Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
18/08/2023, 11:51
Static task
static1
Behavioral task
behavioral1
Sample
7da2b1437f81aa4440328b044dd8fbeb6c41b016a8d454e6e7159a85e50131e2.exe
Resource
win10-20230703-en
General
-
Target
7da2b1437f81aa4440328b044dd8fbeb6c41b016a8d454e6e7159a85e50131e2.exe
-
Size
731KB
-
MD5
9247a9ff1a6ca7eac5dc5ca4c0ad9980
-
SHA1
9599a3ceb20fba6e2df21b1231c784ec16779ee8
-
SHA256
7da2b1437f81aa4440328b044dd8fbeb6c41b016a8d454e6e7159a85e50131e2
-
SHA512
5e5c2ea10629e3259b24fca7b4f05ef88b3e4fe3d5a54cd8b40815e08c28ad78ffc09c333eb56f645e835307e26f1fdc239e0cad7a3cbff49545f456a5bebc61
-
SSDEEP
12288:sMrqy90XNMkxZo2OBwV1lLYu116PBphsFGH3msNgqO91RnoQoyJINA9:Oy8NMaZLOBwYujqvXmsSxRnoDux9
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
dugin
77.91.124.73:19071
-
auth_value
7c3e46e091100fd26a6076996d374c28
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001afad-144.dat healer behavioral1/files/0x000700000001afad-145.dat healer behavioral1/memory/3004-146-0x00000000000B0000-0x00000000000BA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" l8692846.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" l8692846.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" l8692846.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" l8692846.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" l8692846.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 2212 y3217767.exe 5076 y8422160.exe 4108 y2109865.exe 3004 l8692846.exe 4572 m6275534.exe 4228 saves.exe 1668 n0018788.exe 2696 saves.exe 3256 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 4484 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" l8692846.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7da2b1437f81aa4440328b044dd8fbeb6c41b016a8d454e6e7159a85e50131e2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y3217767.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y8422160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" y2109865.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1868 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3004 l8692846.exe 3004 l8692846.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3004 l8692846.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3688 wrote to memory of 2212 3688 7da2b1437f81aa4440328b044dd8fbeb6c41b016a8d454e6e7159a85e50131e2.exe 69 PID 3688 wrote to memory of 2212 3688 7da2b1437f81aa4440328b044dd8fbeb6c41b016a8d454e6e7159a85e50131e2.exe 69 PID 3688 wrote to memory of 2212 3688 7da2b1437f81aa4440328b044dd8fbeb6c41b016a8d454e6e7159a85e50131e2.exe 69 PID 2212 wrote to memory of 5076 2212 y3217767.exe 70 PID 2212 wrote to memory of 5076 2212 y3217767.exe 70 PID 2212 wrote to memory of 5076 2212 y3217767.exe 70 PID 5076 wrote to memory of 4108 5076 y8422160.exe 71 PID 5076 wrote to memory of 4108 5076 y8422160.exe 71 PID 5076 wrote to memory of 4108 5076 y8422160.exe 71 PID 4108 wrote to memory of 3004 4108 y2109865.exe 72 PID 4108 wrote to memory of 3004 4108 y2109865.exe 72 PID 4108 wrote to memory of 4572 4108 y2109865.exe 73 PID 4108 wrote to memory of 4572 4108 y2109865.exe 73 PID 4108 wrote to memory of 4572 4108 y2109865.exe 73 PID 4572 wrote to memory of 4228 4572 m6275534.exe 74 PID 4572 wrote to memory of 4228 4572 m6275534.exe 74 PID 4572 wrote to memory of 4228 4572 m6275534.exe 74 PID 5076 wrote to memory of 1668 5076 y8422160.exe 75 PID 5076 wrote to memory of 1668 5076 y8422160.exe 75 PID 5076 wrote to memory of 1668 5076 y8422160.exe 75 PID 4228 wrote to memory of 1868 4228 saves.exe 76 PID 4228 wrote to memory of 1868 4228 saves.exe 76 PID 4228 wrote to memory of 1868 4228 saves.exe 76 PID 4228 wrote to memory of 1960 4228 saves.exe 77 PID 4228 wrote to memory of 1960 4228 saves.exe 77 PID 4228 wrote to memory of 1960 4228 saves.exe 77 PID 1960 wrote to memory of 3264 1960 cmd.exe 80 PID 1960 wrote to memory of 3264 1960 cmd.exe 80 PID 1960 wrote to memory of 3264 1960 cmd.exe 80 PID 1960 wrote to memory of 1108 1960 cmd.exe 81 PID 1960 wrote to memory of 1108 1960 cmd.exe 81 PID 1960 wrote to memory of 1108 1960 cmd.exe 81 PID 1960 wrote to memory of 4816 1960 cmd.exe 82 PID 1960 wrote to memory of 4816 1960 cmd.exe 82 PID 1960 wrote to memory of 4816 1960 cmd.exe 82 PID 1960 wrote to memory of 3728 1960 cmd.exe 83 PID 1960 wrote to memory of 3728 1960 cmd.exe 83 PID 1960 wrote to memory of 3728 1960 cmd.exe 83 PID 1960 wrote to memory of 4580 1960 cmd.exe 84 PID 1960 wrote to memory of 4580 1960 cmd.exe 84 PID 1960 wrote to memory of 4580 1960 cmd.exe 84 PID 1960 wrote to memory of 4376 1960 cmd.exe 85 PID 1960 wrote to memory of 4376 1960 cmd.exe 85 PID 1960 wrote to memory of 4376 1960 cmd.exe 85 PID 4228 wrote to memory of 4484 4228 saves.exe 87 PID 4228 wrote to memory of 4484 4228 saves.exe 87 PID 4228 wrote to memory of 4484 4228 saves.