bab99
SHA25606660e3b1e6d38cf38585daa2520d02314ccd0b72aafd2db8861a227131a516c
SHA51238b03dbcd07a895f2195f58ab4e4ec5ccb815d6e9525275a57f79f7f24d71f56b51e426adba7dc22115788e29752ae9ec17f15991769de844371dbb78e38c496
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\ucrtbase.DLL
Filesize1011KB
MD5849959a003fa63c5a42ae87929fcd18b
SHA1d1b80b3265e31a2b5d8d7da6183146bbd5fb791b
SHA2566238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
SHA51264958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09
-
Filesize
177KB
MD56f29130290ee62c82537ce5bb04b8f13
SHA163e78e4316fe25c5602400d183e5dba02a57db33
SHA256d0eda453cc6eefc3b1fc2994b3bc0ea49b51b479e9cc88b18f54be49ee945391
SHA512cef077f88a306fa584b895b55d103a8889fa9f20137aa1408b6ac87e63aef693c6c630b85f1ad846789020e21d3713eb31b91decadb0bd6571981cf8bfd0da1c
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-core-file-l1-2-0.dll
Filesize11KB
MD55a72a803df2b425d5aaff21f0f064011
SHA14b31963d981c07a7ab2a0d1a706067c539c55ec5
SHA256629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086
SHA512bf44997c405c2ba80100eb0f2ff7304938fc69e4d7ae3eac52b3c236c3188e80c9f18bda226b5f4fde0112320e74c198ad985f9ffd7cea99aca22980c39c7f69
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-core-file-l2-1-0.dll
Filesize11KB
MD5721b60b85094851c06d572f0bd5d88cd
SHA14d0ee4d717aeb9c35da8621a545d3e2b9f19b4e7
SHA256dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf
SHA512430a91fcecde4c8cc4ac7eb9b4c6619243ab244ee88c34c9e93ca918e54bd42b08aca8ea4475d4c0f5fa95241e4aacb3206cbae863e92d15528c8e7c9f45601b
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-core-processthreads-l1-1-1.dll
Filesize11KB
MD57e8b61d27a9d04e28d4dae0bfa0902ed
SHA1861a7b31022915f26fb49c79ac357c65782c9f4b
SHA2561ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c
SHA5121c5b35026937b45beb76cb8d79334a306342c57a8e36cc15d633458582fc8f7d9ab70ace7a92144288c6c017f33ecfc20477a04432619b40a21c9cda8d249f6d
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-core-synch-l1-2-0.dll
Filesize11KB
MD5e86cfc5e1147c25972a5eefed7be989f
SHA10075091c0b1f2809393c5b8b5921586bdd389b29
SHA25672c639d1afda32a65143bcbe016fe5d8b46d17924f5f5190eb04efe954c1199a
SHA512ea58a8d5aa587b7f5bde74b4d394921902412617100ed161a7e0bef6b3c91c5dae657065ea7805a152dd76992997017e070f5415ef120812b0d61a401aa8c110
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-crt-convert-l1-1-0.dll
Filesize15KB
MD54ec4790281017e616af632da1dc624e1
SHA1342b15c5d3e34ab4ac0b9904b95d0d5b074447b7
SHA2565cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639
SHA51280c4e20d37eff29c7577b2d0ed67539a9c2c228edb48ab05d72648a6ed38f5ff537715c130342beb0e3ef16eb11179b9b484303354a026bda3a86d5414d24e69
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-crt-environment-l1-1-0.dll
Filesize11KB
MD57a859e91fdcf78a584ac93aa85371bc9
SHA11fa9d9cad7cc26808e697373c1f5f32aaf59d6b7
SHA256b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607
SHA512a368f21eca765afca86e03d59cf953500770f4a5bff8b86b2ac53f1b5174c627e061ce9a1f781dc56506774e0d0b09725e9698d4dc2d3a59e93da7ef3d900887
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-crt-locale-l1-1-0.dll
Filesize11KB
MD5dd8176e132eedea3322443046ac35ca2
