Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 07:35
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230915-en
General
-
Target
file.exe
-
Size
1.3MB
-
MD5
927c4fe5f460861f3abc8014b281dd62
-
SHA1
fabe1d0a99f2446935538e2d2e89dea6d5ce9a37
-
SHA256
6ad87b6ae0e056ab495eabdd98b84b9bb7f2294c683026542107fdefea864fc3
-
SHA512
4366d64eccd3ca8f8abb82abcb8df54ceef44b43bbc2b7da4eac6df49d3f578037e96774d7ef73cc9b059bae759ced79057b48fc0a31e01f6225c4299344b1a3
-
SSDEEP
24576:/yfY123pDaR42Q5ZbEYPq3hWKecVo3rFBUx/dSH/phfru2RIpkUT:Kf5aRi5SVhhecVo3fwVMHn2OU
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 4 IoCs
resource yara_rule behavioral1/files/0x000700000001657c-34.dat healer behavioral1/files/0x000700000001657c-36.dat healer behavioral1/files/0x000700000001657c-37.dat healer behavioral1/memory/2668-38-0x0000000000910000-0x000000000091A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a8135561.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a8135561.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a8135561.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a8135561.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a8135561.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a8135561.exe -
Executes dropped EXE 5 IoCs
pid Process 1732 v7651441.exe 2704 v6253172.exe 2664 v0078850.exe 2668 a8135561.exe 2556 b3926984.exe -
Loads dropped DLL 14 IoCs
pid Process 2064 file.exe 1732 v7651441.exe 1732 v7651441.exe 2704 v6253172.exe 2704 v6253172.exe 2664 v0078850.exe 2664 v0078850.exe 2664 v0078850.exe 2664 v0078850.exe 2556 b3926984.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features a8135561.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a8135561.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v7651441.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v6253172.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v0078850.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2556 set thread context of 2488 2556 b3926984.exe 36 -
Program crash 1 IoCs
pid pid_target Process procid_target 3012 2556 WerFault.exe 32 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2668 a8135561.exe 2668 a8135561.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2668 a8135561.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2064 wrote to memory of 1732 2064 file.exe 28 PID 2064 wrote to memory of 1732 2064 file.exe 28 PID 2064 wrote to memory of 1732 2064 file.exe 28 PID 2064 wrote to memory of 1732 2064 file.exe 28 PID 2064 wrote to memory of 1732 2064 file.exe 28 PID 2064 wrote to memory of 1732 2064 file.exe 28 PID 2064 wrote to memory of 1732 2064 file.exe 28 PID 1732 wrote to memory of 2704 1732 v7651441.exe 29 PID 1732 wrote to memory of 2704 1732 v7651441.exe 29 PID 1732 wrote to memory of 2704 1732 v7651441.exe 29 PID 1732 wrote to memory of 2704 1732 v7651441.exe 29 PID 1732 wrote to memory of 2704 1732 v7651441.exe 29 PID 1732 wrote to memory of 2704 1732 v7651441.exe 29 PID 1732 wrote to memory of 2704 1732 v7651441.exe 29 PID 2704 wrote to memory of 2664 2704 v6253172.exe 30 PID 2704 wrote to memory of 2664 2704 v6253172.exe 30 PID 2704 wrote to memory of 2664 2704 v6253172.exe 30 PID 2704 wrote to memory of 2664 2704 v6253172.exe 30 PID 2704 wrote to memory