Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 08:14
Static task
static1
Behavioral task
behavioral1
Sample
Real Spy Monitor v2.89 特别版 电脑监测安全软件/Real.Spy.Monitor/NewSpy.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Real Spy Monitor v2.89 特别版 电脑监测安全软件/Real.Spy.Monitor/NewSpy.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Real Spy Monitor v2.89 特别版 电脑监测安全软件/Real.Spy.Monitor/下载说明.htm
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Real Spy Monitor v2.89 特别版 电脑监测安全软件/Real.Spy.Monitor/下载说明.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Real Spy Monitor v2.89 特别版 电脑监测安全软件/Real.Spy.Monitor/飘荡精品软件.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Real Spy Monitor v2.89 特别版 电脑监测安全软件/Real.Spy.Monitor/飘荡精品软件.url
Resource
win10v2004-20240802-en
General
-
Target
Real Spy Monitor v2.89 特别版 电脑监测安全软件/Real.Spy.Monitor/下载说明.htm
-
Size
2KB
-
MD5
9785eb39d2a933dafc7c713baefda91b
-
SHA1
fd66e14363e866222e467c4397e8ccb1d0954a7b
-
SHA256
b7a5dde4b441c67156e2085ebcb90ac91e72f376cc4fd7874c69974de39730c0
-
SHA512
7e8d6f5e77dae8bb4cced6fcb9d3d6d79b3165ce8fe1c0b6d8c6a5184d28d6bbd31959780f0e212f6f1a0f373fc23958f6b5481cc5075a4802b51538efe79dd7
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4800 msedge.exe 4800 msedge.exe 1268 msedge.exe 1268 msedge.exe 4344 identity_helper.exe 4344 identity_helper.exe 2520 msedge.exe 2520 msedge.exe 2520 msedge.exe 2520 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe 1268 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1268 wrote to memory of 3940 1268 msedge.exe 84 PID 1268 wrote to memory of 3940 1268 msedge.exe 84 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 3132 1268 msedge.exe 85 PID 1268 wrote to memory of 4800 1268 msedge.exe 86 PID 1268 wrote to memory of 4800 1268 msedge.exe 86 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87 PID 1268 wrote to memory of 3588 1268 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ Real Spy Monitor v2.89 特别版 电脑监测安全软件\Real.Spy.Monitor\下载说明.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8a1f46f8,0x7ffa8a1f4708,0x7ffa8a1f47182⤵PID:3940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:82⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:12⤵PID:868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:12⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:12⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:12⤵PID:3352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1724 /prefetch:12⤵PID:2716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6509259810311940056,13202732583605468770,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5808 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2520
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2656
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
6KB
MD5bf652072deded32961f64c170d2ce909
SHA1b922dba29575ae1e9dc99725114a006710498fec
SHA256a993574cc73ca208ebef1963c6501c50cfd19d408f18288cb7645feaedb314ea
SHA5128415b4d1753c195eded95a86a4363fbb1ce5c18e5c5929eb5caf98727c3d689d8fbbca19f2d6a70362c1008c78b794e1ad67fd864663cb7b74cbb7e17d29a3e2
-
Filesize
6KB
MD596f1cd149719de8937d526af051fe9cf
SHA1984e2f9d5a910fac5db4df2c2600662e58e8f1b6
SHA2569743089aa06793971d59ce7520a53a97cf017bc7180dc40e185c9fd0116ec63d
SHA51202f03c1891ba57adfb90e5d71cb638bb4cc651653e62914eddff4f8fb395ab8d98f612b4652dce7d20f46131283b49f295c1d02c04af62f22afa699508406f3a
-
Filesize
6KB
MD5092ddecf35d3425e1fd26730353deb60
SHA1daea125676c91e5363b9e76c4841c77129737dbf
SHA2568eb17f3d5050a3806c25e68bbd6cd7af178585d296278d96d497aaf6e87276f6
SHA5120a38d91f1201d6c86ce9163115c97d9cbb4e514d5be17a8b7c3490438ad63ebf9ab7a29780c4a320ab179570db6323f9a9190043ee62b1164635eb9058ddf701
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5ad8ad01ea8a4952b0d07631635e425c1
SHA153007ac4700f47459917b554c87e3a5988fcbcc5
SHA25698a40408566d5603082bc33d3da47426941ad064a0a57310c44ac434389a98be
SHA5123c36d174bb63d62a5dac0ed87b67e57680d458835c153e0b7f71a5a1dfc8a3e7744c7b8d68ac69ae446743b40651b92b481e18203b45ea85c49ff3df21adadc6