Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    08/01/2024, 07:44

General

  • Target

    4ad8d75bf9adec1c842b08580a057756.exe

  • Size

    9.7MB

  • MD5

    4ad8d75bf9adec1c842b08580a057756

  • SHA1

    31ddc5eb8de63acd0181d97fbf2df8016dc81dc8

  • SHA256

    2225b313a0f9cdf6d8e08ba774afa69b9e6cb7c835215d0785b0f31d4036e623

  • SHA512

    f5df73b960f61a8ad9d10c96f108d1bbcc35e9a7df137d2d987091ba16729e85a0e4dc200b03d615ab9de6b5916f6ee8d716aba230607722791952596ec6dd1e

  • SSDEEP

    196608:Tx0aFdqCsXDjDyfmdJolpPgToa10/J48RmU/3ZlsPv9IGdFOnJA4GTvN8C8pmI+:lLFYCEDLJ83a10RtN3ZWDsSTCIR

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 28 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ad8d75bf9adec1c842b08580a057756.exe
    "C:\Users\Admin\AppData\Local\Temp\4ad8d75bf9adec1c842b08580a057756.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Users\Admin\AppData\Local\Temp\4ad8d75bf9adec1c842b08580a057756.exe
      "C:\Users\Admin\AppData\Local\Temp\4ad8d75bf9adec1c842b08580a057756.exe"
      2⤵
      • Loads dropped DLL
      PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\VCRUNTIME140.dll

    Filesize

    93KB

    MD5

    4a365ffdbde27954e768358f4a4ce82e

    SHA1

    a1b31102eee1d2a4ed1290da2038b7b9f6a104a3

    SHA256

    6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c

    SHA512

    54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\_ctypes.pyd

    Filesize

    124KB

    MD5

    291a0a9b63bae00a4222a6df71a22023

    SHA1

    7a6a2aad634ec30e8edb2d2d8d0895c708d84551

    SHA256

    820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324

    SHA512

    d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\_socket.pyd

    Filesize

    78KB

    MD5

    4827652de133c83fa1cae839b361856c

    SHA1

    182f9a04bdc42766cfd5fb352f2cb22e5c26665e

    SHA256

    87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba

    SHA512

    8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\_tkinter.pyd

    Filesize

    64KB

    MD5

    cc74d36aeedc687d5ee733041042e2e5

    SHA1

    c304c579d15204eb25198e09a558ec747dea4832

    SHA256

    d55ef406b4612695499186355a6130885ad522e48556327c0fb409e0345d552d

    SHA512

    4e7e5330610e9588ad920f120e13260fa1ff94c73f5f286a42dd8475ce8387a8112ed38a5b0de5dcc855a0bcad6324a9b9344d8c576954f4c50a627ec6c34c86

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-core-file-l1-2-0.dll

    Filesize

    11KB

    MD5

    1bab66681e21a40a87bd7b869154ea3e

    SHA1

    4cd8f6da8a269c9f92915e557018b660e9a67543

    SHA256

    20560798f43a79ef390d9bc42aea3a59918c9440fb1404b420072b2048d77def

    SHA512

    8d184572a31ad33d8350170c9d4ca3f7fdb2675bc8569d5a917b13da798ce4b3aaae231be81e5f09fbf98369b8769c71ebd1a128745bf2f9829230eee141d6b5

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-core-file-l2-1-0.dll

    Filesize

    11KB

    MD5

    1f061fd38e9e8717f1a6b9463929e9e2

    SHA1

    332b69d41c480c89bfc3840e132754cb19643146

    SHA256

    843a7cab04233f656081ddbeceeb58a7cdd2e2b1a04833f8acc4d361d2909abb

    SHA512

    c1825476f8a1dc11cdee5511d367ff66657e86840a57984711ab09814af9f588fc4b16ce6e63e446bb7ea16de2fe1bfdc91e71fa42285e0934b655f1a22cb579

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    13KB

    MD5

    a9511d3c0f01d3855e6d66066287b270

    SHA1

    1adb59fad65559234978ddb1aa594954392756e9

    SHA256

    e4d3c421dfcf3a68ecba5ad4edd6bf55fcbed486a1417af9beaa9a1d62fb7e2a

    SHA512

    584ae6d9d7b55caad035ebca284e848ca4875dbb8e8626093b7764d66907410f5b6bb0ecbc8f52269041707e47e8fd5781f2be26118125ad6efc6365bdb4d253

