Analysis
-
max time kernel
119s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe
-
Size
2.0MB
-
MD5
fec8fdf6f039781a2ea596f1208639a0
-
SHA1
c915b3b30acf84f2b22b269632d7ba45431d9281
-
SHA256
a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40c
-
SHA512
9d4b06cc5570befc6b068e688b5a397b31e36f31c8f67e76a5f98bad1369e6c9a03788ee5754976be1a5a37f343c98dd30bb60b7d1b8fe7a2767c41f655d51b6
-
SSDEEP
49152:stcJsrPa00lOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmqTjcoD:stcJIqqUHxqPF9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 5084 a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.tmp 2828 a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.mm 2788 GOG.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.mm Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.mm -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened (read-only) \??\B: a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\7-Zip\7zG.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\dotnet\dotnet.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\7-Zip\7z.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\GOG.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.mm File created C:\Windows\GOG.exe GOG.exe File created C:\Windows\GOG.exe a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.mm -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.mm Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3248 a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe 3248 a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe 2788 GOG.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3248 wrote to memory of 5084 3248 a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe 83 PID 3248 wrote to memory of 5084 3248 a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe 83 PID 3248 wrote to memory of 2828 3248 a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe 84 PID 3248 wrote to memory of 2828 3248 a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe 84 PID 3248 wrote to memory of 2828 3248 a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe 84 PID 2828 wrote to memory of 2788 2828 a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.mm 85 PID 2828 wrote to memory of 2788 2828 a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.mm 85 PID 2828 wrote to memory of 2788 2828 a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.mm 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe"C:\Users\Admin\AppData\Local\Temp\a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.tmpC:\Users\Admin\AppData\Local\Temp\a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.tmp2⤵
- Executes dropped EXE
PID:5084
-
-
C:\Users\Admin\AppData\Local\Temp\a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.mmC:\Users\Admin\AppData\Local\Temp\a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2788
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.mm
Filesize571KB
MD5febe565a2640aa3dc9c6f227c9e1e952
SHA11633609b432d5e8baf3cadd35235f24f9ebdf15b
SHA25617812a72e5fd347cb954e57b7076c03717a837808a38d57e0c3d49cd819be4fd
SHA5125a8401209ca4c92aec16cdc830598eca3047f837b4f64037317744b3d7e10475107fe46253ca96192e0eee998278d8779612e5cfd74928db6d4236cca835a9b9
-
C:\Users\Admin\AppData\Local\Temp\a6d67b077c95951922e5fe5d7c9fde3fc11a8fb70e7eec12cba05515079bc40cN.tmp
Filesize1.4MB
MD56b277c1f5a1ec567fcab409867b91a92
SHA18fd9b679a1f42d528304f42aeff6702b8bdb6a89
SHA256ab29de51a0e42a7adbf3c170c603f5aad44281361205b317b35887d199786274
SHA512fdf8ef16051b030911e1c32afafcf603ffa180ae380da0608403e7d9c09e343df73aa2673056ac4faaf79dcf8a4be7aeb7e80a5642a6930ebc7a27de76ae6bc0