Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
185s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 20:02
Static task
static1
Behavioral task
behavioral1
Sample
39f65eb60578fafd0df50305fd87a1a5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
39f65eb60578fafd0df50305fd87a1a5.exe
Resource
win10v2004-20231215-en
General
-
Target
39f65eb60578fafd0df50305fd87a1a5.exe
-
Size
286KB
-
MD5
39f65eb60578fafd0df50305fd87a1a5
-
SHA1
c4be9cb53658e3d9592288e31b32733e4b1e80cc
-
SHA256
503489f6a200d5bad10841f8740c481b96ff17a08b8edc476b7722853bba23ed
-
SHA512
e82d9cf2ee64cc21bfba41733ee41538af4daf611dd87c9adbfd51c76f5f7df22fa75de68ce0bce1a7f6d48320a5269e9052309ed88156d9a7a26d47fdc57241
-
SSDEEP
6144:eKK9AIV8+3vko4UWDxjyaz6BNG+D+Pbhjesi1cT:mGIV8OlgVxuNoPtmW
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4532 nOiIfEpEfJj28601.exe -
Executes dropped EXE 1 IoCs
pid Process 4532 nOiIfEpEfJj28601.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nOiIfEpEfJj28601 = "C:\\ProgramData\\nOiIfEpEfJj28601\\nOiIfEpEfJj28601.exe" nOiIfEpEfJj28601.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: nOiIfEpEfJj28601.exe File opened (read-only) \??\P: nOiIfEpEfJj28601.exe File opened (read-only) \??\R: nOiIfEpEfJj28601.exe File opened (read-only) \??\U: nOiIfEpEfJj28601.exe File opened (read-only) \??\G: nOiIfEpEfJj28601.exe File opened (read-only) \??\K: nOiIfEpEfJj28601.exe File opened (read-only) \??\N: nOiIfEpEfJj28601.exe File opened (read-only) \??\S: nOiIfEpEfJj28601.exe File opened (read-only) \??\W: nOiIfEpEfJj28601.exe File opened (read-only) \??\Y: nOiIfEpEfJj28601.exe File opened (read-only) \??\Z: nOiIfEpEfJj28601.exe File opened (read-only) \??\I: nOiIfEpEfJj28601.exe File opened (read-only) \??\M: nOiIfEpEfJj28601.exe File opened (read-only) \??\T: nOiIfEpEfJj28601.exe File opened (read-only) \??\V: nOiIfEpEfJj28601.exe File opened (read-only) \??\Q: nOiIfEpEfJj28601.exe File opened (read-only) \??\X: nOiIfEpEfJj28601.exe File opened (read-only) \??\E: nOiIfEpEfJj28601.exe File opened (read-only) \??\H: nOiIfEpEfJj28601.exe File opened (read-only) \??\J: nOiIfEpEfJj28601.exe File opened (read-only) \??\O: nOiIfEpEfJj28601.exe -
Program crash 35 IoCs
pid pid_target Process procid_target 4004 1088 WerFault.exe 86 5100 1088 WerFault.exe 86 1012 1088 WerFault.exe 86 5000 1088 WerFault.exe 86 2772 4532 WerFault.exe 97 4392 4532 WerFault.exe 97 2408 4532 WerFault.exe 97 1356 1088 WerFault.exe 86 2444 1088 WerFault.exe 86 4160 4532 WerFault.exe 97 3460 1088 WerFault.exe 86 3760 4532 WerFault.exe 97 2152 4532 WerFault.exe 97 4164 1088 WerFault.exe 86 3532 1088 WerFault.exe 86 3056 4532 WerFault.exe 97 2932 4532 WerFault.exe 97 3892 4532 WerFault.exe 97 1016 1088 WerFault.exe 86 2732 4532 WerFault.exe 97 2016 1088 WerFault.exe 86 1092 4532 WerFault.exe 97 1744 4532 WerFault.exe 97 3680 4532 WerFault.exe 97 1864 4532 WerFault.exe 97 4056 4532 WerFault.exe 97 1848 4532 WerFault.exe 97 4980 4532 WerFault.exe 97 4092 4532 WerFault.exe 97 2252 1088 WerFault.exe 86 3932 1088 WerFault.exe 86 1352 4532 WerFault.exe 97 3748 4532 WerFault.exe 97 2124 4532 WerFault.exe 97 1104 4532 WerFault.exe 97 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 1088 39f65eb60578fafd0df50305fd87a1a5.exe 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1088 39f65eb60578fafd0df50305fd87a1a5.exe Token: SeDebugPrivilege 4532 nOiIfEpEfJj28601.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4532 nOiIfEpEfJj28601.exe 4532 nOiIfEpEfJj28601.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1088 wrote to memory of 4532 1088 39f65eb60578fafd0df50305fd87a1a5.exe 97 PID 1088 wrote to memory of 4532 1088 39f65eb60578fafd0df50305fd87a1a5.exe 97 PID 1088 wrote to memory of 4532 1088 39f65eb60578fafd0df50305fd87a1a5.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\39f65eb60578fafd0df50305fd87a1a5.exe"C:\Users\Admin\AppData\Local\Temp\39f65eb60578fafd0df50305fd87a1a5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 5682⤵
- Program crash
PID:4004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 6162⤵
- Program crash
PID:5100
-
-
C:\ProgramData\nOiIfEpEfJj28601\nOiIfEpEfJj28601.exe"C:\ProgramData\nOiIfEpEfJj28601\nOiIfEpEfJj28601.exe" "C:\Users\Admin\AppData\Local\Temp\39f65eb60578fafd0df50305fd87a1a5.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 6323⤵
- Program crash
PID:2772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 6403⤵
- Program crash
PID:4392
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 6483⤵
- Program crash
PID:2408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 7923⤵
- Program crash
PID:4160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 8003⤵
- Program crash
PID:3760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 8443⤵
- Program crash
PID:2152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 8523⤵
- Program crash
PID:3056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 10283⤵
- Program crash
PID:2932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 10523⤵
- Program crash
PID:3892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 11323⤵
- Program crash
PID:2732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 6523⤵
