Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 06:10
Static task
static1
Behavioral task
behavioral1
Sample
a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe
Resource
win10v2004-20221111-en
General
-
Target
a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe
-
Size
676KB
-
MD5
e742b815b15c725791f5a13ab38482e2
-
SHA1
c88db982a544c0305deccc90c7a9dd620ffd71ca
-
SHA256
a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988
-
SHA512
19d90267f5eff7828347c460c745887347ac45bb40861434bc542ed6c01e3a6fe47b83d0927f99720166d3b47245d65c9014b33a43675a56820d9be50e7d7b85
-
SSDEEP
12288:8dgmy6lZ8E9soPvowBbfunHwhTRbQpdWnFiHfgiujN0n2r3s6eiCv6fC:8dgX6tTLFfYGhadkiHt2rveiCC
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\nethfdrv.sys a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe -
Executes dropped EXE 5 IoCs
pid Process 1192 installd.exe 544 nethtsrv.exe 1028 netupdsrv.exe 2008 nethtsrv.exe 1432 netupdsrv.exe -
Loads dropped DLL 13 IoCs
pid Process 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 1192 installd.exe 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 544 nethtsrv.exe 544 nethtsrv.exe 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 2008 nethtsrv.exe 2008 nethtsrv.exe 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\hfpapi.dll a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe File created C:\Windows\SysWOW64\installd.exe a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe File created C:\Windows\SysWOW64\nethtsrv.exe a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe File created C:\Windows\SysWOW64\netupdsrv.exe a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe File created C:\Windows\SysWOW64\hfnapi.dll a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Config\data.xml a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2008 nethtsrv.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1368 wrote to memory of 976 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 27 PID 1368 wrote to memory of 976 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 27 PID 1368 wrote to memory of 976 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 27 PID 1368 wrote to memory of 976 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 27 PID 976 wrote to memory of 1644 976 net.exe 29 PID 976 wrote to memory of 1644 976 net.exe 29 PID 976 wrote to memory of 1644 976 net.exe 29 PID 976 wrote to memory of 1644 976 net.exe 29 PID 1368 wrote to memory of 1248 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 30 PID 1368 wrote to memory of 1248 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 30 PID 1368 wrote to memory of 1248 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 30 PID 1368 wrote to memory of 1248 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 30 PID 1248 wrote to memory of 1872 1248 net.exe 32 PID 1248 wrote to memory of 1872 1248 net.exe 32 PID 1248 wrote to memory of 1872 1248 net.exe 32 PID 1248 wrote to memory of 1872 1248 net.exe 32 PID 1368 wrote to memory of 1192 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 33 PID 1368 wrote to memory of 1192 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 33 PID 1368 wrote to memory of 1192 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 33 PID 1368 wrote to memory of 1192 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 33 PID 1368 wrote to memory of 1192 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 33 PID 1368 wrote to memory of 1192 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 33 PID 1368 wrote to memory of 1192 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 33 