Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2023, 02:33
Static task
static1
Behavioral task
behavioral1
Sample
b9b32855ae306c2cd90b813a532198d8baa0f1f7afd26f1aee4801e8d6d3d69d.exe
Resource
win10v2004-20230703-en
General
-
Target
b9b32855ae306c2cd90b813a532198d8baa0f1f7afd26f1aee4801e8d6d3d69d.exe
-
Size
704KB
-
MD5
64cb71e0b930532c74c3d69e3f66fe32
-
SHA1
53716d7e766d339dbb4226af43fb5f7238312754
-
SHA256
b9b32855ae306c2cd90b813a532198d8baa0f1f7afd26f1aee4801e8d6d3d69d
-
SHA512
fdff62c8cb54e3ef6b8ea1864f03cef22b323b575e674dc4e652e29ecea396ef23edc54dfc60b072b60bd8f337321f423f44eba878eaa875e194f983e9d45cae
-
SSDEEP
12288:mMrQy90PAO5j+mEbDIdMsYcRYw9HGLunfFCNfo:+yOAO5j+3Ut/BfOw
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
Extracted
redline
sruta
77.91.124.82:19071
-
auth_value
c556edcd49703319eca74247de20c236
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000002321c-26.dat healer behavioral1/files/0x000700000002321c-27.dat healer behavioral1/memory/1284-28-0x00000000003A0000-0x00000000003AA000-memory.dmp healer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection g3906242.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" g3906242.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" g3906242.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" g3906242.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" g3906242.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" g3906242.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 3788 x5496086.exe 4620 x4006210.exe 4664 x5745703.exe 1284 g3906242.exe 1992 h9188042.exe 2964 saves.exe 4104 i2283708.exe 1112 saves.exe 3628 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 1624 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" g3906242.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b9b32855ae306c2cd90b813a532198d8baa0f1f7afd26f1aee4801e8d6d3d69d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x5496086.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x4006210.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x5745703.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3300 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1284 g3906242.exe 1284 g3906242.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1284 g3906242.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2728 wrote to memory of 3788 2728 b9b32855ae306c2cd90b813a532198d8baa0f1f7afd26f1aee4801e8d6d3d69d.exe 82 PID 2728 wrote to memory of 3788 2728 b9b32855ae306c2cd90b813a532198d8baa0f1f7afd26f1aee4801e8d6d3d69d.exe 82 PID 2728 wrote to memory of 3788 2728 b9b32855ae306c2cd90b813a532198d8baa0f1f7afd26f1aee4801e8d6d3d69d.exe 82 PID 3788 wrote to memory of 4620 3788 x5496086.exe 83 PID 3788 wrote to memory of 4620 3788 x5496086.exe 83 PID 3788 wrote to memory of 4620 3788 x5496086.exe 83 PID 4620 wrote to memory of 4664 4620 x4006210.exe 84 PID 4620 wrote to memory of 4664 4620 x4006210.exe 84 PID 4620 wrote to memory of 4664 4620 x4006210.exe 84 PID 4664 wrote to memory of 1284 4664 x5745703.exe 85 PID 4664 wrote to memory of 1284 4664 x5745703.exe 85 PID 4664 wrote to memory of 1992 4664 x5745703.exe 93 PID 4664 wrote to memory of 1992 4664 x5745703.exe 93 PID 4664 wrote to memory of 1992 4664 x5745703.exe 93 PID 1992 wrote to memory of 2964 1992 h9188042.exe 95 PID 1992 wrote to memory of 2964 1992 h9188042.exe 95 PID 1992 wrote to memory of 2964 1992 h9188042.exe 95 PID 4620 wrote to memory of 4104 4620 x4006210.exe 96 PID 4620 wrote to memory of 4104 4620 x4006210.exe 96 PID 4620 wrote to memory of 4104 4620 x4006210.exe 96 PID 2964 wrote to memory of 3300 2964 saves.exe 97 PID 2964 wrote to memory of 3300 2964 saves.exe 97 PID 2964 wrote to memory of 3300 2964 saves.exe 97 PID 2964 wrote to memory of 1936 2964 saves.exe 99 PID 2964 wrote to memory of 1936 2964 saves.exe 99 PID 2964 wrote to memory of 1936 2964 saves.exe 99 PID 1936 wrote to memory of 1292 1936 cmd.exe 101 PID 1936 wrote to