Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
27/08/2023, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe
Resource
win10v2004-20230824-en
General
-
Target
dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe
-
Size
27KB
-
MD5
561f430a0fbc2005d448f4ff02ec9d10
-
SHA1
a84c3b09f9ee68ec521d29e86fabe62b906eae40
-
SHA256
dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099
-
SHA512
f7e93dbedad789ee10bb6526f3c13f44761bc0287274dbe375ccb04bea687ecf4f928e6990f2c380cfa30cbd27aab71737e4acdcae57d14de3cd5019659fea33
-
SSDEEP
384:MdRY1Gt5M0zhIV/DZ3KZp7JcTO4yf9KFL/KaUUqd3qR+FlYTj9QTN0wpD9p5Cs:x16GVRu1yK9fMFLKaTxsujCT7pZpY
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\P: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\O: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\K: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\X: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\V: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\Q: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\N: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\H: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\G: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\E: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\Z: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\Y: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\U: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\T: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\S: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\R: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\I: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\M: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\L: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened (read-only) \??\J: dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\Microsoft Games\Minesweeper\fr-FR\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\VideoLAN\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\Java\jre7\bin\server\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Windows Mail\ja-JP\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\Microsoft Games\More Games\en-US\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\Google\Chrome\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\Windows Defender\de-DE\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\_desktop.ini dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rundl132.exe dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2932 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 28 PID 2240 wrote to memory of 2932 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 28 PID 2240 wrote to memory of 2932 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 28 PID 2240 wrote to memory of 2932 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 28 PID 2932 wrote to memory of 2436 2932 net.exe 30 PID 2932 wrote to memory of 2436 2932 net.exe 30 PID 2932 wrote to memory of 2436 2932 net.exe 30 PID 2932 wrote to memory of 2436 2932 net.exe 30 PID 2240 wrote to memory of 1176 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 21 PID 2240 wrote to memory of 1176 2240 dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe"C:\Users\Admin\AppData\Local\Temp\dd2e2d4269e7b153bb50dcea996fe5962f0acf8c0bbdab1e58614307789cb099.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2436
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD55d86662509c82a2ed910908133d198b1
SHA181416173502df444627f29dda1033ee976dd54bd
SHA2560bb3ea7ae3d34fb791f483c3a660f831610ffb83fe5b59ac3e73c2d6c3016782
SHA5125bbc0c6893b6706f530ea0b1264f4964ecf87f0a761a635fe11cd279aee667aa8b3a042607339b4208458731dd6ea6c158dd48b3ed3e06cee58a31ee9913ab57
-
Filesize
874KB
MD5e39c7fba20af4f43291efb0f5c423241
SHA191733ceba9480c536456329a20d17a9134bf412d
SHA256c4e877a9e2f1b5e1ec06000024b5466df0cfe17195c986333a875280f998a1f1
SHA5126d22076da1fc63154f0a751efcd6301470ae6afcdba86bec6bbd442855470e3ef655bbcd393c67ec5cdac5172483e7daa7071f3af22b19b30ec816fb1cfc9abf
-
Filesize
472KB
MD588eb1bca8c399bc3f46e99cdde2f047e
SHA155fafbceb011e1af2edced978686a90971bd95f2
SHA25642fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428
SHA512149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728
-
Filesize
9B
MD5c0232c2f01c543d260713210da47a57b
SHA163f2c13c2c5c83091133c2802e69993d52e3ec65
SHA256278e1b8fd3f40d95faaecf548098b8d9ee4b32e98a8878559c8c8dfcd5cd1197
SHA5122ccfd67393a63f03f588296bb798d7a7d4ec2ea5d6ac486cb7bdf8a5a66b1df944d8b548f317e58bfe17dea2ae54e536ffe77bc11a43c931f3d10e299ab3fca0