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    11KB

    MD5

    7ecd60a32b006faa9b2618182fdaf1a4

    SHA1

    c6f8a363efd6a10abcb5b644ff49e26a0dd54c1a

    SHA256

    647442d40ea1bda158ceef56e3ec3d2e66fff1702de469e9c2ff162f1bff6161

    SHA512

    091029146cde34ce72916b5c090725962d63b53d1455aa96265cd3af98609994430dda2bc38f72a3aa8b2bd973680c83ff486d41c6ec0fa8a1cf43baef99bfc2

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    11KB

    MD5

    c45f1192763d4407778990a072b0dc74

    SHA1

    5b9f5813da5e76e87cf158ea610fbe6152a091bc

    SHA256

    434a06fb89164aff7b18acaffb079ba074e4dae782ac005680395e052a28f30e

    SHA512

    c1c68dd4b3418d37aeb074557cce2ff5c7330679f53cd5e1af8e92c90c7cf954538373a3cabb505d160ff68c0762acd5f8ef901046bab7ec70e44de3c8160988

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\base_library.zip

    Filesize

    760KB

    MD5

    b1ad2c0229d27b34e5c2450b82d29392

    SHA1

    120dec70f7155637d31a9f9a8ba72dae12cc6843

    SHA256

    ab15db2cef9ff8d0d911ee222fe8646a94f3c26d33b55f108f42d41abd0ba1ab

    SHA512

    82ecd92fdf1f6abbb975c38d03e5c0c78c724149fef0d865099c6529cff4005bc2896573bc6ace042bd82655170a1412fcf724212f8f798c75b51526835aefa0

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\libffi-7.dll

    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\python38.dll

    Filesize

    4.0MB

    MD5

    26ba25d468a778d37f1a24f4514d9814

    SHA1

    b64fe169690557656ede3ae50d3c5a197fea6013

    SHA256

    2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128

    SHA512

    80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\select.pyd

    Filesize

    27KB

    MD5

    e21cff76db11c1066fd96af86332b640

    SHA1

    e78ef7075c479b1d218132d89bf4bec13d54c06a

    SHA256

    fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28

    SHA512

    e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\tcl86t.dll

    Filesize

    1.6MB

    MD5

    c0b23815701dbae2a359cb8adb9ae730

    SHA1

    5be6736b645ed12e97b9462b77e5a43482673d90

    SHA256

    f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768

    SHA512

    ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\tcl8\8.5\msgcat-1.6.1.tm

    Filesize

    33KB

    MD5

    db52847c625ea3290f81238595a915cd

    SHA1

    45a4ed9b74965e399430290bcdcd64aca5d29159

    SHA256

    4fdf70fdcedef97aa8bd82a02669b066b5dfe7630c92494a130fc7c627b52b55

    SHA512

    5a8fb4ada7b2efbf1cadd10dbe4dc7ea7acd101cb8fd0b80dad42be3ed8804fc8695c53e6aeec088c2d4c3ee01af97d148b836289da6e4f9ee14432b923c7e40

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\tcl\auto.tcl

    Filesize

    20KB

    MD5

    5e9b3e874f8fbeaadef3a004a1b291b5

    SHA1

    b356286005efb4a3a46a1fdd53e4fcdc406569d0

    SHA256

    f385515658832feb75ee4dce5bd53f7f67f2629077b7d049b86a730a49bd0840

    SHA512

    482c555a0da2e635fa6838a40377eef547746b2907f53d77e9ffce8063c1a24322d8faa3421fc8d12fdcaff831b517a65dafb1cea6f5ea010bdc18a441b38790

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\tcl\encoding\cp1252.enc

    Filesize

    1KB

    MD5

    5900f51fd8b5ff75e65594eb7dd50533

    SHA1

    2e21300e0bc8a847d0423671b08d3c65761ee172

    SHA256

    14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0

    SHA512

    ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\tcl\init.tcl

    Filesize

    23KB

    MD5

    b900811a252be90c693e5e7ae365869d

    SHA1

    345752c46f7e8e67dadef7f6fd514bed4b708fc5

    SHA256

    bc492b19308bc011cfcd321f1e6e65e6239d4eeb620cc02f7e9bf89002511d4a

    SHA512

    36b8cdba61b9222f65b055c0c513801f3278a3851912215658bcf0ce10f80197c1f12a5ca3054d8604da005ce08da8dcd303b8544706b642140a49c4377dd6ce

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\tcl\tclIndex

    Filesize

    5KB

    MD5

    e127196e9174b429cc09c040158f6aab

    SHA1

    ff850f5d1bd8efc1a8cb765fe8221330f0c6c699

    SHA256

    abf7d9d1e86de931096c21820bfa4fd70db1f55005d2db4aa674d86200867806

    SHA512

    c4b98ebc65e25df41e6b9a93e16e608cf309fa0ae712578ee4974d84f7f33bcf2a6ed7626e88a343350e13da0c5c1a88e24a87fcbd44f7da5983bb3ef036a162

