Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 20:58
Static task
static1
Behavioral task
behavioral1
Sample
83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe
Resource
win10v2004-20220812-en
General
-
Target
83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe
-
Size
656KB
-
MD5
00b7c65ca3b12ad7a444a5b44da56220
-
SHA1
00a4f28d98dc8b39cfb1ee8d6d2215b85517c7cb
-
SHA256
83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55
-
SHA512
889c369ab3c8265c44762c37bd84ccc431d559e5c914dc99822cb060f3412190204f29832481abf1cc5b4ce257636dd50d7e786b7075e6c47cf403e2118c4edb
-
SSDEEP
12288:0+a5ShViVnhiAEZFkQWLTMrq2yh+SQPHNYnUDBcvODK6ZTbkYFHWJa:0BQhViVn4AEZa1Gq2HPNMUSODNZTL2c
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1716 Logo1_.exe 1540 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe -
Deletes itself 1 IoCs
pid Process 1976 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1976 cmd.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\F: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe Logo1_.exe File created C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe File created C:\Windows\Logo1_.exe 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe 1716 Logo1_.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1412 wrote to memory of 2004 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 27 PID 1412 wrote to memory of 2004 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 27 PID 1412 wrote to memory of 2004 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 27 PID 1412 wrote to memory of 2004 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 27 PID 1412 wrote to memory of 1976 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 29 PID 1412 wrote to memory of 1976 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 29 PID 1412 wrote to memory of 1976 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 29 PID 1412 wrote to memory of 1976 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 29 PID 1412 wrote to memory of 1716 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 31 PID 1412 wrote to memory of 1716 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 31 PID 1412 wrote to memory of 1716 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 31 PID 1412 wrote to memory of 1716 1412 83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe 31 PID 1716 wrote to memory of 1948 1716 Logo1_.exe 32 PID 1716 wrote to memory of 1948 1716 Logo1_.exe 32 PID 1716 wrote to memory of 1948 1716 Logo1_.exe 32 PID 1716 wrote to memory of 1948 1716 Logo1_.exe 32 PID 1948 wrote to memory of 1440 1948 net.exe 34 PID 1948 wrote to memory of 1440 1948 net.exe 34 PID 1948 wrote to memory of 1440 1948 net.exe 34 PID 1948 wrote to memory of 1440 1948 net.exe 34 PID 2004 wrote to memory of 924 2004 net.exe 35 PID 2004 wrote to memory of 924 2004 net.exe 35 PID 2004 wrote to memory of 924 2004 net.exe 35 PID 2004 wrote to memory of 924 2004 net.exe 35 PID 1976 wrote to memory of 1540 1976 cmd.exe 36 PID 1976 wrote to memory of 1540 1976 cmd.exe 36 PID 1976 wrote to memory of 1540 1976 cmd.exe 36 PID 1976 wrote to memory of 1540 1976 cmd.exe 36 PID 1716 wrote to memory of 564 1716 Logo1_.exe 37 PID 1716 wrote to memory of 564 1716 Logo1_.exe 37 PID 1716 wrote to memory of 564 1716 Logo1_.exe 37 PID 1716 wrote to memory of 564 1716 Logo1_.exe 37 PID 564 wrote to memory of 1324 564 net.exe 39 PID 564 wrote to memory of 1324 564 net.exe 39 PID 564 wrote to memory of 1324 564 net.exe 39 PID 564 wrote to memory of 1324 564 net.exe 39 PID 1716 wrote to memory of 1200 1716 Logo1_.exe 14 PID 1716 wrote to memory of 1200 1716 Logo1_.exe 14
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe"C:\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:924
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aAFE0.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe"C:\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe"4⤵
- Executes dropped EXE
PID:1540
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1440
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1324
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD5bd33cb8a3d5d9db14537aba150f9fea8
SHA169e098a1955ef2a665dfd5e2be22ff2472e31ba9
SHA25653c124d425c688a57d123ff07b07dd09ca0a921c660f6ff448f138f165f9573e
SHA512fc122ede0a65b678268416aa6cfe5f2caee87438cb5874870c83381cd65acc8f4c3069ba8bb0b03302b142c3adf165b84d5a9d6dc537b9dfbb18958b777215b5
-
C:\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe
Filesize623KB
MD5e5ca2ebcf1d6ecb6dacef20fcde132e9
SHA1bc3ad7d5b426535604b3573c960efb12cbb5d8f4
SHA2566f952b39c013fced1686cf6fbcd2a7bc75d947629e3b9e5dbc7aceb7786d145f
SHA512747f6b70524c10149111d0b1a0c5fc8224c324ea8e6914c511b002b6542d19cba460f9fdf77d97a2d6148f725d4e27d413f8406408ffb659b4644cace14ae1c7
-
C:\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe.exe
Filesize623KB
MD5e5ca2ebcf1d6ecb6dacef20fcde132e9
SHA1bc3ad7d5b426535604b3573c960efb12cbb5d8f4
SHA2566f952b39c013fced1686cf6fbcd2a7bc75d947629e3b9e5dbc7aceb7786d145f
SHA512747f6b70524c10149111d0b1a0c5fc8224c324ea8e6914c511b002b6542d19cba460f9fdf77d97a2d6148f725d4e27d413f8406408ffb659b4644cace14ae1c7
-
Filesize
33KB
MD56a6f427787f08bc9dd4011586840fea6
SHA1bfdd466f2766de3873ea7fd8e0c11c4c15c67a2b
SHA25610681f0d26abaa23bfc8f2aff9729f656ae9fefbf74e842a89529555b1d64c6c
SHA5122bc15635aef97dba954a481b3f294e81348cd28aa238d5521d9e6bd9a66a378217460106bc0b301cb46e2a0fc0aee6e1a132cfe17eed87f2b6fe24fe699cd82b
-
Filesize
33KB
MD56a6f427787f08bc9dd4011586840fea6
SHA1bfdd466f2766de3873ea7fd8e0c11c4c15c67a2b
SHA25610681f0d26abaa23bfc8f2aff9729f656ae9fefbf74e842a89529555b1d64c6c
SHA5122bc15635aef97dba954a481b3f294e81348cd28aa238d5521d9e6bd9a66a378217460106bc0b301cb46e2a0fc0aee6e1a132cfe17eed87f2b6fe24fe699cd82b
-
Filesize
33KB
MD56a6f427787f08bc9dd4011586840fea6
SHA1bfdd466f2766de3873ea7fd8e0c11c4c15c67a2b
SHA25610681f0d26abaa23bfc8f2aff9729f656ae9fefbf74e842a89529555b1d64c6c
SHA5122bc15635aef97dba954a481b3f294e81348cd28aa238d5521d9e6bd9a66a378217460106bc0b301cb46e2a0fc0aee6e1a132cfe17eed87f2b6fe24fe699cd82b
-
\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe
Filesize623KB
MD5e5ca2ebcf1d6ecb6dacef20fcde132e9
SHA1bc3ad7d5b426535604b3573c960efb12cbb5d8f4
SHA2566f952b39c013fced1686cf6fbcd2a7bc75d947629e3b9e5dbc7aceb7786d145f
SHA512747f6b70524c10149111d0b1a0c5fc8224c324ea8e6914c511b002b6542d19cba460f9fdf77d97a2d6148f725d4e27d413f8406408ffb659b4644cace14ae1c7