SHA1d13587c7cc52b2c6fbcaa548c8ed2c771a260769
SHA2562eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e
SHA51277cb8c44c8cc8dd29997fba4424407579ac91176482db3cf7bc37e1f9f6aa4c4f5ba14862d2f3a9c05d1fdd7ca5a043b5f566bd0e9a9e1ed837da9c11803b253
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-crt-math-l1-1-0.dll
Filesize20KB
MD5a6a3d6d11d623e16866f38185853facd
SHA1fbeadd1e9016908ecce5753de1d435d6fcf3d0b5
SHA256a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0
SHA512abbf32ceb35e5ec6c1562f9f3b2652b96b7dbd97bfc08d918f987c0ec0503e8390dd697476b2a2389f0172cd8cf16029fd2ec5f32a9ba3688bf2ebeefb081b2c
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-crt-string-l1-1-0.dll
Filesize17KB
MD59b79965f06fd756a5efde11e8d373108
SHA13b9de8bf6b912f19f7742ad34a875cbe2b5ffa50
SHA2561a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6
SHA5127d4155c00d65c3554e90575178a80d20dc7c80d543c4b5c4c3f508f0811482515638fe513e291b82f958b4d7a63c9876be4e368557b07ff062961197ed4286fb
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-crt-time-l1-1-0.dll
Filesize13KB
MD51d48a3189a55b632798f0e859628b0fb
SHA161569a8e4f37adc353986d83efc90dc043cdc673
SHA256b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0
SHA51247f329102b703bfbb1ebaeb5203d1c8404a0c912019193c93d150a95bb0c5ba8dc101ac56d3283285f9f91239fc64a66a5357afe428a919b0be7194bada1f64f
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\api-ms-win-crt-utility-l1-1-0.dll
Filesize11KB
MD5dbc27d384679916ba76316fb5e972ea6
SHA1fb9f021f2220c852f6ff4ea94e8577368f0616a4
SHA256dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1
SHA512cc0d8c56749ccb9d007b6d3f5c4a8f1d4e368bb81446ebcd7cc7b40399bbd56d0acaba588ca172ecb7472a8cbddbd4c366ffa38094a832f6d7e343b813ba565e
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\boost_filesystem-mt-x64.dll
Filesize149KB
MD569ecba1f86ac529e1e2338d885231b12
SHA1dd90f124777dee34a283dbf6f0fb6d5eb7e688a6
SHA2567b21ecf89371eb4cea7904e6da33bf90ba1d6684a3aedb8de8f9f16ec17aaf5e
SHA5129d8144f8704a78009dfe6c9149186d568439231e1995c8c1423f66ed78dbf9b6c99a64c71616015f627712a9284b9ad6b4562c7cc5bea031b63210877fe559ea
-
Filesize
4.2MB
MD54d3ea83d19e1ae4584a5af5ac884a193
SHA113f40d5f46a0d70ee96b8507a91f63a12fd7d43d
SHA256ed6a18d76ac7b8b72ebd8e4fbe0c9698ec2204edc9cb5a40e348b01f186c8a20
SHA51256ea89c081f095888c478bbd3dd9e9a0283badcc25462fb485feaa574e1e85a5332c93fcf116eb582005012e25d1f5f83c230020b68d75825d613cf12bf07fa8
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\vcruntime140.dll
Filesize94KB
MD502794a29811ba0a78e9687a0010c37ce
SHA197b5701d18bd5e25537851614099e2ffce25d6d8
SHA2561729421a22585823493d5a125cd43a470889b952a2422f48a7bc8193f5c23b0f
SHA512caf2a478e9c78c8e93dd2288ed98a9261fcf2b7e807df84f2e4d76f8130c2e503eb2470c947a678ac63e59d7d54f74e80e743d635428aa874ec2d06df68d0272
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-bfab2a36-1efc-4845-915b-480cb0e472b9\vcruntime140_1.dll
Filesize36KB
MD5d8d1a08176ba2542c58669c1c04da1b7
SHA1e0d0059baf23fb5e1d2dadedc12e2f53c930256d
SHA25626c29d01df73a8e35d32e430c892d925abb6e4ad62d3630ae42b69daacba1a0d
SHA5125308790fbcf6348e87e7d5b9235ed66942527326f7ba556c910d68d94617bdd247a4ed540b4b9f8d4e73d15cf4a7204c0a57d4fd348ec26e53f39b91be8617fb