Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
99s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17/02/2023, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87.exe
Resource
win10v2004-20220812-en
General
-
Target
3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87.exe
-
Size
743KB
-
MD5
9a1f0fb28063c41a4fec09975b7c7823
-
SHA1
f38f7ce34df3d2268e9123c3e728d9b42202d518
-
SHA256
3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87
-
SHA512
71f072c2ce9dab235f2cff56ca6914d385e06db722571ea2413d7cec9dc2965ab6b8f594eafcca6da008d3ed408d1ecbecb9c538964cd4f92b7466e31a8a9d44
-
SSDEEP
12288:KMrJy90Zs3wqGTHnm3jCUTtV55CgdrRaV94hvbsEKqeMHnxPZi4VzDIwrSKmX7r8:fyOhqGTHnsCUT55CgaV94hvbSIHxJV4W
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Extracted
amadey
3.66
193.233.20.4/t6r48nSa/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" fCZ04oE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" fCZ04oE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" fCZ04oE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection fCZ04oE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" fCZ04oE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" fCZ04oE.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation nFQ00dd.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 8 IoCs
pid Process 3880 sIb17nY.exe 4924 sTH80hz.exe 4844 fCZ04oE.exe 1864 haW51ic.exe 3520 kmt48Ho.exe 2356 nFQ00dd.exe 988 mnolyk.exe 3868 mnolyk.exe -
Loads dropped DLL 1 IoCs
pid Process 4312 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" fCZ04oE.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" sIb17nY.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sTH80hz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" sTH80hz.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sIb17nY.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4936 3520 WerFault.exe 84 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2232 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4844 fCZ04oE.exe 4844 fCZ04oE.exe 1864 haW51ic.exe 1864 haW51ic.exe 3520 kmt48Ho.exe 3520 kmt48Ho.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4844 fCZ04oE.exe Token: SeDebugPrivilege 1864 haW51ic.exe Token: SeDebugPrivilege 3520 kmt48Ho.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3484 wrote to memory of 3880 3484 3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87.exe 79 PID 3484 wrote to memory of 3880 3484 3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87.exe 79 PID 3484 wrote to memory of 3880 3484 3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87.exe 79 PID 3880 wrote to memory of 4924 3880 sIb17nY.exe 80 PID 3880 wrote to memory of 4924 3880 sIb17nY.exe 80 PID 3880 wrote to memory of 4924 3880 sIb17nY.exe 80 PID 4924 wrote to memory of 4844 4924 sTH80hz.exe 81 PID 4924 wrote to memory of 4844 4924 sTH80hz.exe 81 PID 4924 wrote to memory of 1864 4924 sTH80hz.exe 82 PID 4924 wrote to memory of 1864 4924 sTH80hz.exe 82 PID 4924 wrote to memory of 1864 4924 sTH80hz.exe 82 PID 3880 wrote to memory of 3520 3880 sIb17nY.exe 84 PID 3880 wrote to memory of 3520 3880 sIb17nY.exe 84 PID 3880 wrote to memory of 3520 3880 sIb17nY.exe 84 PID 3484 wrote to memory of 2356 3484 3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87.exe 88 PID 3484 wrote to memory of 2356 3484 3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87.exe 88 PID 3484 wrote to memory of 2356 3484 3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87.exe 88 PID 2356 wrote to memory of 988 2356 nFQ00dd.exe 89 PID 2356 wrote to memory of 988 2356 nFQ00dd.exe 89 PID 2356 wrote to memory of 988 2356 nFQ00dd.exe 89 PID 988 wrote to memory of 2232 988 mnolyk.exe 90 PID 988 wrote to memory of 2232 988 mnolyk.exe 90 PID 988 wrote to memory of 2232 988 mnolyk.exe 90 PID 988 wrote to memory of 4536 988 mnolyk.exe 92 PID 988 wrote to memory of 4536 988 mnolyk.exe 92 PID 988 wrote to memory of 4536 988 mnolyk.exe 92 PID 4536 wrote to memory of 1416 4536 cmd.exe 94 PID 4536 wrote to memory of 1416 4536 cmd.exe 94 PID 4536 wrote to memory of 1416 4536 cmd.exe 94 PID 4536 wrote to memory of 636 4536 cmd.exe 95 PID 4536 wrote to memory of 636 4536 cmd.exe 95 PID 4536 wrote to memory of 636 4536 cmd.exe 95 PID 4536 wrote to memory of 4724 4536 cmd.exe 96 PID 4536 wrote to memory of 4724 4536 cmd.exe 96 PID 4536 wrote to memory of 4724 4536 cmd.exe 96 PID 4536 wrote to memory of 2116 4536 cmd.exe 97 PID 4536 wrote to memory of 2116 4536 cmd.exe 97 PID 4536 wrote to memory of 2116 4536 cmd.exe 97 PID 4536 wrote to memory of 1660 4536 cmd.exe 98 PID 4536 wrote to memory of 1660 4536 cmd.exe 98 PID 4536 wrote to memory of 1660 4536 cmd.exe 98 PID 4536 wrote to memory of 3232 4536 cmd.exe 99 PID 4536 wrote to memory of 3232 4536 cmd.exe 99 PID 4536 wrote to memory of 3232 4536 cmd.exe 99 PID 988 wrote to memory of 4312 988 mnolyk.exe 100 PID 988 wrote to memory of 4312 988 mnolyk.exe 100 PID 988 wrote to memory of 4312 988 mnolyk.