Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/11/2024, 12:55
Static task
static1
Behavioral task
behavioral1
Sample
软件安装包u5.2.6.msi
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
软件安装包u5.2.6.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
软件安装包u5.2.6.msi
-
Size
12.3MB
-
MD5
f128e0366847f75148a914540c8d43fc
-
SHA1
d94a75e313329d7787aeac6c6010cce8c6368bdd
-
SHA256
570c265082d625f99c178ac6565c18798f614e97d1edbeff6fd5acbdfcafdc9a
-
SHA512
08875de029a89d5005203883820391695355cffdb0caa819b418bea0bfe4733926a4268684b8bb8ca65777b4b448ca8c47d5028fbbefd9fcc1f0e100fe5e9d75
-
SSDEEP
393216:e49ccZUpj4f7eUFVg9UwfegD8ZVCrnRji:VKJpEfqqVg9dfegDCVCrnRG
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2920 MsiExec.exe 2920 MsiExec.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Windows NT\7za.bin msiexec.exe File created C:\Program Files (x86)\Windows NT\data.bin msiexec.exe File created C:\Program Files (x86)\Windows NT\Update.png MsiExec.exe File opened for modification C:\Program Files (x86)\Windows NT\Update.png MsiExec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76b9ed.msi msiexec.exe File opened for modification C:\Windows\Installer\f76b9ed.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f76b9ee.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f76b9ee.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIBB15.tmp msiexec.exe File created C:\Windows\Installer\f76b9f0.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBC11.tmp msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 2920 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2872 msiexec.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Modifies registry class 22 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\ProductName = "Setup" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ABCBC521D000113428DCA4ABCB7D434C\67741285AA03C674BB2A8E1F99A591BF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\Version = "16973828" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList\PackageName = "软件安装包u5.2.6.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67741285AA03C674BB2A8E1F99A591BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\PackageCode = "6FB9EEAA2B76EFD4A980BA0024B9CD86" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ABCBC521D000113428DCA4ABCB7D434C msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67741285AA03C674BB2A8E1F99A591BF\ProdFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList\Media\1 = ";" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2312 msiexec.exe 2312 msiexec.exe 2920 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2872 msiexec.exe Token: SeIncreaseQuotaPrivilege 2872 msiexec.exe Token: SeRestorePrivilege 2312 msiexec.exe Token: SeTakeOwnershipPrivilege 2312 msiexec.exe Token: SeSecurityPrivilege 2312 msiexec.exe Token: SeCreateTokenPrivilege 2872 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2872 msiexec.exe Token: SeLockMemoryPrivilege 2872 msiexec.exe Token: SeIncreaseQuotaPrivilege 2872 msiexec.exe Token: SeMachineAccountPrivilege 2872 msiexec.exe Token: SeTcbPrivilege 2872 msiexec.exe Token: SeSecurityPrivilege 2872 msiexec.exe Token: SeTakeOwnershipPrivilege 2872 msiexec.exe Token: SeLoadDriverPrivilege 2872 msiexec.exe Token: SeSystemProfilePrivilege 2872 msiexec.exe Token: SeSystemtimePrivilege 2872 msiexec.exe Token: SeProfSingleProcessPrivilege 2872 msiexec.exe Token: SeIncBasePriorityPrivilege 2872 msiexec.exe Token: SeCreatePagefilePrivilege 2872 msiexec.exe