Overview
overview
10Static
static
10bca3772529...45.exe
windows7-x64
10bca3772529...45.exe
windows10-2004-x64
10bccb34575f...72.exe
windows7-x64
10bccb34575f...72.exe
windows10-2004-x64
10bcf1af9a5a...be.exe
windows7-x64
10bcf1af9a5a...be.exe
windows10-2004-x64
8bcf783e363...97.exe
windows7-x64
3bcf783e363...97.exe
windows10-2004-x64
3bd515574dc...8c.exe
windows7-x64
1bd515574dc...8c.exe
windows10-2004-x64
1bd68ca7605...39.exe
windows7-x64
10bd68ca7605...39.exe
windows10-2004-x64
10bd707a0357...e3.exe
windows7-x64
9bd707a0357...e3.exe
windows10-2004-x64
9bd7edfedeb...0b.exe
windows7-x64
10bd7edfedeb...0b.exe
windows10-2004-x64
10bdad1ff46d...f2.exe
windows7-x64
10bdad1ff46d...f2.exe
windows10-2004-x64
10bdae9ff159...df.exe
windows7-x64
10bdae9ff159...df.exe
windows10-2004-x64
10be01d2552c...1c.exe
windows7-x64
10be01d2552c...1c.exe
windows10-2004-x64
10be077774c9...87.exe
windows7-x64
10be077774c9...87.exe
windows10-2004-x64
10be0a8aeb7e...56.exe
windows7-x64
3be0a8aeb7e...56.exe
windows10-2004-x64
3be1643898c...f5.exe
windows7-x64
7be1643898c...f5.exe
windows10-2004-x64
10be183db6d4...94.exe
windows7-x64
10be183db6d4...94.exe
windows10-2004-x64
10be2375e810...94.exe
windows7-x64
10be2375e810...94.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:15
Behavioral task
behavioral1
Sample
bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
bccb34575fb2db34d4a29075cb2f9aa39904b7d5412695545f2240c00fbb0472.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
bccb34575fb2db34d4a29075cb2f9aa39904b7d5412695545f2240c00fbb0472.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
bcf1af9a5a93ae74ea1c79da9951c5be.exe
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
bcf1af9a5a93ae74ea1c79da9951c5be.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
bcf783e363557f5bdd4014c159ae2497.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
bcf783e363557f5bdd4014c159ae2497.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
bd515574dc1cb379674710f110e907d8cd72a5e4c5eb90d464fbee847b71718c.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
bd515574dc1cb379674710f110e907d8cd72a5e4c5eb90d464fbee847b71718c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
bd68ca7605316450c87b9218d2dbe19d8c5694e07b93f320f3ca4a9ad902c139.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
bd68ca7605316450c87b9218d2dbe19d8c5694e07b93f320f3ca4a9ad902c139.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
bd707a0357b19ea6953d47900bb051e3.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
bd707a0357b19ea6953d47900bb051e3.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral15
Sample
bd7edfedebe8a680d801ffd5b2415cd3877e95c78edb8cfc44eaae3e0e9a1e0b.exe
Resource
win7-20250207-en
Behavioral task
behavioral16
Sample
bd7edfedebe8a680d801ffd5b2415cd3877e95c78edb8cfc44eaae3e0e9a1e0b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
bdad1ff46d46963cc687d5f6889c9ef2.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
bdad1ff46d46963cc687d5f6889c9ef2.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
bdae9ff15952ccdfec0be80562f1cbdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
bdae9ff15952ccdfec0be80562f1cbdf.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
be01d2552c64422f1b97721af2e07451309244c21e464bbe47b603043d95b21c.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
be01d2552c64422f1b97721af2e07451309244c21e464bbe47b603043d95b21c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
be077774c9e78bbe8c9388aa7d552de77e9ef40ec732ea193da049a0db2e5787.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
be077774c9e78bbe8c9388aa7d552de77e9ef40ec732ea193da049a0db2e5787.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
be0a8aeb7e1655bee6255bac9c2947ecef511b5f00e29933dfd9c7f39965bf56.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
be0a8aeb7e1655bee6255bac9c2947ecef511b5f00e29933dfd9c7f39965bf56.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
be1643898cf51a24e38e4044d24ae1f5.exe
Resource
win7-20241023-en
Behavioral task
behavioral28
Sample
be1643898cf51a24e38e4044d24ae1f5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
be183db6d4b77c092496c69c3f389b94.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
be183db6d4b77c092496c69c3f389b94.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe
Resource
win10v2004-20250314-en
General
-
Target
be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe
-
Size
192KB
-
MD5
e5f8f6cd43f153b1223a9175fc19e235
-
SHA1
c5ce77bf08255c036602902b622b895ae90f369d
-
SHA256
be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694
-
SHA512
fecacd2cced113bf3749bfd86570fa10e2f42f7f4dceb18d9a2a90fc367476eb5f61d4cb7b3f320eccbffd96a7bc2d81cae81fabf5e74da507f88388690d481a
-
SSDEEP
3072:qN9AvTqSWPVKBGr8rQmRLjjsskVZK9kCk3mb3Eg2mogLfOsea1YuNPzLHWA9b80l:yhEKolQZKaCm6VXogLf3/bNHjbzl
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Public\\Pictures\\Blasted.exe" be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe -
Executes dropped EXE 3 IoCs
pid Process 5636 Blasted.exe 448 Blasted.exe 2332 Blasted.exe -
Loads dropped DLL 12 IoCs