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\tcl\tm.tcl

    Filesize

    11KB

    MD5

    f9ed2096eea0f998c6701db8309f95a6

    SHA1

    bcdb4f7e3db3e2d78d25ed4e9231297465b45db8

    SHA256

    6437bd7040206d3f2db734fa482b6e79c68bcc950fba80c544c7f390ba158f9b

    SHA512

    e4fb8f28dc72ea913f79cedf5776788a0310608236d6607adc441e7f3036d589fd2b31c446c187ef5827fd37dcaa26d9e94d802513e3bf3300e94dd939695b30

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\tk\tk.tcl

    Filesize

    22KB

    MD5

    3250ec5b2efe5bbe4d3ec271f94e5359

    SHA1

    6a0fe910041c8df4f3cdc19871813792e8cc4e4c

    SHA256

    e1067a0668debb2d8e8ec3b7bc1aec3723627649832b20333f9369f28e4dfdbf

    SHA512

    f8e403f3d59d44333bce2aa7917e6d8115bec0fe5ae9a1306f215018b05056467643b7aa228154ddced176072bc903dfb556cb2638f5c55c1285c376079e8fe3

  • C:\Users\Admin\AppData\Local\Temp\_MEI22682\ucrtbase.dll

    Filesize

    971KB

    MD5

    bd8b198c3210b885fe516500306a4fcf

    SHA1

    28762cb66003587be1a59c2668d2300fce300c2d

    SHA256

    ce2621719f1358508c2c33bcc1380d78a737ca20cd18c0ac89f38e1be788d9a2

    SHA512

    c32b6c083d3a7da01085718e5685e9a04034be91251c065794ceef1dfaaf6573fdd845cbc84e926ab3f510d295649cb6e497564fbe52cc79c053357c645c11a5

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-conio-l1-1-0.dll

    Filesize

    12KB

    MD5

    833b2f70c9678b56133d69c2e4b67514

    SHA1

    7ff8544e56dda0dfccce716511bb9eb0e5cf9822

    SHA256

    3828e4a7a4ede679807577df73db4561469a5757bad52f241508ca84b3cbcdc7

    SHA512

    df0e0ae4ec65be16a725003abb7605f5a7fdc5e4c087bbb5d6dc57636aa47dc3042dcd01cd277d770b5781878bdb4955b945e244dea4fd7c9be8ca9532c0fb5c

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    15KB

    MD5

    f789e3383d73aa3fa3c35cebe27a6fe6

    SHA1

    3b887ab640181e350b78e30818e1b47c9c1ff11c

    SHA256

    60c3428168002b09fdc246cf948c8341c3b2a1a0e1f70cedcdd6eab59b8e2d08

    SHA512

    fd10635929e7598f05174fa3617fdb828547687898248376760c294570665c552d6e58215b9ea68b99ff5483c8657bb041cfdc9ed92cc0cfc1be7736eafb2b9d

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    11KB

    MD5

    673bec1368a19fa839cc77492ebe1c98

    SHA1

    c87c250ce43d760f4f07ffca2f4dabbbbe90edea

    SHA256

    63077ff3b5315688ed1ada38d05b15a713921e862a34ffc9260f30d3fd00cc7d

    SHA512

    52424b7746833934ec2c1b0b61246324a1c5cba164fd2f29562c6bde13333ddfb72907cd9107e72b7d7f5cf34ebb52a9b95eb37bb27dbce5cf234badee02a765

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    13KB

    MD5

    ab3369337c192d0ae9306af0ad030cef

    SHA1

    50577bf4eab40dd9ed9bd163ead95a0ea72b9597

    SHA256

    918411e05e727e6d42fe19b37c878d5ea461dc86f3bb8c21652c46d0088de8b4

    SHA512

    97a9426cf286b486cfa046867bf06e0458af2625634bd19786e69c9e6e42722f37cd4de8089033f5eaaa9d0baa835bf4e3d180bb0da3f6ba221c34bd75d141b8

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    11KB

    MD5

    66345ba9fae2de5be6dad2f2cb2c263d

    SHA1

    52d178ac3710f3bc622832c7b6ecb3682c340267

    SHA256

    13c9432b4e54ba7699c062f5f20fcfa083e77059b7b6bc33db2cef5767d49227

    SHA512

    a4db4fa07329d26d91f432d1c7726295a82f9cd6c21685cf190399db4a54bf38005d4041cbe6f9676bb264065602d7f0cb1f81d59a703ac994b6ba1c57f0ddf8