of 2664 2704 v6253172.exe 30 PID 2704 wrote to memory of 2664 2704 v6253172.exe 30 PID 2704 wrote to memory of 2664 2704 v6253172.exe 30 PID 2664 wrote to memory of 2668 2664 v0078850.exe 31 PID 2664 wrote to memory of 2668 2664 v0078850.exe 31 PID 2664 wrote to memory of 2668 2664 v0078850.exe 31 PID 2664 wrote to memory of 2668 2664 v0078850.exe 31 PID 2664 wrote to memory of 2668 2664 v0078850.exe 31 PID 2664 wrote to memory of 2668 2664 v0078850.exe 31 PID 2664 wrote to memory of 2668 2664 v0078850.exe 31 PID 2664 wrote to memory of 2556 2664 v0078850.exe 32 PID 2664 wrote to memory of 2556 2664 v0078850.exe 32 PID 2664 wrote to memory of 2556 2664 v0078850.exe 32 PID 2664 wrote to memory of 2556 2664 v0078850.exe 32 PID 2664 wrote to memory of 2556 2664 v0078850.exe 32 PID 2664 wrote to memory of 2556 2664 v0078850.exe 32 PID 2664 wrote to memory of 2556 2664 v0078850.exe 32 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 2488 2556 b3926984.exe 36 PID 2556 wrote to memory of 3012 2556 b3926984.exe 37 PID 2556 wrote to memory of 3012 2556 b3926984.exe 37 PID 2556 wrote to memory of 3012 2556 b3926984.exe 37 PID 2556 wrote to memory of 3012 2556 b3926984.exe 37 PID 2556 wrote to memory of 3012 2556 b3926984.exe 37 PID 2556 wrote to memory of 3012 2556 b3926984.exe 37 PID 2556 wrote to memory of 3012 2556 b3926984.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7651441.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7651441.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6253172.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6253172.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0078850.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0078850.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8135561.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8135561.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3926984.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3926984.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:2488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 2686⤵
- Loads dropped DLL
- Program crash
PID:3012
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e168c7fc991a7a8a888ce928c3a3deab
SHA1548393fbaa0cfcd5d86f94a1722d8a376214d0b8
SHA2564f714a42107ad98baa198525beaa30e83fc4331dad614adc9b7bde75c2c5d50d
SHA512a7a223c15969d6ca90ebe7de98fac6eea1e8fba6cdefa9c1e0eb754c175616179f8f43cab22c5705ce4005b893ed2391774af1a445f317d39c589df84a4020a2
-
Filesize
1.2MB
MD5e168c7fc991a7a8a888ce928c3a3deab
SHA1548393fbaa0cfcd5d86f94a1722d8a376214d0b8
SHA2564f714a42107ad98baa198525beaa30e83fc4331dad614adc9b7bde75c2c5d50d
SHA512a7a223c15969d6ca90ebe7de98fac6eea1e8fba6cdefa9c1e0eb754c175616179f8f43cab22c5705ce4005b893ed2391774af1a445f317d39c589df84a4020a2
-
Filesize
835KB
MD57ac86c4042799caed8ec0d7bcf7c1553
SHA1761ffa18e3710ad2159ce53e69d61c47ddbcc71a
SHA25685e1b413ef5c6d0930887e6c06163d29fa6af182771bc0c7c9b04c9dc91d924b
SHA512e30fbb21af0e90274c7ff06d72075363256f3b6a9299e12bf4c00e2b8ec227091672c236273179147e42b6993018c4f0c42642f6fa9d504360ec0bf7c9266138
-
Filesize
835KB
MD57ac86c4042799caed8ec0d7bcf7c1553
SHA1761ffa18e3710ad2159ce53e69d61c47ddbcc71a
SHA25685e1b413ef5c6d0930887e6c06163d29fa6af182771bc0c7c9b04c9dc91d924b