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\7da2b1437f81aa4440328b044dd8fbeb6c41b016a8d454e6e7159a85e50131e2.exe"C:\Users\Admin\AppData\Local\Temp\7da2b1437f81aa4440328b044dd8fbeb6c41b016a8d454e6e7159a85e50131e2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3217767.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3217767.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8422160.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8422160.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y2109865.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y2109865.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l8692846.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l8692846.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m6275534.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m6275534.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:1868
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:3264
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:1108
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:4816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:3728
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:4580
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:4376
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:4484
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n0018788.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n0018788.exe4⤵
- Executes dropped EXE
PID:1668
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:2696
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:3256
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
599KB
MD5b3b753d5dae8b9660e1ab774eba73e4b
SHA130a96dbfba7476591fb837bdece7b78e8970a7e4
SHA25663512b9db05d33bda6befdca9f1cb0e424c91abe7afbf5ea5e1cebbd36e5555b
SHA51260b157b4ef0c0aac53616bbfcbe7e025211d8b172c11657ffa497ed757f43506968556b993615ac09dd08e44cffd558a2019bc94580d49991fa8f76e1b39f775
-
Filesize
599KB
MD5b3b753d5dae8b9660e1ab774eba73e4b
SHA130a96dbfba7476591fb837bdece7b78e8970a7e4
SHA25663512b9db05d33bda6befdca9f1cb0e424c91abe7afbf5ea5e1cebbd36e5555b
SHA51260b157b4ef0c0aac53616bbfcbe7e025211d8b172c11657ffa497ed757f43506968556b993615ac09dd08e44cffd558a2019bc94580d49991fa8f76e1b39f775
-
Filesize
433KB
MD58269de28c67260dc22c2bc9dc3a89eb7
SHA1859b042d684ca2efc51869feacbe5b05825b7446
SHA256aeab4e375f3f74f70b5197609448218909d18f136ab352da1aebdc90eb4c99ec
SHA5122be3ce9be53bacae34d59959906006c611e1612a0ff1adf83fe58a829494f71d89b4b0084b020c8d5fc2702b928d742482ffbef4c7b63ba2381c30726482ff65
-
Filesize
433KB
MD58269de28c67260dc22c2bc9dc3a89eb7
SHA1859b042d684ca2efc51869feacbe5b05825b7446
SHA256aeab4e375f3f74f70b5197609448218909d18f136ab352da1aebdc90eb4c99ec
SHA5122be3ce9be53bacae34d59959906006c611e1612a0ff1adf83fe58a829494f71d89b4b0084b020c8d5fc2702b928d742482ffbef4c7b63ba2381c30726482ff65
-
Filesize
173KB
MD5242eea90c03fd4a61dec18946744eb63
SHA19e87752cf7b7580351870444c26e957fbdbe38ae
SHA2565bedd2abe9020366b3422cd8e4cb0242ba14a1107a5615360b31aa628a244397
SHA512513971ac22c3a23552b3845d84e491cfe8f963d851f70b0dd1e32298289592eb2feb2683d4e322b6a421f47ba849d80b70291b6f12fecf8f4688f9d304c0adca
-
Filesize
173KB
MD5242eea90c03fd4a61dec18946744eb63
SHA19e87752cf7b7580351870444c26e957fbdbe38ae
SHA2565bedd2abe9020366b3422cd8e4cb0242ba14a1107a5615360b31aa628a244397
SHA512513971ac22c3a23552b3845d84e491cfe8f963d851f70b0dd1e32298289592eb2feb2683d4e322b6a421f47ba849d80b70291b6f12fecf8f4688f9d304c0adca
-
Filesize
277KB
MD52eb206a15aacd646057348dcf10fa294
SHA123e6b73af872fe7d3f1325c0f3dd83b4330839b6
SHA256089f25496b7840aab175a6ad56583b9a85326bcb26cad41b23ffc4c4fcafd9a2
SHA5122aaccfd6e34340722fce6f11c3e11918790d98de80a885a9a8be8945d63ac49033f590e600632a731ce65d2b9bd3d3fba86ef7951fd0347cd5780e1378d0f4eb
-
Filesize
277KB
MD52eb206a15aacd646057348dcf10fa294
SHA123e6b73af872fe7d3f1325c0f3dd83b4330839b6
SHA256089f25496b7840aab175a6ad56583b9a85326bcb26cad41b23ffc4c4fcafd9a2
SHA5122aaccfd6e34340722fce6f11c3e11918790d98de80a885a9a8be8945d63ac49033f590e600632a731ce65d2b9bd3d3fba86ef7951fd0347cd5780e1378d0f4eb
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b