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87.exe"C:\Users\Admin\AppData\Local\Temp\3e6cf87d84ef739cb4f2b0363e16b0b00df43af09d181131d52ee04b8fe6fb87.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sIb17nY.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sIb17nY.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sTH80hz.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sTH80hz.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fCZ04oE.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fCZ04oE.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\haW51ic.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\haW51ic.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kmt48Ho.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kmt48Ho.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3520 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 13324⤵
- Program crash
PID:4936
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nFQ00dd.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nFQ00dd.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
PID:2232
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1416
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵PID:636
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵PID:4724
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2116
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:N"5⤵PID:1660
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:R" /E5⤵PID:3232
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4312
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3520 -ip 35201⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:3868
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
556KB
MD5a342af8b6cceaef6c66a4877523bf566
SHA1f09b6b682093319c18b62f145802f67be0dba63d
SHA256e28a761535c8b3355e7600e97801dfe15dfc2111958438208d674f4ad7d2c01e
SHA512cc6a011a30765471ff7b53038593d38568910436218d31313f230c12251ebf90db1e23c865b1a401a76f575e340d4fcf6dee9aa3a979198dc2038527012d089f
-
Filesize
556KB
MD5a342af8b6cceaef6c66a4877523bf566
SHA1f09b6b682093319c18b62f145802f67be0dba63d
SHA256e28a761535c8b3355e7600e97801dfe15dfc2111958438208d674f4ad7d2c01e
SHA512cc6a011a30765471ff7b53038593d38568910436218d31313f230c12251ebf90db1e23c865b1a401a76f575e340d4fcf6dee9aa3a979198dc2038527012d089f
-
Filesize
352KB
MD563b0cb9489c4c25ac9807cc76289624a
SHA17d7f83d83cc126dfbc8e2beac9a305100088d39f
SHA256add02f47b506d7832798a176511b05e9dd5e2d04f6105436b7d7a49907ad811c
SHA51268a5d29184031690fb310b1b263d81f5b1039aa03d8d3d9b14e1d7fa93210bd472fccaf101575a2076ce20b5f13785009885208283c57276e99e428c9dea6261
-
Filesize
352KB
MD563b0cb9489c4c25ac9807cc76289624a
SHA17d7f83d83cc126dfbc8e2beac9a305100088d39f
SHA256add02f47b506d7832798a176511b05e9dd5e2d04f6105436b7d7a49907ad811c
SHA51268a5d29184031690fb310b1b263d81f5b1039aa03d8d3d9b14e1d7fa93210bd472fccaf101575a2076ce20b5f13785009885208283c57276e99e428c9dea6261
-
Filesize
202KB
MD5372e9ec81b1e4c9f2b6b2a4d1ccbd8b2
SHA13ce714d82e1cd56e62a048f28a48cf3bfb354d42
SHA2566c91f61f8c4cae96825bd0deae6ebc04a628d0dbdd4e7b027b3f4e46b0d8fb38
SHA5129305a6101e441fc238b265a4c7fe9f06d773c1fb7ae7cdb51c3870ecd55da26ac7738425efefa3a266c7d2043eab0707339314121f4a969de76d582c498f6684
-
Filesize
202KB
MD5372e9ec81b1e4c9f2b6b2a4d1ccbd8b2
SHA13ce714d82e1cd56e62a048f28a48cf3bfb354d42
SHA2566c91f61f8c4cae96825bd0deae6ebc04a628d0dbdd4e7b027b3f4e46b0d8fb38
SHA5129305a6101e441fc238b265a4c7fe9f06d773c1fb7ae7cdb51c3870ecd55da26ac7738425efefa3a266c7d2043eab0707339314121f4a969de76d582c498f6684
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
89KB
MD54cf63b9a3e4bc0910af4d8baa5939238
SHA1361eea9bb65071ebf09d9598fe7a482e487b919f
SHA256dd82c0954f9047eb2a601aefa58eec94c79f71cab58f980a663ae3b8a54a63f9
SHA512177f101609bbdb7a3e423ecb2914b21d3fb91bf1e6267c4a30313b8ae0b5bc49659fc6ce1f1715649b8ee774022a9b045d886f2ba658ef065eefceedeaf7ee38
-
Filesize
89KB
MD54cf63b9a3e4bc0910af4d8baa5939238
SHA1361eea9bb65071ebf09d9598fe7a482e487b919f
SHA256dd82c0954f9047eb2a601aefa58eec94c79f71cab58f980a663ae3b8a54a63f9
SHA512177f101609bbdb7a3e423ecb2914b21d3fb91bf1e6267c4a30313b8ae0b5bc49659fc6ce1f1715649b8ee774022a9b045d886f2ba658ef065eefceedeaf7ee38