PID 1368 wrote to memory of 544 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 35 PID 1368 wrote to memory of 544 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 35 PID 1368 wrote to memory of 544 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 35 PID 1368 wrote to memory of 544 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 35 PID 1368 wrote to memory of 1028 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 37 PID 1368 wrote to memory of 1028 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 37 PID 1368 wrote to memory of 1028 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 37 PID 1368 wrote to memory of 1028 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 37 PID 1368 wrote to memory of 1028 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 37 PID 1368 wrote to memory of 1028 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 37 PID 1368 wrote to memory of 1028 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 37 PID 1368 wrote to memory of 2028 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 39 PID 1368 wrote to memory of 2028 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 39 PID 1368 wrote to memory of 2028 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 39 PID 1368 wrote to memory of 2028 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 39 PID 2028 wrote to memory of 1928 2028 net.exe 41 PID 2028 wrote to memory of 1928 2028 net.exe 41 PID 2028 wrote to memory of 1928 2028 net.exe 41 PID 2028 wrote to memory of 1928 2028 net.exe 41 PID 1368 wrote to memory of 1256 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 43 PID 1368 wrote to memory of 1256 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 43 PID 1368 wrote to memory of 1256 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 43 PID 1368 wrote to memory of 1256 1368 a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe 43 PID 1256 wrote to memory of 1392 1256 net.exe 45 PID 1256 wrote to memory of 1392 1256 net.exe 45 PID 1256 wrote to memory of 1392 1256 net.exe 45 PID 1256 wrote to memory of 1392 1256 net.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe"C:\Users\Admin\AppData\Local\Temp\a5efdb70cf256a0e31bf5295fec0b7f6a6efd690c58196e7db9275529d4e5988.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1644
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:1872
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1028
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:1928
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:1392
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:1432
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5545ac9a76fdfbed2f2064cf7c4a06c71
SHA1e4c0d9acbba54429f610257a13ce857ad1ce4443
SHA256321014cf8bf90beb39937e6e7a16e668b61fad85c1d4d3c7da853fbc42355a02
SHA512e4eaf5669f39de9fb2a93fd4e2dbe01818e5ee75c44b1d871ba99705387e0c68b818406684f0d3f8a5ba3d018b41e1d37d118f4b4bc561115a4d00ef5746df70
-
Filesize
244KB
MD54a8585a630b7ecdb3e81762849a52725
SHA18cbca6be11c3cd77b77d9ff86d7168a37bea25a5
SHA256d9c145941c38aad556de62fa9828e554eb1454b8ca4a25b638b7bcd6a96c1b4e
SHA512cc84d992ebbb5e168320eb6a7f1c42457791aeea53e27587be1879acca638fe52d5c824e7bc4c5ecd55376204c5e7dcc98e43dc6bc174db0abfc896875ba615c
-
Filesize
108KB
MD5e8efef4ff3e67cb189554fd575dc8033
SHA12262bda8636ce5d40e371c1a8063c51cc11546bd
SHA256b2f190b46e76cd7caae8b9fd053c58e6ade70919f8ce75cc80bc51dec0586778
SHA512e09dade757f02e9ab46dea158a9e55f7b7f76325b4fc636f5fe3643af8b6e0a66db1a0f2325ba3954ecde1c02effb7ca22bb29bbd1bd4d094ca02126ff828d66
-
Filesize
176KB
MD523a9417e9a67c04693cf3e7c54e494a7