memory of 1292 1936 cmd.exe 101 PID 1936 wrote to memory of 1292 1936 cmd.exe 101 PID 1936 wrote to memory of 2740 1936 cmd.exe 102 PID 1936 wrote to memory of 2740 1936 cmd.exe 102 PID 1936 wrote to memory of 2740 1936 cmd.exe 102 PID 1936 wrote to memory of 4708 1936 cmd.exe 103 PID 1936 wrote to memory of 4708 1936 cmd.exe 103 PID 1936 wrote to memory of 4708 1936 cmd.exe 103 PID 1936 wrote to memory of 4728 1936 cmd.exe 105 PID 1936 wrote to memory of 4728 1936 cmd.exe 105 PID 1936 wrote to memory of 4728 1936 cmd.exe 105 PID 1936 wrote to memory of 3448 1936 cmd.exe 104 PID 1936 wrote to memory of 3448 1936 cmd.exe 104 PID 1936 wrote to memory of 3448 1936 cmd.exe 104 PID 1936 wrote to memory of 1000 1936 cmd.exe 106 PID 1936 wrote to memory of 1000 1936 cmd.exe 106 PID 1936 wrote to memory of 1000 1936 cmd.exe 106 PID 2964 wrote to memory of 1624 2964 saves.exe 109 PID 2964 wrote to memory of 1624 2964 saves.exe 109 PID 2964 wrote to memory of 1624 2964 saves.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9b32855ae306c2cd90b813a532198d8baa0f1f7afd26f1aee4801e8d6d3d69d.exe"C:\Users\Admin\AppData\Local\Temp\b9b32855ae306c2cd90b813a532198d8baa0f1f7afd26f1aee4801e8d6d3d69d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5496086.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5496086.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4006210.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4006210.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5745703.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5745703.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3906242.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3906242.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1284
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h9188042.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h9188042.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:3300
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:1292
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:2740
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:4708
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:3448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4728
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:1000
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:1624
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i2283708.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i2283708.exe4⤵
- Executes dropped EXE
PID:4104
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:1112
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:3628
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
599KB
MD513f9eb3f3ee9dcac346469cde865e701
SHA1b0c0a769f81a567f1ba8462c73a0ff9746295acc
SHA25689aa147a4f15952e3ef8f88f4a3afe23cd93b0960f12af865488cb690dba3e7f
SHA5127a79d69a0cfd76c34e0d40e1e9141d2328eca6b7c599a4599428ffd89c281d77fd1e93bf43105544fe112d09712448f40f496d1a4496701106dbaf8b4f6c38a8
-
Filesize
599KB
MD513f9eb3f3ee9dcac346469cde865e701
SHA1b0c0a769f81a567f1ba8462c73a0ff9746295acc
SHA25689aa147a4f15952e3ef8f88f4a3afe23cd93b0960f12af865488cb690dba3e7f
SHA5127a79d69a0cfd76c34e0d40e1e9141d2328eca6b7c599a4599428ffd89c281d77fd1e93bf43105544fe112d09712448f40f496d1a4496701106dbaf8b4f6c38a8
-
Filesize
433KB
MD5030c7aa167d0544b43a72779881aa46b
SHA1c88417274e726a461c65a2143d484968bd85aefb
SHA2564d9415cfdbdfc5ac9553be4794f35f369770ede2a08f79fa0a69d7efa4ccb5ef
SHA5120170a693eda11bce98b794a2c01ecda77b7e7ec672298bf42c2e335df088bc043473d11e5a89ddbf7afdeea6f8c0ffe2154550d24c88418a9a229ae9ffcd0c7f
-
Filesize
433KB
MD5030c7aa167d0544b43a72779881aa46b
SHA1c88417274e726a461c65a2143d484968bd85aefb
SHA2564d9415cfdbdfc5ac9553be4794f35f369770ede2a08f79fa0a69d7efa4ccb5ef
SHA5120170a693eda11bce98b794a2c01ecda77b7e7ec672298bf42c2e335df088bc043473d11e5a89ddbf7afdeea6f8c0ffe2154550d24c88418a9a229ae9ffcd0c7f
-
Filesize
174KB
MD5d97e656b5595c427f4b37e86ffb5d682
SHA18b1801df554977dd52f91196f687509c2d66bf67
SHA256948ddf3abc097b20667de79972ad985902c78229974a770c40436c67f6dcbe60
SHA512caae05a06cb6cbeca441990cd8ee3ad7a2693747dba811c49b31b77e047da4f2a28f0d6f0b55935afac37398e2cac27de6d57ea846c49c30a4aa09a8a1c67bae
-
Filesize
174KB
MD5d97e656b5595c427f4b37e86ffb5d682
SHA18b1801df554977dd52f91196f687509c2d66bf67
SHA256948ddf3abc097b20667de79972ad985902c78229974a770c40436c67f6dcbe60
SHA512caae05a06cb6cbeca441990cd8ee3ad7a2693747dba811c49b31b77e047da4f2a28f0d6f0b55935afac37398e2cac27de6d57ea846c49c30a4aa09a8a1c67bae
-
Filesize
277KB
MD59ba190bfb764c0ec43bc4eaf221e31d2
SHA12dfebd41098c6503f25a2144254109cadd7d83d9
SHA256a6108fb19ff1b2d6821abead376e4558347da2d0260bade80ea7624e6a3d44d3
SHA512ec892ed7383f31e9133610fea78f4aafe9867587fde6c60c8097b90997888c0216987a57ff7144cb8d3696099f8e26fb800964567560883050b6c4cbd851a210
-
Filesize
277KB
MD59ba190bfb764c0ec43bc4eaf221e31d2
SHA12dfebd41098c6503f25a2144254109cadd7d83d9
SHA256a6108fb19ff1b2d6821abead376e4558347da2d0260bade80ea7624e6a3d44d3
SHA512ec892ed7383f31e9133610fea78f4aafe9867587fde6c60c8097b90997888c0216987a57ff7144cb8d3696099f8e26fb800964567560883050b6c4cbd851a210
-
Filesize
17KB
MD58e9707ae8ea4e3fa61b59cb66aaf288b
SHA124f9136af0ae4045fb819d796180d800a705aea8
SHA2567e00e2f6841b485d2f53eec20eb8bcdea9a456638640f9311c0fdd26673f78b0
SHA512559d064dfebde0bc416a9ebf187c13c7fef35544e39d37efffd1f2d2968a1cdfeff16f7763075d186904442719c43f62a83322794065f3db4eb4baa3d98008be
-
Filesize
17KB
MD58e9707ae8ea4e3fa61b59cb66aaf288b
SHA124f9136af0ae4045fb819d796180d800a705aea8
SHA2567e00e2f6841b485d2f53eec20eb8bcdea9a456638640f9311c0fdd26673f78b0
SHA512559d064dfebde0bc416a9ebf187c13c7fef35544e39d37efffd1f2d2968a1cdfeff16f7763075d186904442719c43f62a83322794065f3db4eb4baa3d98008be
-
Filesize
326KB
MD59aef4e84dff4b8b22b7ab9a8cfdbb78f
SHA1527415da1fb393c6ea5febcbcf46545868d45458
SHA25683e3ab2c599795690197e054649557396a7ed90090c24aed3b8c6bfcb3bd09de
SHA512a61613b15c55ee4f10a2171045921ba435c14690f52fb358d8b92c1208e5a6c207d7070ee4997dca831d0be33221cf5d45766e21217b4985e5db771e1c4cc6e5
-
Filesize
326KB
MD59aef4e84dff4b8b22b7ab9a8cfdbb78f
SHA1527415da1fb393c6ea5febcbcf46545868d45458
SHA25683e3ab2c599795690197e054649557396a7ed90090c24aed3b8c6bfcb3bd09de
SHA512a61613b15c55ee4f10a2171045921ba435c14690f52fb358d8b92c1208e5a6c207d7070ee4997dca831d0be33221cf5d45766e21217b4985e5db771e1c4cc6e5
-
Filesize
326KB
MD59aef4e84dff4b8b22b7ab9a8cfdbb78f
SHA1527415da1fb393c6ea5febcbcf46545868d45458
SHA25683e3ab2c599795690197e054649557396a7ed90090c24aed3b8c6bfcb3bd09de
SHA512a61613b15c55ee4f10a2171045921ba435c14690f52fb358d8b92c1208e5a6c207d7070ee4997dca831d0be33221cf5d45766e21217b4985e5db771e1c4cc6e5
-
Filesize
326KB
MD59aef4e84dff4b8b22b7ab9a8cfdbb78f
SHA1527415da1fb393c6ea5febcbcf46545868d45458
SHA25683e3ab2c599795690197e054649557396a7ed90090c24aed3b8c6bfcb3bd09de
SHA512a61613b15c55ee4f10a2171045921ba435c14690f52fb358d8b92c1208e5a6c207d7070ee4997dca831d0be33221cf5d45766e21217b4985e5db771e1c4cc6e5
-
Filesize
326KB
MD59aef4e84dff4b8b22b7ab9a8cfdbb78f
SHA1527415da1fb393c6ea5febcbcf46545868d45458
SHA25683e3ab2c599795690197e054649557396a7ed90090c24aed3b8c6bfcb3bd09de
SHA512a61613b15c55ee4f10a2171045921ba435c14690f52fb358d8b92c1208e5a6c207d7070ee4997dca831d0be33221cf5d45766e21217b4985e5db771e1c4cc6e5
-
Filesize
326KB
MD59aef4e84dff4b8b22b7ab9a8cfdbb78f
SHA1527415da1fb393c6ea5febcbcf46545868d45458
SHA25683e3ab2c599795690197e054649557396a7ed90090c24aed3b8c6bfcb3bd09de
SHA512a61613b15c55ee4f10a2171045921ba435c14690f52fb358d8b92c1208e5a6c207d7070ee4997dca831d0be33221cf5d45766e21217b4985e5db771e1c4cc6e5
-
Filesize
326KB
MD59aef4e84dff4b8b22b7ab9a8cfdbb78f
SHA1527415da1fb393c6ea5febcbcf46545868d45458
SHA25683e3ab2c599795690197e054649557396a7ed90090c24aed3b8c6bfcb3bd09de
SHA512a61613b15c55ee4f10a2171045921ba435c14690f52fb358d8b92c1208e5a6c207d7070ee4997dca831d0be33221cf5d45766e21217b4985e5db771e1c4cc6e5
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7