SHA512e30fbb21af0e90274c7ff06d72075363256f3b6a9299e12bf4c00e2b8ec227091672c236273179147e42b6993018c4f0c42642f6fa9d504360ec0bf7c9266138
-
Filesize
475KB
MD53dd862ff5f41e5d1512e900ca2868e12
SHA120160cd262c179292f35fc236886ca51bab2c9d6
SHA2563da6a5acfd75408992e1ad6a9415e26fb6fc2865273269f6b6ee936e69f1f232
SHA5128ba2f7d03ec5184b7f7c177f4bbde57b867ef488931ec8a1e5678bf397566e5d66ee1a901fda4f6f08297104c3421155b2c99e9ab4d409261c2cdc61f16e82c0
-
Filesize
475KB
MD53dd862ff5f41e5d1512e900ca2868e12
SHA120160cd262c179292f35fc236886ca51bab2c9d6
SHA2563da6a5acfd75408992e1ad6a9415e26fb6fc2865273269f6b6ee936e69f1f232
SHA5128ba2f7d03ec5184b7f7c177f4bbde57b867ef488931ec8a1e5678bf397566e5d66ee1a901fda4f6f08297104c3421155b2c99e9ab4d409261c2cdc61f16e82c0
-
Filesize
11KB
MD5287f3c8c903556fc1e2491d9fb356b3a
SHA1c81ea2afba01ffdaeeab11a73ee99ade618ad8da
SHA2563aa2508e767ff51ef5a22d57653ee37084629c6b43de1d931d2255293a53e7c6
SHA5126ffe77f4211e18a1f8831d2b9ecf9477eb4a7b685fc1d4e21c8e74ddc07703dea3bba40efbd40914d8c007185f788dcb6d019172a8c08ebc489024897e994c84
-
Filesize
11KB
MD5287f3c8c903556fc1e2491d9fb356b3a
SHA1c81ea2afba01ffdaeeab11a73ee99ade618ad8da
SHA2563aa2508e767ff51ef5a22d57653ee37084629c6b43de1d931d2255293a53e7c6
SHA5126ffe77f4211e18a1f8831d2b9ecf9477eb4a7b685fc1d4e21c8e74ddc07703dea3bba40efbd40914d8c007185f788dcb6d019172a8c08ebc489024897e994c84
-
Filesize
1.0MB
MD58bbc8aa58cb075eceaf589c9973c345e
SHA129bc046ee31f2c455e2560c47b0822f65538fdbb
SHA256360098fa03964d77aab673a65f8d7adf6a5c8316f7c529152cf6d5ae964dfcc2
SHA512933574224b68da9090356067f87ce671653caf71d55f8523b0ea7c1534d5028f3d4cc7643e5c768098361b4d39a9a5ed82f21be1d60be560487c8ad88098f66d
-
Filesize
1.0MB
MD58bbc8aa58cb075eceaf589c9973c345e
SHA129bc046ee31f2c455e2560c47b0822f65538fdbb
SHA256360098fa03964d77aab673a65f8d7adf6a5c8316f7c529152cf6d5ae964dfcc2
SHA512933574224b68da9090356067f87ce671653caf71d55f8523b0ea7c1534d5028f3d4cc7643e5c768098361b4d39a9a5ed82f21be1d60be560487c8ad88098f66d
-
Filesize
1.0MB
MD58bbc8aa58cb075eceaf589c9973c345e
SHA129bc046ee31f2c455e2560c47b0822f65538fdbb
SHA256360098fa03964d77aab673a65f8d7adf6a5c8316f7c529152cf6d5ae964dfcc2
SHA512933574224b68da9090356067f87ce671653caf71d55f8523b0ea7c1534d5028f3d4cc7643e5c768098361b4d39a9a5ed82f21be1d60be560487c8ad88098f66d
-
Filesize
1.2MB
MD5e168c7fc991a7a8a888ce928c3a3deab
SHA1548393fbaa0cfcd5d86f94a1722d8a376214d0b8
SHA2564f714a42107ad98baa198525beaa30e83fc4331dad614adc9b7bde75c2c5d50d
SHA512a7a223c15969d6ca90ebe7de98fac6eea1e8fba6cdefa9c1e0eb754c175616179f8f43cab22c5705ce4005b893ed2391774af1a445f317d39c589df84a4020a2
-
Filesize
1.2MB
MD5e168c7fc991a7a8a888ce928c3a3deab
SHA1548393fbaa0cfcd5d86f94a1722d8a376214d0b8
SHA2564f714a42107ad98baa198525beaa30e83fc4331dad614adc9b7bde75c2c5d50d
SHA512a7a223c15969d6ca90ebe7de98fac6eea1e8fba6cdefa9c1e0eb754c175616179f8f43cab22c5705ce4005b893ed2391774af1a445f317d39c589df84a4020a2
-
Filesize
835KB
MD57ac86c4042799caed8ec0d7bcf7c1553
SHA1761ffa18e3710ad2159ce53e69d61c47ddbcc71a
SHA25685e1b413ef5c6d0930887e6c06163d29fa6af182771bc0c7c9b04c9dc91d924b
SHA512e30fbb21af0e90274c7ff06d72075363256f3b6a9299e12bf4c00e2b8ec227091672c236273179147e42b6993018c4f0c42642f6fa9d504360ec0bf7c9266138
-
Filesize
835KB
MD57ac86c4042799caed8ec0d7bcf7c1553
SHA1761ffa18e3710ad2159ce53e69d61c47ddbcc71a