SHA13dd3c94ef0cbe8ba0d72d649eeb640383af9f6d1
SHA25602feaf1c940aac99a9d38fc51fdc771b76a9dd0c74aec17abb86923f917491ad
SHA51292f974022b386cd9faa70a6578b7e45229424c267f61e3c309ff4470e728fab7b4bdfc09f6a5d4db24c79577c392025b4b3badd1aea2c2e324850aa2ccc620b2
-
Filesize
176KB
MD523a9417e9a67c04693cf3e7c54e494a7
SHA13dd3c94ef0cbe8ba0d72d649eeb640383af9f6d1
SHA25602feaf1c940aac99a9d38fc51fdc771b76a9dd0c74aec17abb86923f917491ad
SHA51292f974022b386cd9faa70a6578b7e45229424c267f61e3c309ff4470e728fab7b4bdfc09f6a5d4db24c79577c392025b4b3badd1aea2c2e324850aa2ccc620b2
-
Filesize
158KB
MD59b71f1f0cc72561670c29e579915e27d
SHA1f3bb90b4fda83eb6df748ec3c5ca069e95ca4f3e
SHA2569f6ae9622c02874889b10f0fe6d90db932b577d700c6f3fe870ad8115c7b5ac6
SHA5121f9ff0bf1bd0c64016bd7ae34eeb5eb3ffa5c2e37d8024db5b2f68d6572e49c31291bebbd1985198f93eb989e4c12cfa5fa5672613cf2aa476438d61fd4b4e26
-
Filesize
158KB
MD59b71f1f0cc72561670c29e579915e27d
SHA1f3bb90b4fda83eb6df748ec3c5ca069e95ca4f3e
SHA2569f6ae9622c02874889b10f0fe6d90db932b577d700c6f3fe870ad8115c7b5ac6
SHA5121f9ff0bf1bd0c64016bd7ae34eeb5eb3ffa5c2e37d8024db5b2f68d6572e49c31291bebbd1985198f93eb989e4c12cfa5fa5672613cf2aa476438d61fd4b4e26
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5545ac9a76fdfbed2f2064cf7c4a06c71
SHA1e4c0d9acbba54429f610257a13ce857ad1ce4443
SHA256321014cf8bf90beb39937e6e7a16e668b61fad85c1d4d3c7da853fbc42355a02
SHA512e4eaf5669f39de9fb2a93fd4e2dbe01818e5ee75c44b1d871ba99705387e0c68b818406684f0d3f8a5ba3d018b41e1d37d118f4b4bc561115a4d00ef5746df70
-
Filesize
106KB
MD5545ac9a76fdfbed2f2064cf7c4a06c71
SHA1e4c0d9acbba54429f610257a13ce857ad1ce4443
SHA256321014cf8bf90beb39937e6e7a16e668b61fad85c1d4d3c7da853fbc42355a02
SHA512e4eaf5669f39de9fb2a93fd4e2dbe01818e5ee75c44b1d871ba99705387e0c68b818406684f0d3f8a5ba3d018b41e1d37d118f4b4bc561115a4d00ef5746df70
-
Filesize
106KB
MD5545ac9a76fdfbed2f2064cf7c4a06c71
SHA1e4c0d9acbba54429f610257a13ce857ad1ce4443
SHA256321014cf8bf90beb39937e6e7a16e668b61fad85c1d4d3c7da853fbc42355a02
SHA512e4eaf5669f39de9fb2a93fd4e2dbe01818e5ee75c44b1d871ba99705387e0c68b818406684f0d3f8a5ba3d018b41e1d37d118f4b4bc561115a4d00ef5746df70
-
Filesize
244KB
MD54a8585a630b7ecdb3e81762849a52725
SHA18cbca6be11c3cd77b77d9ff86d7168a37bea25a5
SHA256d9c145941c38aad556de62fa9828e554eb1454b8ca4a25b638b7bcd6a96c1b4e
SHA512cc84d992ebbb5e168320eb6a7f1c42457791aeea53e27587be1879acca638fe52d5c824e7bc4c5ecd55376204c5e7dcc98e43dc6bc174db0abfc896875ba615c
-
Filesize
244KB
MD54a8585a630b7ecdb3e81762849a52725
SHA18cbca6be11c3cd77b77d9ff86d7168a37bea25a5
SHA256d9c145941c38aad556de62fa9828e554eb1454b8ca4a25b638b7bcd6a96c1b4e
SHA512cc84d992ebbb5e168320eb6a7f1c42457791aeea53e27587be1879acca638fe52d5c824e7bc4c5ecd55376204c5e7dcc98e43dc6bc174db0abfc896875ba615c
-
Filesize
108KB
MD5e8efef4ff3e67cb189554fd575dc8033
SHA12262bda8636ce5d40e371c1a8063c51cc11546bd
SHA256b2f190b46e76cd7caae8b9fd053c58e6ade70919f8ce75cc80bc51dec0586778
SHA512e09dade757f02e9ab46dea158a9e55f7b7f76325b4fc636f5fe3643af8b6e0a66db1a0f2325ba3954ecde1c02effb7ca22bb29bbd1bd4d094ca02126ff828d66
-
Filesize
176KB
MD523a9417e9a67c04693cf3e7c54e494a7
SHA13dd3c94ef0cbe8ba0d72d649eeb640383af9f6d1
SHA25602feaf1c940aac99a9d38fc51fdc771b76a9dd0c74aec17abb86923f917491ad
SHA51292f974022b386cd9faa70a6578b7e45229424c267f61e3c309ff4470e728fab7b4bdfc09f6a5d4db24c79577c392025b4b3badd1aea2c2e324850aa2ccc620b2
-
Filesize
158KB
MD59b71f1f0cc72561670c29e579915e27d
SHA1f3bb90b4fda83eb6df748ec3c5ca069e95ca4f3e
SHA2569f6ae9622c02874889b10f0fe6d90db932b577d700c6f3fe870ad8115c7b5ac6
SHA5121f9ff0bf1bd0c64016bd7ae34eeb5eb3ffa5c2e37d8024db5b2f68d6572e49c31291bebbd1985198f93eb989e4c12cfa5fa5672613cf2aa476438d61fd4b4e26