Analysis
-
max time kernel
57s -
max time network
23s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 06:36
Behavioral task
behavioral1
Sample
e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe
-
Size
160KB
-
MD5
d1986caa455ffa11b46341e837777e52
-
SHA1
c045c2be676ebba04d7403f3636c7adb685a4011
-
SHA256
e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407
-
SHA512
ea87e4f31a45a4e54c56dc120ce26c369a02af952d0c20411677c4cba4eb442a43b776d094150458a0b72dc65b53ca29fc300739cc56f81c6f7fee5e15043359
-
SSDEEP
3072:gDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368Pu7YlTx6gIB8FrN75DyW:K5d/zugZqll3AYrG+
Score
9/10
Malware Config
Signatures
-
Renames multiple (179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2568 FB11.tmp -
Executes dropped EXE 1 IoCs
pid Process 2568 FB11.tmp -
Loads dropped DLL 1 IoCs
pid Process 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\kF0wnCN24.bmp" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\kF0wnCN24.bmp" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\WallpaperStyle = "10" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.kF0wnCN24 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.kF0wnCN24\ = "kF0wnCN24" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kF0wnCN24\DefaultIcon e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kF0wnCN24 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\kF0wnCN24\DefaultIcon\ = "C:\\ProgramData\\kF0wnCN24.ico" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1984 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp 2568 FB11.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeDebugPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: 36 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeImpersonatePrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeIncBasePriorityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeIncreaseQuotaPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: 33 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeManageVolumePrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeProfSingleProcessPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeRestorePrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSystemProfilePrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeTakeOwnershipPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeShutdownPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeDebugPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 852 vssvc.exe Token: SeRestorePrivilege 852 vssvc.exe Token: SeAuditPrivilege 852 vssvc.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1880 wrote to memory of 2568 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 35 PID 1880 wrote to memory of 2568 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 35 PID 1880 wrote to memory of 2568 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 35 PID 1880 wrote to memory of 2568 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 35 PID 1880 wrote to memory of 2568 1880 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 35 PID 2568 wrote to memory of 2528 2568 FB11.tmp 36 PID 2568 wrote to memory of 2528 2568 FB11.tmp 36 PID 2568 wrote to memory of 2528 2568 FB11.tmp 36 PID 2568 wrote to memory of 2528 2568 FB11.tmp 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe"C:\Users\Admin\AppData\Local\Temp\e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\ProgramData\FB11.tmp"C:\ProgramData\FB11.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\FB11.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2528
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:852
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\kF0wnCN24.README.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5cec2fed8b940d9cf89a1009640bdfbaf
SHA1c1af8c04785c7ad91f6b0eb6c9f7537f128f5a3f
SHA25602d6e3fd58d34783b4d6af00885eae7cd60cbdc56e15d56d47c428a4045f4706
SHA512f6ef5674b3262fa76adbdd3645539d2c01bab4c5ef37f295683cdd62e75a7f0f1bc396cb95c929398ab9de067d5222d18a19cb660503e75b79fa1e5143303ab7
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize160KB
MD5b97866e5f79c0c4ab3c0c4dcdd348b5a
SHA118804964c191317add0dc6e7f065275f58e11dc1
SHA2566e4e49283517785f664d41974614d64865d4ea641f159c8ac397b7d3208f9050
SHA512874e8c04fae6d465bfb471dc6d88068b756af72e8b2460b6ea2d7b9144c7ab40e534933bc8202cc4d6a4da8fe3377957b96fe0ae44fffc5d228c886b913d3519
-
Filesize
6KB
MD531e6661ebf7b857f58e4884668005cc6
SHA1a07de340a94303382d6c7f1197382d2697bb874f
SHA2560d90eba3b0def4255fa3b3f167e26c04a8848dcbcfbee55dda87ab0639a231ef
SHA512b31f7171bee8f044cd36ac06ee57a64f426a77387463bbcb35abea424400750f7ce6b10a46c4db4521b51227979ab48626a52a09fc38d5affdfa447ab9d1b1cc
-
Filesize
129B
MD5c41884be23a2820fc8412abdc2cd28a7
SHA16b16e1a63d3582b09fe03cce6bd44c1313992054
SHA2568caed7676dd052c6574ef0bd929c2df4f2caf1af4cd36873be2edb77a47bc94f
SHA5126feb31aefa49833e1043506fe5ee3ed97abc8e3d1448b47e1e0bb64bc760c9c8c35895a3f90d7548dcaff19a2d0eb9acd92b46fd2899fb963ba6c6fbae0cfe0c
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf