Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 03:33
Static task
static1
Behavioral task
behavioral1
Sample
7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2.exe
Resource
win10v2004-20230703-en
General
-
Target
7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2.exe
-
Size
705KB
-
MD5
4e8e8c50e37b202e6aab7b15c133a7bc
-
SHA1
5c517b4878c91ccb4da509be49eeccf3fc24364c
-
SHA256
7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2
-
SHA512
ae0bb172eb5b6ed1464dcebf25c91c6718de747f391d53937e929d78ee185eae3d6926492ed7252d27f90d508ff40d3ad3dcfff518fc14b6ec96767360d4edd7
-
SSDEEP
12288:ZMrny9044SidEzVCvwHxIJjzKPfKImB6ce5AMl8DaDUbpCO/yBneQyfl9/e:eyN4SiWGIIpzyfLxl8DpBfFfL2
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
Extracted
redline
stas
77.91.124.82:19071
-
auth_value
db6d96c4eade05afc28c31d9ad73a73c
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x00070000000231bb-26.dat healer behavioral1/files/0x00070000000231bb-27.dat healer behavioral1/memory/3076-28-0x0000000000740000-0x000000000074A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" g1952567.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" g1952567.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" g1952567.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" g1952567.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection g1952567.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" g1952567.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 4440 x6805666.exe 1564 x5210512.exe 864 x4024038.exe 3076 g1952567.exe 3740 h7587309.exe 4572 saves.exe 2056 i4104346.exe 4260 saves.exe 1712 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 1760 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" g1952567.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x6805666.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x5210512.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x4024038.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4860 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3076 g1952567.exe 3076 g1952567.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3076 g1952567.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1164 wrote to memory of 4440 1164 7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2.exe 81 PID 1164 wrote to memory of 4440 1164 7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2.exe 81 PID 1164 wrote to memory of 4440 1164 7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2.exe 81 PID 4440 wrote to memory of 1564 4440 x6805666.exe 82 PID 4440 wrote to memory of 1564 4440 x6805666.exe 82 PID 4440 wrote to memory of 1564 4440 x6805666.exe 82 PID 1564 wrote to memory of 864 1564 x5210512.exe 83 PID 1564 wrote to memory of 864 1564 x5210512.exe 83 PID 1564 wrote to memory of 864 1564 x5210512.exe 83 PID 864 wrote to memory of 3076 864 x4024038.exe 84 PID 864 wrote to memory of 3076 864 x4024038.exe 84 PID 864 wrote to memory of 3740 864 x4024038.exe 92 PID 864 wrote to memory of 3740 864 x4024038.exe 92 PID 864 wrote to memory of 3740 864 x4024038.exe 92 PID 3740 wrote to memory of 4572 3740 h7587309.exe 93 PID 3740 wrote to memory of 4572 3740 h7587309.exe 93 PID 3740 wrote to memory of 4572 3740 h7587309.exe 93 PID 1564 wrote to memory of 2056 1564 x5210512.exe 94 PID 1564 wrote to memory of 2056 1564 x5210512.exe 94 PID 1564 wrote to memory of 2056 1564 x5210512.exe 94 PID 4572 wrote to memory of 4860 4572 saves.exe 95 PID 4572 wrote to memory of 4860 4572 saves.exe 95 PID 4572 wrote to memory of 4860 4572 saves.exe 95 PID 4572 wrote to memory of 1000 4572 saves.exe 96 PID 4572 wrote to memory of 1000 4572 saves.exe 96 PID 4572 wrote to memory of 1000 4572 saves.exe 96 PID 1000 wrote to memory of 4444 1000 cmd.exe 99 PID 1000 wrote to memory of 4444 1000 cmd.exe 99 PID 1000 wrote to memory of 4444 1000 cmd.exe 99 PID 1000 wrote to memory of 3716 1000 cmd.exe 100 PID 1000 wrote to memory of 3716 1000 cmd.exe 100 PID 1000 wrote to memory of 3716 1000 cmd.exe 100 PID 1000 wrote to memory of 1068 1000 cmd.exe 102 PID 1000 wrote to memory of 1068 1000 cmd.exe 102 PID 1000 wrote to memory of 1068 1000 cmd.exe 102 PID 1000 wrote to memory of 3676 1000 cmd.exe 103 PID 1000 wrote to memory of 3676 1000 cmd.exe 103 PID 1000 wrote to memory of 3676 1000 cmd.exe 103 PID 1000 wrote to memory of 3844 1000 cmd.exe 104 PID 1000 wrote to memory of 3844 1000 cmd.exe 104 PID 1000 wrote to memory of 3844 1000 cmd.exe 104 PID 1000 wrote to memory of 4272 1000 cmd.exe 105 PID 1000 wrote to memory of 4272 1000 cmd.exe 105 PID 1000 wrote to memory of 4272 1000 cmd.exe 105 PID 4572 wrote to memory of 1760 4572 saves.exe 108 PID 4572 wrote to memory of 1760 4572 saves.exe 108 PID 4572 wrote to memory of 1760 4572 saves.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2.exe"C:\Users\Admin\AppData\Local\Temp\7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6805666.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6805666.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5210512.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5210512.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4024038.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4024038.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1952567.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1952567.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3076
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7587309.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7587309.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:4860
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4444
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:3716
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:1068
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:3676
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:3844
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:4272
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:1760
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i4104346.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i4104346.exe4⤵
- Executes dropped EXE
PID:2056
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:4260
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:1712
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
599KB
MD5b1f043e5beb5686ed2e417d2da48c1f0
SHA13a539d92780a320ca554e35bc010971f154559a2
SHA25609cd981e54e1530cebca445ebadb674439de12646ead08d5c692e25ef76774a8
SHA512659df817d9189dc42eda0de6c696c0422a00883bc1da6de7f273d3502edcc47ec2af9409894788efe073046d6ec9b79d0bc15743b73261f3acbe3e194356258a
-
Filesize
599KB
MD5b1f043e5beb5686ed2e417d2da48c1f0
SHA13a539d92780a320ca554e35bc010971f154559a2
SHA25609cd981e54e1530cebca445ebadb674439de12646ead08d5c692e25ef76774a8
SHA512659df817d9189dc42eda0de6c696c0422a00883bc1da6de7f273d3502edcc47ec2af9409894788efe073046d6ec9b79d0bc15743b73261f3acbe3e194356258a
-
Filesize
433KB
MD50ee160349603c4b70e8d60f7b80f509f
SHA12241b00b11b9062a6224e20a4a47bd627339d22c
SHA25620b5bf02f25929a7e5c8b8c4ea92de97a6b1f922627a30d05c0f7e8cf70e3217
SHA512906d52570b059496cc446eddddaae5369a3274a162e5733845168474a50c0c9a6383b234de585d522ca5e1b61d70e55c25a3a2669b4be229dc3814223696a122
-
Filesize
433KB
MD50ee160349603c4b70e8d60f7b80f509f
