Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
99s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
16/02/2023, 19:10
Static task
static1
Behavioral task
behavioral1
Sample
7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d.exe
Resource
win10v2004-20221111-en
General
-
Target
7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d.exe
-
Size
743KB
-
MD5
d011944a3e25a040472b18bbceac06fe
-
SHA1
54ab3e69cd3a329897351e291edb07f6685de2ba
-
SHA256
7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d
-
SHA512
e5e2b4a14f7f86d656caa5284324f10b75c40b563c478548a22511ac1279c8232565af1da61211a711fa1d4b718bb48a5c9031d50d09faa2953a7fdc64fa0c9b
-
SSDEEP
12288:1Mr4y9056QVm3CuF3Yj8kWmvEWKPYjhQHlNJbmr2CjAnouAB1nM/anhE4:9y66QY3CuFa1BEWKPguHlNJba2iAnouw
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Extracted
amadey
3.66
193.233.20.4/t6r48nSa/index.php
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection ihE62tI.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" ihE62tI.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" ihE62tI.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" ihE62tI.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" ihE62tI.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" ihE62tI.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation nzb50Sd.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 8 IoCs
pid Process 4112 seQ11DC.exe 4872 sna81CY.exe 4884 ihE62tI.exe 1972 koe24zO.exe 1808 ltY01eb.exe 3396 nzb50Sd.exe 2608 mnolyk.exe 840 mnolyk.exe -
Loads dropped DLL 1 IoCs
pid Process 1540 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" ihE62tI.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" sna81CY.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce seQ11DC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" seQ11DC.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sna81CY.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4380 1808 WerFault.exe 84 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1316 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4884 ihE62tI.exe 4884 ihE62tI.exe 1972 koe24zO.exe 1972 koe24zO.exe 1808 ltY01eb.exe 1808 ltY01eb.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4884 ihE62tI.exe Token: SeDebugPrivilege 1972 koe24zO.exe Token: SeDebugPrivilege 1808 ltY01eb.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4052 wrote to memory of 4112 4052 7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d.exe 80 PID 4052 wrote to memory of 4112 4052 7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d.exe 80 PID 4052 wrote to memory of 4112 4052 7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d.exe 80 PID 4112 wrote to memory of 4872 4112 seQ11DC.exe 81 PID 4112 wrote to memory of 4872 4112 seQ11DC.exe 81 PID 4112 wrote to memory of 4872 4112 seQ11DC.exe 81 PID 4872 wrote to memory of 4884 4872 sna81CY.exe 82 PID 4872 wrote to memory of 4884 4872 sna81CY.exe 82 PID 4872 wrote to memory of 1972 4872 sna81CY.exe 83 PID 4872 wrote to memory of 1972 4872 sna81CY.exe 83 PID 4872 wrote to memory of 1972 4872 sna81CY.exe 83 PID 4112 wrote to memory of 1808 4112 seQ11DC.exe 84 PID 4112 wrote to memory of 1808 4112 seQ11DC.exe 84 PID 4112 wrote to memory of 1808 4112 seQ11DC.exe 84 PID 4052 wrote to memory of 3396 4052 7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d.exe 89 PID 4052 wrote to memory of 3396 4052 7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d.exe 89 PID 4052 wrote to memory of 3396 4052 7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d.exe 89 PID 3396 wrote to memory of 2608 3396 nzb50Sd.exe 90 PID 3396 wrote to memory of 2608 3396 nzb50Sd.exe 90 PID 3396 wrote to memory of 2608 3396 nzb50Sd.exe 90 PID 2608 wrote to memory of 1316 2608 mnolyk.exe 91 PID 2608 wrote to memory of 1316 2608 mnolyk.exe 91 PID 2608 wrote to memory of 1316 2608 mnolyk.exe 91 PID 2608 wrote to memory of 4324 2608 mnolyk.exe 93 PID 2608 wrote to memory of 4324 2608 mnolyk.exe 93 PID 2608 wrote to memory of 4324 2608 mnolyk.exe 93 PID 4324 wrote to memory of 3080 4324 cmd.exe 95 PID 4324 wrote to memory of 3080 4324 cmd.exe 95 PID 4324 wrote to memory of 3080 4324 cmd.exe 95 PID 4324 wrote to memory of 984 4324 cmd.exe 96 PID 4324 wrote to memory of 984 4324 cmd.exe 96 PID 4324 wrote to memory of 984 4324 cmd.exe 96 PID 4324 wrote to memory of 3128 4324 cmd.exe 97 PID 4324 wrote to memory of 3128 4324 cmd.exe 97 PID 4324 wrote to memory of 3128 4324 cmd.exe 97 PID 4324 wrote to memory of 3228 4324 cmd.exe 98 PID 4324 wrote to memory of 3228 4324 cmd.exe 98 PID 4324 wrote to memory of 3228 4324 cmd.exe 98 PID 4324 wrote to memory of 4360 4324 cmd.exe 99 PID 4324 wrote to memory of 4360 4324 cmd.exe 99 PID 4324 wrote to memory of 4360 4324 cmd.exe 99 PID 4324 wrote to memory of 1908 4324 cmd.exe 100 PID 4324 wrote to memory of 1908 4324 cmd.exe 100 PID 4324 wrote to memory of 1908 4324 cmd.exe 100 PID 2608 wrote to memory of 1540 2608 mnolyk.exe 101 PID 2608 wrote to memory of 1540 2608 mnolyk.exe 101 PID 2608 wrote to memory of 1540 2608 mnolyk.