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    11KB

    MD5

    c8cb7df56c4e4c6b461cd7535c34dd3e

    SHA1

    881e0c16579e86d0f3def8fed98af64ba1ff6f2c

    SHA256

    de95bf6ecffb6aeb31bba8f62bb282f87e4b5b19659eca4b2435b2be2999c9c8

    SHA512

    19c354ee6d7645bf141889ce63467b3884ffdfd2964c7a873a80ec9fd10ed324b961869b0d06eafe222e7a064b77a8d7515b5c841872876ec19aa12dafea8b0d

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    20KB

    MD5

    3c76c9213112a111275ed5daf7b20a1e

    SHA1

    a9c2b0619c46c975637f1e0c4b80be7155fb158c

    SHA256

    7a75c4c14da9f0e6d9c597321ee3a6531f903bbce33b83259eca611f62877c60

    SHA512

    a058a5eeb3d8710aeb0098eb2b9f637cbe54631fc775dd5e054c99c018d3d91eb1d4561acc15c2bff8a2fd0900e0b85d0371768d56f46344f55982e9c837c7b3

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-process-l1-1-0.dll

    Filesize

    12KB

    MD5

    f4fa9e3d84e97b0f1f31c2c57ded56d1

    SHA1

    2a2cd7d6539e0f5913257f67e9a2ecbea974811f

    SHA256

    1c8b9cfecb68e60c151ebb2a305291e70b7584faefd8c02df331b3713f11c5f6

    SHA512

    9a18c121b48c7364b66631c0c730abd9044849be372932cbae352ae45dca1766d45afa4ad68048dad5a11407d04e059408a49d9fb46328b5e3bcce633efb5178

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    15KB

    MD5

    bf0c335428a9bdd676d726199dc9e517

    SHA1

    f9ef3ae33686176ec542f870da6c092b5c21c0cf

    SHA256

    4c93b20d7f2ccedc725f3f718f24e23d6a2148f0d73ea1d032c2eeba6b16afb0

    SHA512

    feecbd04acad88bc1a352c5ddfeff34acacf5c88b6ab3143692305378b1cb7b6204bfc8cd84abbc56c3ab279f39d1e75e3fe6904216d818de0a28b801a7c0928

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    17KB

    MD5

    a6d215393c7498005368b636ce8ac831

    SHA1

    b5b7ca683ab0736644a3fe9e51714b3d358d5adf

    SHA256

    12f0707c435d734fdec382b3475019b86e724902197b234a9788d9d6cb1e200c

    SHA512

    6c929ad71e4b1b7d92b692ba7faf9b16e66035bde6b1c2d53885badd3c65429a2c8c379be15a3f14e97ff00c05400eb4b4083d7955bc984b662c78fc5ac5f693

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    17KB

    MD5

    839e3484564f9141c7f047e336b84930

    SHA1

    dd03d279120ef382af0413c36fd4c58129a1e0c4

    SHA256

    4e07911d2d2bf39b8b5ccabe1427f094b8feb3e0e5a5a691c4533d3bf5e58d56

    SHA512

    dcc79e6f19a3bae6e83144cf466268e0c7f8ce22de5a6561c3df2cd536daa640282541e8943cf3b93d93610e97c52cd4f1a32febbe21828e03453de571537bc5

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    13KB

    MD5

    4a991ee39fc196089364ec5a22dc9dce

    SHA1

    f121bc9ade49b8e1a57ea681ea2e18d40136f01d

    SHA256

    c3e1514c2e4d12ca10581dd4ac16ccc9ed055ea408b6c47a7eaaa32432652315

    SHA512

    2f5f8b8ea0bee4792f90110dfef3c553b7d322618e3534227edd395510c10e5ef346ad06e340f519ef69e20302eac12e6144889ce733ce923134501ebfb2fbaa

  • \Users\Admin\AppData\Local\Temp\_MEI22682\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    11KB

    MD5

    bd2a0d3099e6f4dcc788d8e7d47095d2

    SHA1

    57ac6d00f21e9d7377157d9f5935b9cf27454f9d

    SHA256

    4f199489614cf260c71242ba85c948b7a7d021d4a2295298aeb937e0f3b65682

    SHA512

    1eb57e28010acb4cfd06b219d64efcec2dde6f80bb1e6cffdab3ce31b5c5000588c8a08daf4c7a6f44f0e6d6f71443f0cf87833b5cbb173e6900d9a20a6720d4

  • \Users\Admin\AppData\Local\Temp\_MEI22682\tk86t.dll

    Filesize

    1.4MB

    MD5

    fdc8a5d96f9576bd70aa1cadc2f21748

    SHA1

    bae145525a18ce7e5bc69c5f43c6044de7b6e004

    SHA256

    1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5

    SHA512

    816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c