SHA12241b00b11b9062a6224e20a4a47bd627339d22c
SHA25620b5bf02f25929a7e5c8b8c4ea92de97a6b1f922627a30d05c0f7e8cf70e3217
SHA512906d52570b059496cc446eddddaae5369a3274a162e5733845168474a50c0c9a6383b234de585d522ca5e1b61d70e55c25a3a2669b4be229dc3814223696a122
-
Filesize
174KB
MD52d18f43392917f6aaf9800229803c164
SHA1bb5b37a83e7a177b588376b4e24bdb97e37111b3
SHA2561117eeb94f380a1fb2304dd4a81bb18f3df91a1e6aeb48f18ef509360455dc10
SHA51290e3b49065ba5cf1b6e3ce8e4244fd7c293ede73bc55dc80e28fb96f1f664be5220acf4ca067b6fa9ef4d65aa8f84d2bb132c767f322ca422842fbaf84cf5ba9
-
Filesize
174KB
MD52d18f43392917f6aaf9800229803c164
SHA1bb5b37a83e7a177b588376b4e24bdb97e37111b3
SHA2561117eeb94f380a1fb2304dd4a81bb18f3df91a1e6aeb48f18ef509360455dc10
SHA51290e3b49065ba5cf1b6e3ce8e4244fd7c293ede73bc55dc80e28fb96f1f664be5220acf4ca067b6fa9ef4d65aa8f84d2bb132c767f322ca422842fbaf84cf5ba9
-
Filesize
277KB
MD5a869764d091fa7d328081d88be2a5bd5
SHA16437424cc106ad8391cc2bd9934558df55665a43
SHA25666ba47bbbad6e3cbc7b7d20873b6862b5b74aaafc7a873f6c09a6c5ef26eb684
SHA5125ab38354ff9654c94e35d6c92e0651a687dc9676498b33420ef9b4fd27aabf9cb914efb5c11ebc938e3877d4d1847a4c3e38705cf5660665d485ed03f5c9f02a
-
Filesize
277KB
MD5a869764d091fa7d328081d88be2a5bd5
SHA16437424cc106ad8391cc2bd9934558df55665a43
SHA25666ba47bbbad6e3cbc7b7d20873b6862b5b74aaafc7a873f6c09a6c5ef26eb684
SHA5125ab38354ff9654c94e35d6c92e0651a687dc9676498b33420ef9b4fd27aabf9cb914efb5c11ebc938e3877d4d1847a4c3e38705cf5660665d485ed03f5c9f02a
-
Filesize
15KB
MD54903424d41d3eba34126f22f2568f5aa
SHA16d930af02607852b9bacf5fd5731f11445ca2e03
SHA256cbb59c886e09f9c04a731e8c0a2ebe2b31b79f53ded34ad55690889371ddbd03
SHA512c6f1f69e98ce915a69512ac8ab7fc1f95ca63fad061c25b976a4125df45245cb14e10fb75a2cd2295ebc8fe2d071b364b02228b302ba179b26ac3946228534cb
-
Filesize
15KB
MD54903424d41d3eba34126f22f2568f5aa
SHA16d930af02607852b9bacf5fd5731f11445ca2e03
SHA256cbb59c886e09f9c04a731e8c0a2ebe2b31b79f53ded34ad55690889371ddbd03
SHA512c6f1f69e98ce915a69512ac8ab7fc1f95ca63fad061c25b976a4125df45245cb14e10fb75a2cd2295ebc8fe2d071b364b02228b302ba179b26ac3946228534cb
-
Filesize
323KB
MD5d8b1ff05f1f381d2a9890b6b914cce93
SHA161d356a37e6a409177fb12bb8060e622d19178df
SHA2563a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089
SHA5122b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac
-
Filesize
323KB
MD5d8b1ff05f1f381d2a9890b6b914cce93
SHA161d356a37e6a409177fb12bb8060e622d19178df
SHA2563a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089
SHA5122b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac
-
Filesize
323KB
MD5d8b1ff05f1f381d2a9890b6b914cce93
SHA161d356a37e6a409177fb12bb8060e622d19178df
SHA2563a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089
SHA5122b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac
-
Filesize
323KB
MD5d8b1ff05f1f381d2a9890b6b914cce93
SHA161d356a37e6a409177fb12bb8060e622d19178df
SHA2563a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089
SHA5122b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac
-
Filesize
323KB
MD5d8b1ff05f1f381d2a9890b6b914cce93
SHA161d356a37e6a409177fb12bb8060e622d19178df
SHA2563a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089
SHA5122b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac
-
Filesize
323KB
MD5d8b1ff05f1f381d2a9890b6b914cce93
SHA161d356a37e6a409177fb12bb8060e622d19178df
SHA2563a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089
SHA5122b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac
-
Filesize
323KB
MD5d8b1ff05f1f381d2a9890b6b914cce93
SHA161d356a37e6a409177fb12bb8060e622d19178df
SHA2563a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089
SHA5122b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7