Token: SeCreatePermanentPrivilege 2872 msiexec.exe Token: SeBackupPrivilege 2872 msiexec.exe Token: SeRestorePrivilege 2872 msiexec.exe Token: SeShutdownPrivilege 2872 msiexec.exe Token: SeDebugPrivilege 2872 msiexec.exe Token: SeAuditPrivilege 2872 msiexec.exe Token: SeSystemEnvironmentPrivilege 2872 msiexec.exe Token: SeChangeNotifyPrivilege 2872 msiexec.exe Token: SeRemoteShutdownPrivilege 2872 msiexec.exe Token: SeUndockPrivilege 2872 msiexec.exe Token: SeSyncAgentPrivilege 2872 msiexec.exe Token: SeEnableDelegationPrivilege 2872 msiexec.exe Token: SeManageVolumePrivilege 2872 msiexec.exe Token: SeImpersonatePrivilege 2872 msiexec.exe Token: SeCreateGlobalPrivilege 2872 msiexec.exe Token: SeBackupPrivilege 296 vssvc.exe Token: SeRestorePrivilege 296 vssvc.exe Token: SeAuditPrivilege 296 vssvc.exe Token: SeBackupPrivilege 2312 msiexec.exe Token: SeRestorePrivilege 2312 msiexec.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeLoadDriverPrivilege 2772 DrvInst.exe Token: SeLoadDriverPrivilege 2772 DrvInst.exe Token: SeLoadDriverPrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2312 msiexec.exe Token: SeTakeOwnershipPrivilege 2312 msiexec.exe Token: SeRestorePrivilege 2312 msiexec.exe Token: SeTakeOwnershipPrivilege 2312 msiexec.exe Token: SeRestorePrivilege 2312 msiexec.exe Token: SeTakeOwnershipPrivilege 2312 msiexec.exe Token: SeRestorePrivilege 2312 msiexec.exe Token: SeTakeOwnershipPrivilege 2312 msiexec.exe Token: SeRestorePrivilege 2312 msiexec.exe Token: SeTakeOwnershipPrivilege 2312 msiexec.exe Token: SeRestorePrivilege 2312 msiexec.exe Token: SeTakeOwnershipPrivilege 2312 msiexec.exe Token: SeRestorePrivilege 2312 msiexec.exe Token: SeTakeOwnershipPrivilege 2312 msiexec.exe Token: SeRestorePrivilege 2312 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2872 msiexec.exe 2872 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2920 2312 msiexec.exe 32 PID 2312 wrote to memory of 2920 2312 msiexec.exe 32 PID 2312 wrote to memory of 2920 2312 msiexec.exe 32 PID 2312 wrote to memory of 2920 2312 msiexec.exe 32 PID 2312 wrote to memory of 2920 2312 msiexec.exe 32 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\软件安装包u5.2.6.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2872
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 33DFFCB6F4B2C1BAD0030EF534C92429 M Global\MSI00002⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2920
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:296
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003A0" "00000000000005DC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.8MB
MD5b1a512545f2153f9acb805288c09bf39
SHA15160e00b1f283ead1a62fc889150aa525fd84c7c
SHA2565bb6a98e723333e36cb4ca75f74a97a4886dd432cdcdb5d88a5016dc34f77463
SHA5126af008f5ca3d577d9d0e87227739581b69a29ba2ddc4652d51bffd9dede58f5e4742e6f22aa7470bcdc69e7bfbbd67a0ca6229462777082fe62627e5e5848661
-
Filesize
11.8MB
MD5dfb8e9e024e2137c56f4869070994068
SHA1b954b321ce72829a8cb14bbb5fdfe8c3d0c451be
SHA25675c51971b8fc6c8f9303c7ba3c26c89b9cfea20025758a782dab122ebae62147
SHA512dba2ae510fa3780d8d988e2b564de2c60f6824abc3284793bee5ea785f6b951addccadb686c51e14a5b7ed54f13f5a3d29f3fc0324c8ece6c8ed01fbb9dc83a7
-
Filesize
12.3MB
MD5f128e0366847f75148a914540c8d43fc
SHA1d94a75e313329d7787aeac6c6010cce8c6368bdd
SHA256570c265082d625f99c178ac6565c18798f614e97d1edbeff6fd5acbdfcafdc9a
SHA51208875de029a89d5005203883820391695355cffdb0caa819b418bea0bfe4733926a4268684b8bb8ca65777b4b448ca8c47d5028fbbefd9fcc1f0e100fe5e9d75