pid Process 5636 Blasted.exe 5620 Process not Found 2316 Process not Found 1992 Process not Found 3376 findstr.exe 5292 netsh.exe 2372 Process not Found 5960 Process not Found 3124 Process not Found 448 Blasted.exe 4284 Process not Found 2332 Blasted.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Blasted.exe Key opened \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Blasted.exe Key opened \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Blasted.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 35 icanhazip.com -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xdwd.dll be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe File opened for modification C:\Windows\xdwd.dll be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 5292 netsh.exe 3680 cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 Blasted.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Blasted.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1444 schtasks.exe 1588 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 5636 Blasted.exe 3376 findstr.exe 3376 findstr.exe 5292 netsh.exe 5292 netsh.exe 448 Blasted.exe 448 Blasted.exe 2332 Blasted.exe 2332 Blasted.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4268 be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe Token: SeDebugPrivilege 5636 Blasted.exe Token: SeIncBasePriorityPrivilege 5636 Blasted.exe Token: SeDebugPrivilege 448 Blasted.exe Token: SeDebugPrivilege 2332 Blasted.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4268 wrote to memory of 4608 4268 be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe 90 PID 4268 wrote to memory of 4608 4268 be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe 90 PID 4268 wrote to memory of 1916 4268 be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe 91 PID 4268 wrote to memory of 1916 4268 be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe 91 PID 1916 wrote to memory of 1444 1916 cmd.exe 94 PID 1916 wrote to memory of 1444 1916 cmd.exe 94 PID 4268 wrote to memory of 1680 4268 be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe 95 PID 4268 wrote to memory of 1680 4268 be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe 95 PID 1680 wrote to memory of 1588 1680 cmd.exe 97 PID 1680 wrote to memory of 1588 1680 cmd.exe 97 PID 4268 wrote to memory of 5636 4268 be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe 98 PID 4268 wrote to memory of 5636 4268 be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe 98 PID 5636 wrote to memory of 3680 5636 Blasted.exe 103 PID 5636 wrote to memory of 3680 5636 Blasted.exe 103 PID 3680 wrote to memory of 3528 3680 cmd.exe 105 PID 3680 wrote to memory of 3528 3680 cmd.exe 105 PID 3680 wrote to memory of 5292 3680 cmd.exe 106 PID 3680 wrote to memory of 5292 3680 cmd.exe 106 PID 3680 wrote to memory of 3376 3680 cmd.exe 107 PID 3680 wrote to memory of 3376 3680 cmd.exe 107 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Blasted.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Blasted.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe"C:\Users\Admin\AppData\Local\Temp\be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh firewall add allowedprogram "C:\Users\Public\Pictures\Blasted.exe" WindowsControl ENABLE & exit2⤵PID:4608
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Public\Pictures\Blasted.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Public\Pictures\Blasted.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1444
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Blasted.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Blasted.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1588
-
-
-
C:\Users\Public\Pictures\Blasted.exe"C:\Users\Public\Pictures\Blasted.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:5636 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /C chcp 65001 && netsh wlan show profiles | findstr All3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:3528
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5292
-
-
C:\Windows\system32\findstr.exefindstr All4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3376
-
-
-
-
C:\Users\Public\Pictures\Blasted.exeC:\Users\Public\Pictures\Blasted.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:448
-
C:\Users\Public\Pictures\Blasted.exeC:\Users\Public\Pictures\Blasted.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
2AppInit DLLs
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
2AppInit DLLs
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
642B
MD5e19ed69089e56bbfaaba5e5e63d0354f
SHA1287519bf7c4ec630e4326db00809f627f927ebef
SHA256f9481e31897c3d9071b744e1638942b52c46858c16ccf692f5c6e109a8b092f6
SHA512c4a8678d28eea4c3a3adfe0324943478efabef839d3bdacb0e4c278e97ee356037c0bfd83b096952b43d81af0b7253eb7d666416e0024ce93a1c516a834fd05b
-
Filesize
228KB
MD5ee463e048e56b687d02521cd12788e2c
SHA1ee26598f8e8643df84711960e66a20ecbc6321b8
SHA2563a07b3003758a79a574aa73032076567870389751f2a959537257070da3a10d8
SHA51242b395bf6bd97da800385b9296b63a4b0edd7b3b50dc92f19e61a89235a42d37d204359b57d506e6b25ab95f16625cce035ed3b55ef2d54951c82332498dab0f
-
Filesize
130KB
MD5b33d9aa8389eb13e907085a77234e34e
SHA183935f3310d27e31260821a2f233a77cacf5402e
SHA256bfef543edcd06c1f48237cd4d3a398c1011179efee8d98905e84a734002128d1
SHA51280c2627f65437a929b5a3285bd7291043182938dfd61d06fe653d38ba3fc7e9acf428712ebf4142c27e6523a8e9262d99cad4ec99a74b9da91c0a5b287109bab
-
Filesize
192KB
MD5e5f8f6cd43f153b1223a9175fc19e235
SHA1c5ce77bf08255c036602902b622b895ae90f369d
SHA256be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694
SHA512fecacd2cced113bf3749bfd86570fa10e2f42f7f4dceb18d9a2a90fc367476eb5f61d4cb7b3f320eccbffd96a7bc2d81cae81fabf5e74da507f88388690d481a
-
Filesize
136KB
MD516e5a492c9c6ae34c59683be9c51fa31
SHA197031b41f5c56f371c28ae0d62a2df7d585adaba
SHA25635c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
SHA51220fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6