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d.exe"C:\Users\Admin\AppData\Local\Temp\7f4eedd233070c7c967dac8687d4d5aae774226b8ea6930a587615cd1b5ed87d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\seQ11DC.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\seQ11DC.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sna81CY.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sna81CY.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ihE62tI.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ihE62tI.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\koe24zO.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\koe24zO.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ltY01eb.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ltY01eb.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 18924⤵
- Program crash
PID:4380
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nzb50Sd.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nzb50Sd.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
PID:1316
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3080
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵PID:984
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵PID:3128
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3228
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:N"5⤵PID:4360
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:R" /E5⤵PID:1908
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1540
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1808 -ip 18081⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:840
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
556KB
MD59a45a5b3691b7401df581dc4015fb1ca
SHA1c9d8ca2f64b73d718907e4d6b4657154287005d7
SHA256e4f50d64b8417d8e81006793c408113da24ac23f9f5c349fc2e498f5323a372a
SHA512ed053254fabd92fa297fdd60db518619cc09dad9e27fac999191dac0e5e3b1cf1fd4c44145b3f5f14de58a8dc98aaf5fa43445637fc1fb99e6493c4e27e68155
-
Filesize
556KB
MD59a45a5b3691b7401df581dc4015fb1ca
SHA1c9d8ca2f64b73d718907e4d6b4657154287005d7
SHA256e4f50d64b8417d8e81006793c408113da24ac23f9f5c349fc2e498f5323a372a
SHA512ed053254fabd92fa297fdd60db518619cc09dad9e27fac999191dac0e5e3b1cf1fd4c44145b3f5f14de58a8dc98aaf5fa43445637fc1fb99e6493c4e27e68155
-
Filesize
352KB
MD51f4fa5e9d77b2414bc8e643866ef39db
SHA1d3baa3f3a3d3e1988d5c6192f3754c333c3ec091
SHA2566677b0604339c9e81fa0abf5616b712be3e7c64e590dae250368afb1ce7858bf
SHA51266c48871608885176a2c533889f931265a55202cbb0d6240b662632b308fd87c478d2deff3c743ee92ef5d36e0219bf16bb580a099d9790b3748093d6dea2d61
-
Filesize
352KB
MD51f4fa5e9d77b2414bc8e643866ef39db
SHA1d3baa3f3a3d3e1988d5c6192f3754c333c3ec091
SHA2566677b0604339c9e81fa0abf5616b712be3e7c64e590dae250368afb1ce7858bf
SHA51266c48871608885176a2c533889f931265a55202cbb0d6240b662632b308fd87c478d2deff3c743ee92ef5d36e0219bf16bb580a099d9790b3748093d6dea2d61
-
Filesize
202KB
MD525898ac0102a6d5d918d26c0b3c69184
SHA19222dee410594ae2ae9b7ce46e4419044d6febcc
SHA256eb5fba59a8486f0818a6a6fff2e8e90e023534cf170bbbc45529639dd299a528
SHA512134a7588f7e8563d25a4ced8684b5be5cb0167dade6a98dc19809d77eeae8b10e540bbb789199db3cffca07dbd8bb8fce63e1e6b8dd4444c05781d13217a6139
-
Filesize
202KB
MD525898ac0102a6d5d918d26c0b3c69184
SHA19222dee410594ae2ae9b7ce46e4419044d6febcc
SHA256eb5fba59a8486f0818a6a6fff2e8e90e023534cf170bbbc45529639dd299a528
SHA512134a7588f7e8563d25a4ced8684b5be5cb0167dade6a98dc19809d77eeae8b10e540bbb789199db3cffca07dbd8bb8fce63e1e6b8dd4444c05781d13217a6139
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
89KB
MD54cf63b9a3e4bc0910af4d8baa5939238
SHA1361eea9bb65071ebf09d9598fe7a482e487b919f
SHA256dd82c0954f9047eb2a601aefa58eec94c79f71cab58f980a663ae3b8a54a63f9
SHA512177f101609bbdb7a3e423ecb2914b21d3fb91bf1e6267c4a30313b8ae0b5bc49659fc6ce1f1715649b8ee774022a9b045d886f2ba658ef065eefceedeaf7ee38
-
Filesize
89KB
MD54cf63b9a3e4bc0910af4d8baa5939238
SHA1361eea9bb65071ebf09d9598fe7a482e487b919f
SHA256dd82c0954f9047eb2a601aefa58eec94c79f71cab58f980a663ae3b8a54a63f9
SHA512177f101609bbdb7a3e423ecb2914b21d3fb91bf1e6267c4a30313b8ae0b5bc49659fc6ce1f1715649b8ee774022a9b045d886f2ba658ef065eefceedeaf7ee38