Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2024 13:01
Behavioral task
behavioral1
Sample
6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe
Resource
win10v2004-20240802-en
General
-
Target
6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe
-
Size
397KB
-
MD5
b5b98cd5208774fcf2d9888d57a8d193
-
SHA1
0029b311e2d64cc361153ef34fd34f9a835b40a9
-
SHA256
6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026
-
SHA512
4a935aceb60abff425d2df170c9aeee9ea86ac730a686f10d493b5b7d7ba802a48935fd1eb7208f79bb94569a1e807ce96a9a44b75e52f7f6fc4f958751fc723
-
SSDEEP
6144:YdIE/IurMwlZPTOmTua2uQl9DeQkqvyXMVqcSBIGNBrfSLkteA7:4/zn6maxuQl9DeQkqa8V8XNBrckcA
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1108-67-0x0000000010000000-0x000000001002D000-memory.dmp fatalrat -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
mesvc.exespower.exeupssvc.exesvchost.exepid process 4000 mesvc.exe 3180 spower.exe 2072 upssvc.exe 1108 svchost.exe -
Loads dropped DLL 7 IoCs
Processes:
mesvc.exepid process 4000 mesvc.exe 4000 mesvc.exe 4000 mesvc.exe 4000 mesvc.exe 4000 mesvc.exe 4000 mesvc.exe 4000 mesvc.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\finua8m4l7x0e35\spower.exe vmprotect behavioral2/memory/3180-48-0x00007FF72AA70000-0x00007FF72ACA3000-memory.dmp vmprotect behavioral2/memory/3180-49-0x00007FF72AA70000-0x00007FF72ACA3000-memory.dmp vmprotect behavioral2/memory/3180-59-0x00007FF72AA70000-0x00007FF72ACA3000-memory.dmp vmprotect -
Drops file in Program Files directory 10 IoCs
Processes:
upssvc.exe6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exedescription ioc process File opened for modification C:\Program Files (x86)\360\360sd\360sd.exe upssvc.exe File created C:\Program Files\Microvirt\MEmuHyperv\mesvc.exe 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe File created C:\Program Files\Microvirt\MEmuHyperv\libcrypto-1_1-x64.dll 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe File created C:\Program Files\Microvirt\MEmuHyperv\libcurl.dll 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe File created C:\Program Files\Microvirt\MEmuHyperv\libssl-1_1-x64.dll 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe File created C:\Program Files\Microvirt\MEmuHyperv\MEmuRT.dll 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe File created C:\Program Files\Microvirt\MEmuHyperv\MSVCR100.dll 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe File opened for modification C:\Program Files (x86)\360\360Safe\safemon\360tray.exe upssvc.exe File created C:\Program Files\Microvirt\MEmuHyperv\MEmuDDU.dll 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe File created C:\Program Files\Microvirt\MEmuHyperv\MSVCP100.dll 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exesvchost.exeSCHTASKS.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCHTASKS.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exepid process 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 1108 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exepid process 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exepid process 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exedescription pid process target process PID 4668 wrote to memory of 3180 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe spower.exe PID 4668 wrote to memory of 3180 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe spower.exe PID 4668 wrote to memory of 2072 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe upssvc.exe PID 4668 wrote to memory of 2072 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe upssvc.exe PID 4668 wrote to memory of 1108 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe svchost.exe PID 4668 wrote to memory of 1108 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe svchost.exe PID 4668 wrote to memory of 1108 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe svchost.exe PID 4668 wrote to memory of 1980 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe SCHTASKS.exe PID 4668 wrote to memory of 1980 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe SCHTASKS.exe PID 4668 wrote to memory of 1980 4668 6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe SCHTASKS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe"C:\Users\Admin\AppData\Local\Temp\6ec246432a49088c2fb426fcec47447ca1ffb9a776b167acb4a9d1ef6b3ab026.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\finua8m4l7x0e35\spower.exeC:\Users\Admin\AppData\Local\Temp\finua8m4l7x0e35\spower.exe2⤵
