Resubmissions
23-07-2024 04:58
240723-fl6qhszakq 1023-07-2024 04:53
240723-fh9yrsygqj 123-07-2024 04:52
240723-fhp9csygmk 1Analysis
-
max time kernel
269s -
max time network
271s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 04:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_11.1.2_build/ghidra_11.1.2_PUBLIC_20240709.zip
Resource
win10v2004-20240709-en
General
-
Target
https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_11.1.2_build/ghidra_11.1.2_PUBLIC_20240709.zip
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1576 msedge.exe 1576 msedge.exe 3212 msedge.exe 3212 msedge.exe 4948 identity_helper.exe 4948 identity_helper.exe 5464 msedge.exe 5464 msedge.exe 5464 msedge.exe 5464 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3212 wrote to memory of 960 3212 msedge.exe 86 PID 3212 wrote to memory of 960 3212 msedge.exe 86 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1624 3212 msedge.exe 87 PID 3212 wrote to memory of 1576 3212 msedge.exe 88 PID 3212 wrote to memory of 1576 3212 msedge.exe 88 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89 PID 3212 wrote to memory of 116 3212 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_11.1.2_build/ghidra_11.1.2_PUBLIC_20240709.zip1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfe9146f8,0x7ffdfe914708,0x7ffdfe9147182⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:82⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:12⤵PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5132 /prefetch:82⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:12⤵PID:6032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3023037209228623506,6471274734074810932,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6708 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5464
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1616
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5584971c8ba88c824fd51a05dddb45a98
SHA1b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA256e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
SHA5125dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
-
Filesize
152B
MD5b28ef7d9f6d74f055cc49876767c886c
SHA1d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA256fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
SHA512491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5178ae76-f31a-4e2a-815c-4b2a1a6c529d.tmp
Filesize265B
MD5ee77ee0ddce6df6a4cf39b6d19ea6b4c
SHA1d5407a3c365266b7a794e647bc17ed9e06b4389f
SHA25679a078c39145a1dc1c27c15f05bb7a39bdaf7aec14fd85a2dcfd36b95a3f5b36
SHA5121841689b05aab9ba73ac48bb390c148e92d218b07da6b89bbec900bcb84055fe2080115545933d495f6e8f2506497af930fbab1c68cf65ff080f2d5a61b30eeb
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD55968292494705a7a4d6514765929de38
SHA19ffa28744d44fa1598cfad7ec42eedd0851ebdcd
SHA2563d0e302c1c297d6cf61139d526e3c6b9e758b3ea5b481296d1a2d8f95850bd4f
SHA512d35931e886f9c6505dde1dd1bdfe41517f7aa70a3e27ff766fa73f1a4456527cf4d5cbc7afe0e6f80cb0894fc1e69782b17932d6b0e2d1394a895e91278f6f12
-
Filesize
6KB
MD5696d5dfa36375b725efbbdb9150ab780
SHA11a1b406a4fa32a91c2e638e1bfca86e1f968bf94
SHA256020fe10b31da040e893d66c113f71a0c39a9aecdaac038deb0cd2378e59ae92c
SHA512e1d4905ebdcd6d972a42f19173e8de9f8bc5b579bf9be9df4499251cf85afecfdd66ad7387c063366136a0250e28edfcd9c8cbc9fc79a279461c650981da24c5
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD50f78202b0dc7a3df633993a5ac7fa650
SHA12f37c2d0c037400aa85a8a7115564737ea3e8677
SHA256f6c763336b6a0c654d14b4107ea5bafbf9f0496288f639d627e5cd74e03f5e1a
SHA51239cb2a39f5bfd7e40ec14dda7af64eba2a0413a7bef0c1dae732a2437a53032f77e00d7e8be4f7233a177ba7094073c464a9291b3391620d3615ac8fafb050c7
-
Filesize
12KB
MD55e028620729598c4bd1087a6a2f9bd30
SHA188c3f16522a14a8e9e547975aa9c132ef3922a36
SHA2565a26410fdadb16100b24e868289ae2ea89794add8b9829950848c17adbce1e97
SHA5121b3c20a4890b4834462542af7e691fe9770d040a453c7509ed47b08efab8747e88ee4d7e71718b9bd304d7d2c2031d91945b72c9d689c6d80f902f14dbb1f423