- Program crash
PID:1092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 14043⤵
- Program crash
PID:1744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 16243⤵
- Program crash
PID:3680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 6683⤵
- Program crash
PID:1864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 16123⤵
- Program crash
PID:4056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 17003⤵
- Program crash
PID:1848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 18123⤵
- Program crash
PID:4980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 18283⤵
- Program crash
PID:4092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 10883⤵
- Program crash
PID:1352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 8163⤵
- Program crash
PID:3748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 10843⤵
- Program crash
PID:2124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 8083⤵
- Program crash
PID:1104
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 6322⤵
- Program crash
PID:1012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 6162⤵
- Program crash
PID:5000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 7962⤵
- Program crash
PID:1356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 8042⤵
- Program crash
PID:2444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 8282⤵
- Program crash
PID:3460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 8362⤵
- Program crash
PID:4164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 9602⤵
- Program crash
PID:3532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 9642⤵
- Program crash
PID:1016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 11722⤵
- Program crash
PID:2016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 6282⤵
- Program crash
PID:2252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 1482⤵
- Program crash
PID:3932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1088 -ip 10881⤵PID:1704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1088 -ip 10881⤵PID:3384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1088 -ip 10881⤵PID:2436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4532 -ip 45321⤵PID:4808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4532 -ip 45321⤵PID:5080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4532 -ip 45321⤵PID:1812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1088 -ip 10881⤵PID:512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1088 -ip 10881⤵PID:3856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4532 -ip 45321⤵PID:3876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4532 -ip 45321⤵PID:444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1088 -ip 10881⤵PID:1864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4532 -ip 45321⤵PID:4748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1088 -ip 10881⤵PID:4908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1088 -ip 10881⤵PID:316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1088 -ip 10881⤵PID:1532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4532 -ip 45321⤵PID:3152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1088 -ip 10881⤵PID:4024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4532 -ip 45321⤵PID:4980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4532 -ip 45321⤵PID:3024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4532 -ip 45321⤵PID:956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1088 -ip 10881⤵PID:5068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4532 -ip 45321⤵PID:2600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4532 -ip 45321⤵PID:1412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4532 -ip 45321⤵PID:2576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4532 -ip 45321⤵PID:3168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4532 -ip 45321⤵PID:4552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4532 -ip 45321⤵PID:4108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4532 -ip 45321⤵PID:4164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4532 -ip 45321⤵PID:4676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1088 -ip 10881⤵PID:4184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1088 -ip 10881⤵PID:1548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4532 -ip 45321⤵PID:3928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4532 -ip 45321⤵PID:404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4532 -ip 45321⤵PID:3904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4532 -ip 45321⤵PID:4680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5a5a6d1597ebf9775b52b6f4b2afb5dab
SHA172da337696673664559f3137e19fd7d5ebb037be
SHA256a7073b7cc004bf54a49249157d5096227c5d2cb06a9030af6887eacb0c3a55f9
SHA5121ca01dabc7e4028b8836a7babf897e8a721fd0cef43fa169fa57c1ff605c0ced775ac09b9502efa33a25b2f8e3659201bd61aa3f2b265bc4d5ae689984302e36
-
Filesize
6KB
MD5cc69528880a8ee4726f5c9fbb1e0b4cb
SHA1c9b6418b7d5f1bb980b1598a484f9a56ad2a08d4
SHA256197d82db49e660c3b1e5ee0af725db2fa5cac38fb0288e7fe8201357a8ca1d90
SHA512b551c89fea21429a1838e2114c287f6f980997e1e81b4532f09957aca92807412a94f76749ce74eec3e48a6980cf09d5d22ab3492be31a334a5b81bb8670f881