- Executes dropped EXE
PID:3180
-
-
C:\Users\Admin\AppData\Local\Temp\finua8m4l7x0e35\upssvc.exeC:\Users\Admin\AppData\Local\Temp\finua8m4l7x0e35\upssvc.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2072
-
-
C:\ProgramData\NVIDIARV\svchost.exeC:\ProgramData\NVIDIARV\svchost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC ONLOGON /TN WindowsUpdata /F /RL HIGHEST /TR C:\Users\Public\Pictures359mw1pp\CCCef3Render.exe2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1980
-
-
C:\Program Files\Microvirt\MEmuHyperv\mesvc.exe"C:\Program Files\Microvirt\MEmuHyperv\mesvc.exe" -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
355KB
MD5ce98c3cbd7bfcca2755b35e77a2bceb2
SHA1c12c20bb69e7858682ab6bb21ca3971880efdc07
SHA2561ec46488b2db690f6f769c6cfa7e3021ee6f88096303f04be43f3f2150d8c946
SHA512dfc4f4b300cd2dc0d0f19b415da157b15ce666e1927266feb7a445ffb9199620bb7fc55746239f81fd3f79133c64c8d41822ccddc625288a33a6737a062faee5
-
Filesize
3.8MB
MD556719cc92af72f56f46a5798b1430d9e
SHA1497456e1b225a541058c8d7f96f2a3ef082d147c
SHA256ca5e9919a5b3612a2faaab0f08f3e95db69e3d88d821a706c5d68d3f0d86d060
SHA5125ca3fd7d6f86c5969949e55669c315287084633ccd42aae45cef170bce4fb05071637aaf6a9fce973cdb32003fdf02e184c8dc5aa3c327a17d3889084e07637a
-
Filesize
612KB
MD589acd78f8c6d92947b3fcc78c7493036
SHA13317bd26eda9a7a0d49dfcfe27673d96b2873c95
SHA256e7675926ff8f230e3ce88de65e47ab3fd6f8d617a93e062dd9ecc4226e9d16c0
SHA51208ddb16ab60ea0f531f7853dc6a66a7a2302516e1b54258f2884528a4304cb05111b073d15387702c359f00bd96156043cadddd2b230bfa8bd288b578a11225f
-
Filesize
830KB
MD534b2d5ad1c7c600f9d24660928a03382
SHA1ab9621342ada12b355ea5fcd76b666193898c11b
SHA256d7d6ff911503e848ffc6c0ba43382cc2e1e00b367d55ffdb883c54b688c5c28e
SHA5120d86a396f81864c9ce5a57090fd45745f8c66a28f78fb469a6d62ce01c519f6a0c58d904afa99baef2f74ae4fe2308dc710c901d0394779837b82748679363fa
-
Filesize
2.6MB
MD56def652fd7e5207c374fc51534bda953
SHA1ee23eab28dd67ce96e7799a31801580c824cde5f
SHA25680677a75588101ca6da2a22b74c02bd5b91aba2a62d1bce20d07370a9ddf0118
SHA512f3284532571bfb83a622b019040e4882866941c66a06a9c83da23a1a820b940c48ffedd1d109c799b64d6bd30775cdb9ea1067869f565116653988bd763552a8
-
Filesize
365KB
MD575b9bbfcf9581252474a5d1daa6e6641
SHA10fb1cfa16bf68fb13ba9816c2354af358bded167
SHA256c78b0aa24630b35dfd3030626f873a89a39944ffa620b6afb42ae50eb1618f4b
SHA512ed527526fd6053425fcefdfa5174d7dfa3b3b3601f33f8019b1215c9f1b85d823910f5a02c9bdd296d70058a516f9d464f42e712903144315e17f4ce7ad17561
-
Filesize
639KB
MD52b242983d5fc098515105268eb22f0b7
SHA16a660eae893f16b988b44ec943a8dacf808f467e
SHA2561679808a0a410e73d7807c1facfd0ce0ee1e6270b35d29dcdf0a8977c17418ac
SHA512905b01240f92124f71acd61a075887d89a83699681f585a246aa44b9d514829adec5ab827d720c7c7eccd8392698ee3f18fe9b2f7fcd81000cb0f40caa28ff06
-
Filesize
4.6MB
MD58c1eca3e2fe8f5fd1a0ce4b4a8cf4409
SHA18d45e044cbdcf645fe359864bc700b2568032687
SHA2566ef47689ea1309e43869ec59861a677fe4e40cf03eb89386fc7d32fc516e9671
SHA5124bf03b1453fa1f1bed14cb133c01c7b9b348f82da775bbbeaefc7867d348928c265b6b38623ced8b711138876365d63a669955920a5b5ae119975184297fe54f
-
Filesize
3.4MB
MD52245645176fda20e229c972cf00329cd
SHA17c42fa190c87252db3a2d9b39932721183a0d7b5
SHA2560713e9742f7920fc0f1b2c062dce06041f7a0d509e2408328da8db32bb8cafdc
SHA512bdf3e6f553f4a8f7609bbe6401f847c3f43d559ba5e0f8ee7395c8e7449b6fa8c319f064d6a37bcab97a4fc3cf3379058b4d71ad17bb0d741946447a2a1c6247
-
Filesize
1.1MB
MD57d36f6333547acc3b7dc83e082f90e45
SHA1dd1ebd454970b5a1791ed3fcc240fe15a5906f91
SHA2567b29d4f45a4353b32ca1f5e3a79ef87e7dda5f1572100cce70aaf2fa6c9d25b9
SHA51293bf4fa081eb341a87c7c43d5bb6e45fedfeee71161d782a02d07072741684320379e87b4c660a3a4b716141e25a24ffce760e4b04613dbd6df27bf001abf123
-
Filesize
147KB
MD568a6e6dfdd09a7e7fb8d31b104d9c40c
SHA1688e015ec4a38df2b24e2adadcce2c67cb513167
SHA256f1ffc36d0a457653cb1f86a094e31d870155f2f090c9f38836a56c7893e73e4e
SHA512633eb75c51a730ca37f4287ea26017523d70f8c4a34c656e2ee7aaa2a99ed697a679ee395d345cef6942ae28cae199513943250cae2f0dd33d52bf5241586aca