Analysis
-
max time kernel
118s -
max time network
55s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 01:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e990bc0cdb174f5d7b412e76d3c9d880N.exe
Resource
win7-20240708-en
windows7-x64
17 signatures
120 seconds
General
-
Target
e990bc0cdb174f5d7b412e76d3c9d880N.exe
-
Size
97KB
-
MD5
e990bc0cdb174f5d7b412e76d3c9d880
-
SHA1
b02c3d6102745b80a0baecc8feda12b15eee67fe
-
SHA256
fde13750ffa617b6fd60420a6240148907e9409f3c374772d9197f7059bab407
-
SHA512
3eb9e9ed2b87dafe8e8c1e44f48a5f4c74c041034476a71f0e9f815cd080f2fc85ed1aaf7713e0402b7b3ae350962570dc1b91d35f46442ba5a2eb82c958b8b0
-
SSDEEP
1536:bLPAdZrzyoBo3RTmKw/Hvbd3xkl95+8STrJorRAK:HAjSk/Hvb9qlb7STNQ
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e990bc0cdb174f5d7b412e76d3c9d880N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e990bc0cdb174f5d7b412e76d3c9d880N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e990bc0cdb174f5d7b412e76d3c9d880N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe -
resource yara_rule behavioral1/memory/2280-2-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-4-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-5-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-10-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-7-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-12-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-9-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-11-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-8-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-6-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-33-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-32-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-34-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-35-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-36-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-38-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-39-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-40-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-41-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-44-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-60-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-62-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-64-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-65-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-70-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-75-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-76-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2280-77-0x0000000000980000-0x0000000001A3A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" e990bc0cdb174f5d7b412e76d3c9d880N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc e990bc0cdb174f5d7b412e76d3c9d880N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e990bc0cdb174f5d7b412e76d3c9d880N.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\Q: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\Z: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\E: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\J: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\K: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\N: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\W: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\G: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\I: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\P: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\R: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\S: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\T: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\U: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\V: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\M: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\O: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\X: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\H: e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened (read-only) \??\Y: e990bc0cdb174f5d7b412e76d3c9d880N.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened for modification F:\autorun.inf e990bc0cdb174f5d7b412e76d3c9d880N.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe e990bc0cdb174f5d7b412e76d3c9d880N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f76e83d e990bc0cdb174f5d7b412e76d3c9d880N.exe File opened for modification C:\Windows\SYSTEM.INI e990bc0cdb174f5d7b412e76d3c9d880N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e990bc0cdb174f5d7b412e76d3c9d880N.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe Token: SeDebugPrivilege 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2280 wrote to memory of 1176 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 19 PID 2280 wrote to memory of 1276 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 20 PID 2280 wrote to memory of 1336 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 21 PID 2280 wrote to memory of 1676 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 25 PID 2280 wrote to memory of 1176 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 19 PID 2280 wrote to memory of 1276 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 20 PID 2280 wrote to memory of 1336 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 21 PID 2280 wrote to memory of 1676 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 25 PID 2280 wrote to memory of 1176 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 19 PID 2280 wrote to memory of 1276 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 20 PID 2280 wrote to memory of 1336 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 21 PID 2280 wrote to memory of 1676 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 25 PID 2280 wrote to memory of 1176 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 19 PID 2280 wrote to memory of 1276 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 20 PID 2280 wrote to memory of 1336 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 21 PID 2280 wrote to memory of 1676 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 25 PID 2280 wrote to memory of 1176 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 19 PID 2280 wrote to memory of 1276 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 20 PID 2280 wrote to memory of 1336 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 21 PID 2280 wrote to memory of 1676 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 25 PID 2280 wrote to memory of 1176 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 19 PID 2280 wrote to memory of 1276 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 20 PID 2280 wrote to memory of 1336 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 21 PID 2280 wrote to memory of 1676 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 25 PID 2280 wrote to memory of 1176 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 19 PID 2280 wrote to memory of 1276 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 20 PID 2280 wrote to memory of 1336 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 21 PID 2280 wrote to memory of 1676 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 25 PID 2280 wrote to memory of 1176 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 19 PID 2280 wrote to memory of 1276 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 20 PID 2280 wrote to memory of 1336 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 21 PID 2280 wrote to memory of 1676 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 25 PID 2280 wrote to memory of 1176 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 19 PID 2280 wrote to memory of 1276 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 20 PID 2280 wrote to memory of 1336 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 21 PID 2280 wrote to memory of 1676 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 25 PID 2280 wrote to memory of 1176 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 19 PID 2280 wrote to memory of 1276 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 20 PID 2280 wrote to memory of 1336 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 21 PID 2280 wrote to memory of 1676 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 25 PID 2280 wrote to memory of 1176 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 19 PID 2280 wrote to memory of 1276 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 20 PID 2280 wrote to memory of 1336 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 21 PID 2280 wrote to memory of 1676 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 25 PID 2280 wrote to memory of 1176 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 19 PID 2280 wrote to memory of 1276 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 20 PID 2280 wrote to memory of 1336 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 21 PID 2280 wrote to memory of 1676 2280 e990bc0cdb174f5d7b412e76d3c9d880N.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e990bc0cdb174f5d7b412e76d3c9d880N.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1176
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1276
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\e990bc0cdb174f5d7b412e76d3c9d880N.exe"C:\Users\Admin\AppData\Local\Temp\e990bc0cdb174f5d7b412e76d3c9d880N.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2280
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1676
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5020727ca1f8564c1ff6e759ad1c478bb
SHA1a4e47fdf01da663309296aed524524c32bde9c32
SHA256a0926fdad31f4a9d57fc6001a28534bc0477fd7a90e03c1fabedc8ef438e9970
SHA5129e728e105f02479c583a9a9b4b97e14c612ab4efe8cfc2cc111ad76d7100f5fa15915bbf8e1cd5a402961a4e9527e80832194d251071fdf71fb18a3e0259370a