SHA25685e1b413ef5c6d0930887e6c06163d29fa6af182771bc0c7c9b04c9dc91d924b
SHA512e30fbb21af0e90274c7ff06d72075363256f3b6a9299e12bf4c00e2b8ec227091672c236273179147e42b6993018c4f0c42642f6fa9d504360ec0bf7c9266138
-
Filesize
475KB
MD53dd862ff5f41e5d1512e900ca2868e12
SHA120160cd262c179292f35fc236886ca51bab2c9d6
SHA2563da6a5acfd75408992e1ad6a9415e26fb6fc2865273269f6b6ee936e69f1f232
SHA5128ba2f7d03ec5184b7f7c177f4bbde57b867ef488931ec8a1e5678bf397566e5d66ee1a901fda4f6f08297104c3421155b2c99e9ab4d409261c2cdc61f16e82c0
-
Filesize
475KB
MD53dd862ff5f41e5d1512e900ca2868e12
SHA120160cd262c179292f35fc236886ca51bab2c9d6
SHA2563da6a5acfd75408992e1ad6a9415e26fb6fc2865273269f6b6ee936e69f1f232
SHA5128ba2f7d03ec5184b7f7c177f4bbde57b867ef488931ec8a1e5678bf397566e5d66ee1a901fda4f6f08297104c3421155b2c99e9ab4d409261c2cdc61f16e82c0
-
Filesize
11KB
MD5287f3c8c903556fc1e2491d9fb356b3a
SHA1c81ea2afba01ffdaeeab11a73ee99ade618ad8da
SHA2563aa2508e767ff51ef5a22d57653ee37084629c6b43de1d931d2255293a53e7c6
SHA5126ffe77f4211e18a1f8831d2b9ecf9477eb4a7b685fc1d4e21c8e74ddc07703dea3bba40efbd40914d8c007185f788dcb6d019172a8c08ebc489024897e994c84
-
Filesize
1.0MB
MD58bbc8aa58cb075eceaf589c9973c345e
SHA129bc046ee31f2c455e2560c47b0822f65538fdbb
SHA256360098fa03964d77aab673a65f8d7adf6a5c8316f7c529152cf6d5ae964dfcc2
SHA512933574224b68da9090356067f87ce671653caf71d55f8523b0ea7c1534d5028f3d4cc7643e5c768098361b4d39a9a5ed82f21be1d60be560487c8ad88098f66d
-
Filesize
1.0MB
MD58bbc8aa58cb075eceaf589c9973c345e
SHA129bc046ee31f2c455e2560c47b0822f65538fdbb
SHA256360098fa03964d77aab673a65f8d7adf6a5c8316f7c529152cf6d5ae964dfcc2
SHA512933574224b68da9090356067f87ce671653caf71d55f8523b0ea7c1534d5028f3d4cc7643e5c768098361b4d39a9a5ed82f21be1d60be560487c8ad88098f66d
-
Filesize
1.0MB
MD58bbc8aa58cb075eceaf589c9973c345e
SHA129bc046ee31f2c455e2560c47b0822f65538fdbb
SHA256360098fa03964d77aab673a65f8d7adf6a5c8316f7c529152cf6d5ae964dfcc2
SHA512933574224b68da9090356067f87ce671653caf71d55f8523b0ea7c1534d5028f3d4cc7643e5c768098361b4d39a9a5ed82f21be1d60be560487c8ad88098f66d
-
Filesize
1.0MB
MD58bbc8aa58cb075eceaf589c9973c345e
SHA129bc046ee31f2c455e2560c47b0822f65538fdbb
SHA256360098fa03964d77aab673a65f8d7adf6a5c8316f7c529152cf6d5ae964dfcc2
SHA512933574224b68da9090356067f87ce671653caf71d55f8523b0ea7c1534d5028f3d4cc7643e5c768098361b4d39a9a5ed82f21be1d60be560487c8ad88098f66d
-
Filesize
1.0MB
MD58bbc8aa58cb075eceaf589c9973c345e
SHA129bc046ee31f2c455e2560c47b0822f65538fdbb
SHA256360098fa03964d77aab673a65f8d7adf6a5c8316f7c529152cf6d5ae964dfcc2
SHA512933574224b68da9090356067f87ce671653caf71d55f8523b0ea7c1534d5028f3d4cc7643e5c768098361b4d39a9a5ed82f21be1d60be560487c8ad88098f66d
-
Filesize
1.0MB
MD58bbc8aa58cb075eceaf589c9973c345e
SHA129bc046ee31f2c455e2560c47b0822f65538fdbb
SHA256360098fa03964d77aab673a65f8d7adf6a5c8316f7c529152cf6d5ae964dfcc2
SHA512933574224b68da9090356067f87ce671653caf71d55f8523b0ea7c1534d5028f3d4cc7643e5c768098361b4d39a9a5ed82f21be1d60be560487c8ad88098f66d
-
Filesize
1.0MB
MD58bbc8aa58cb075eceaf589c9973c345e
SHA129bc046ee31f2c455e2560c47b0822f65538fdbb
SHA256360098fa03964d77aab673a65f8d7adf6a5c8316f7c529152cf6d5ae964dfcc2
SHA512933574224b68da9090356067f87ce671653caf71d55f8523b0ea7c1534d5028f3d4cc7643e5c768098361b4d39a9a5ed82f21be1d60be560487c8ad88098f66d