Analysis
-
max time kernel
32s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
04/12/2024, 08:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fc6c4e80d19b321923e09919d9b4607c7e5b8163f8a533f41a3b29a2d912bf19N.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
120 seconds
General
-
Target
fc6c4e80d19b321923e09919d9b4607c7e5b8163f8a533f41a3b29a2d912bf19N.dll
-
Size
120KB
-
MD5
9e6ff82e8d1554d37a11d4958df46150
-
SHA1
de9bb3b54eea694101bc0d642a191d847587dc2c
-
SHA256
fc6c4e80d19b321923e09919d9b4607c7e5b8163f8a533f41a3b29a2d912bf19
-
SHA512
2275b3ff0f241f217f4adba4d88890cfdcceb2f24d9c02cfc95f5db602898cb5013d288e37935fb9c6d02f6725f59aae39f003b542840febe1a3687eb9002a01
-
SSDEEP
3072:aaniXamvKL/u3We1Wzc86ASw4b9am/yJWHb:aaiXhiE8Xlsb
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76c301.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76c301.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76c301.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76ecbf.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ecbf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c4c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c4c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c4c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c4c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c4c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c4c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76ecbf.exe -
Executes dropped EXE 3 IoCs
pid Process 2436 f76c301.exe 2756 f76c4c5.exe 1088 f76ecbf.exe -
Loads dropped DLL 6 IoCs
pid Process 828 rundll32.exe 828 rundll32.exe 828 rundll32.exe 828 rundll32.exe 828 rundll32.exe 828 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c4c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c4c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c4c5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76c4c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c301.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c4c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c4c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c301.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c4c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76ecbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c301.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ecbf.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f76c301.exe File opened (read-only) \??\M: f76c301.exe File opened (read-only) \??\N: f76c301.exe File opened (read-only) \??\O: f76c301.exe File opened (read-only) \??\E: f76ecbf.exe File opened (read-only) \??\G: f76ecbf.exe File opened (read-only) \??\E: f76c301.exe File opened (read-only) \??\H: f76c301.exe File opened (read-only) \??\I: f76c301.exe File opened (read-only) \??\J: f76c301.exe File opened (read-only) \??\K: f76c301.exe File opened (read-only) \??\P: f76c301.exe File opened (read-only) \??\H: f76ecbf.exe File opened (read-only) \??\L: f76c301.exe File opened (read-only) \??\I: f76ecbf.exe -
resource yara_rule behavioral1/memory/2436-13-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-16-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-17-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-19-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-21-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-20-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-22-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-18-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-15-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-14-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-64-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-63-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-62-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-65-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-66-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-67-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-71-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-86-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-99-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-100-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-103-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-105-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-107-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2436-140-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2756-146-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/1088-158-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1088-211-0x0000000000710000-0x00000000017CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76c36e f76c301.exe File opened for modification C:\Windows\SYSTEM.INI f76c301.exe File created C:\Windows\f77170a f76ecbf.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76c301.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76ecbf.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2436 f76c301.exe 2436 f76c301.exe 1088 f76ecbf.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 2436 f76c301.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe Token: SeDebugPrivilege 1088 f76ecbf.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1976 wrote to memory of 828 1976 rundll32.exe 30 PID 1976 wrote to memory of 828 1976 rundll32.exe 30 PID 1976 wrote to memory of 828 1976 rundll32.exe 30 PID 1976 wrote to memory of 828 1976 rundll32.exe 30 PID 1976 wrote to memory of 828 1976 rundll32.exe 30 PID 1976 wrote to memory of 828 1976 rundll32.exe 30 PID 1976 wrote to memory of 828 1976 rundll32.exe 30 PID 828 wrote to memory of 2436 828 rundll32.exe 31 PID 828 wrote to memory of 2436 828 rundll32.exe 31 PID 828 wrote to memory of 2436 828 rundll32.exe 31 PID 828 wrote to memory of 2436 828 rundll32.exe 31 PID 2436 wrote to memory of 1112 2436 f76c301.exe 19 PID 2436 wrote to memory of 1204 2436 f76c301.exe 20 PID 2436 wrote to memory of 1288 2436 f76c301.exe 21 PID 2436 wrote to memory of 1616 2436 f76c301.exe 25 PID 2436 wrote to memory of 1976 2436 f76c301.exe 29 PID 2436 wrote to memory of 828 2436 f76c301.exe 30 PID 2436 wrote to memory of 828 2436 f76c301.exe 30 PID 828 wrote to memory of 2756 828 rundll32.exe 32 PID 828 wrote to memory of 2756 828 rundll32.exe 32 PID 828 wrote to memory of 2756 828 rundll32.exe 32 PID 828 wrote to memory of 2756 828 rundll32.exe 32 PID 2436 wrote to memory of 1112 2436 f76c301.exe 19 PID 2436 wrote to memory of 1204 2436 f76c301.exe 20 PID 2436 wrote to memory of 1288 2436 f76c301.exe 21 PID 2436 wrote to memory of 1616 2436 f76c301.exe 25 PID 2436 wrote to memory of 1976 2436 f76c301.exe 29 PID 2436 wrote to memory of 2756 2436 f76c301.exe 32 PID 2436 wrote to memory of 2756 2436 f76c301.exe 32 PID 828 wrote to memory of 1088 828 rundll32.exe 34 PID 828 wrote to memory of 1088 828 rundll32.exe 34 PID 828 wrote to memory of 1088 828 rundll32.exe 34 PID 828 wrote to memory of 1088 828 rundll32.exe 34 PID 1088 wrote to memory of 1112 1088 f76ecbf.exe 19 PID 1088 wrote to memory of 1204 1088 f76ecbf.exe 20 PID 1088 wrote to memory of 1288 1088 f76ecbf.exe 21 PID 1088 wrote to memory of 1616 1088 f76ecbf.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c301.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ecbf.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1204
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1288
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fc6c4e80d19b321923e09919d9b4607c7e5b8163f8a533f41a3b29a2d912bf19N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fc6c4e80d19b321923e09919d9b4607c7e5b8163f8a533f41a3b29a2d912bf19N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\f76c301.exeC:\Users\Admin\AppData\Local\Temp\f76c301.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\f76c4c5.exeC:\Users\Admin\AppData\Local\Temp\f76c4c5.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\f76ecbf.exeC:\Users\Admin\AppData\Local\Temp\f76ecbf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1088
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1616
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5f3e0f62b36aae1e3720133ec0f0c8dad
SHA16b424f372dd94c0d9c68147c45fe016dff45d1d3
SHA2569e94d6d057f99dcd6ba5655882686f4993849771a585d2a9dcb1e800c6fcb52f
SHA5124551cfe92126b08421ec38c8654245327de240252b2bbf9ac863139822b163fd941e3c0129e8438e5711f9d3300b3a6dbdaf55fea1bb31425b8873e5c5bd6ad4
-
Filesize
257B
MD558662fe3b29aa10c6d0469df52028dde
SHA17f2f1064a768f438b3b301eeb3e27ccce247dab9
SHA2563e4091e9f4b58cdef118bb9b241f8bd5b5f23ec42df853974ffff1c052db0187
SHA512561368b10a1603ac80a140db1fb108c8683136c42467a039e6195587aa033b6c849a4893349874d8a9e6c91c72165e1fd1a781e51d4534e3194b8d1024a8ddc3