Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/05/2024, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
AFC Drawing for POMB Support Base.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
AFC Drawing for POMB Support Base.exe
Resource
win10v2004-20240419-en
General
-
Target
AFC Drawing for POMB Support Base.exe
-
Size
245KB
-
MD5
eaa4063b22edbfb291c5d66acac6dfe3
-
SHA1
416ed8f73fb134cac9fecb3cb5dea409317ebf21
-
SHA256
5bc488bb19629699f5ef130f3bc37a5edf155dedb22220bfbfa49bf8bee45901
-
SHA512
64bb802d17433e4c4bbcb1bf76a353326b141fd2cfb55440e64dff3576e61d6029ed95844ddeb2dbcd29852439486c5c05b107aada6b613948efe423e43bfe9e
-
SSDEEP
3072:np6d0SCBM+0sr5h5gVBqHWniEHcsQh6WdNUhjVI8l+X1845b46DsFG+if:0H8512UfnUI1jtf
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1263338506:AAEo1afaqZcanZqwKGJF2HA7xr6YOHyXHtU/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 36 IoCs
resource yara_rule behavioral1/memory/2192-3-0x0000000007460000-0x000000000774A000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-4-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-5-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-55-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-7-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-58-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-61-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-9-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-11-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-15-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-21-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-25-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-29-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-37-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-59-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-67-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-65-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-63-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-53-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-51-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-49-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-47-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-45-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-43-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-41-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-39-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-35-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-33-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-31-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-27-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-23-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-19-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-17-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2192-13-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-7196-0x0000000004B50000-0x0000000004BC0000-memory.dmp family_zgrat_v1 behavioral1/memory/5032-7238-0x00000000062C0000-0x00000000064F0000-memory.dmp family_zgrat_v1 -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 5032 Khqvd.exe 2616 Khqvd.exe -
Loads dropped DLL 2 IoCs
pid Process 2540 AFC Drawing for POMB Support Base.exe 5032 Khqvd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 41 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Khqvd.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Khqvd.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Khqvd.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Khqvd.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Khqvd.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Khqvd.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook AFC Drawing for POMB Support Base.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AFC Drawing for POMB Support Base.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\notepad = "C:\\Users\\Admin\\AppData\\Roaming\\notepad.exe" AFC Drawing for POMB Support Base.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\notepad = "C:\\Users\\Admin\\AppData\\Roaming\\notepad.exe" Khqvd.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 api.ipify.org 11 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2192 set thread context of 2540 2192 AFC Drawing for POMB Support Base.exe 28 PID 5032 set thread context of 2616 5032 Khqvd.exe 31 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2540 AFC Drawing for POMB Support Base.exe 2540 AFC Drawing for POMB Support Base.exe 2540 AFC Drawing for POMB Support Base.exe 2616 Khqvd.exe 2616 Khqvd.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2192 AFC Drawing for POMB Support Base.exe Token: SeDebugPrivilege 2192 AFC Drawing for POMB Support Base.exe Token: SeDebugPrivilege 2540 AFC Drawing for POMB Support Base.exe Token: SeDebugPrivilege 5032 Khqvd.exe Token: SeDebugPrivilege 5032 Khqvd.exe Token: SeDebugPrivilege 2616 Khqvd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2616 Khqvd.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2540 2192 AFC Drawing for POMB Support Base.exe 28 PID 2192 wrote to memory of 2540 2192 AFC Drawing for POMB Support Base.exe 28 PID 2192 wrote to memory of 2540 2192 AFC Drawing for POMB Support Base.exe 28 PID 2192 wrote to memory of 2540 2192 AFC Drawing for POMB Support Base.exe 28 PID 2192 wrote to memory of 2540 2192 AFC Drawing for POMB Support Base.exe 28 PID 2192 wrote to memory of 2540 2192 AFC Drawing for POMB Support Base.exe 28 PID 2192 wrote to memory of 2540 2192 AFC Drawing for POMB Support Base.exe 28 PID 2192 wrote to memory of 2540 2192 AFC Drawing for POMB Support Base.exe 28 PID 2192 wrote to memory of 2540 2192 AFC Drawing for POMB Support Base.exe 28 PID 2540 wrote to memory of 5032 2540 AFC Drawing for POMB Support Base.exe 30 PID 2540 wrote to memory of 5032 2540 AFC Drawing for POMB Support Base.exe 30 PID 2540 wrote to memory of 5032 2540 AFC Drawing for POMB Support Base.exe 30 PID 2540 wrote to memory of 5032 2540 AFC Drawing for POMB Support Base.exe 30 PID 5032 wrote to memory of 2616 5032 Khqvd.exe 31 PID 5032 wrote to memory of 2616 5032 Khqvd.exe 31 PID 5032 wrote to memory of 2616 5032 Khqvd.exe 31 PID 5032 wrote to memory of 2616 5032 Khqvd.exe 31 PID 5032 wrote to memory of 2616 5032 Khqvd.exe 31 PID 5032 wrote to memory of 2616 5032 Khqvd.exe 31 PID 5032 wrote to memory of 2616 5032 Khqvd.exe 31 PID 5032 wrote to memory of 2616 5032 Khqvd.exe 31 PID 5032 wrote to memory of 2616 5032 Khqvd.exe 31 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Khqvd.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Khqvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AFC Drawing for POMB Support Base.exe"C:\Users\Admin\AppData\Local\Temp\AFC Drawing for POMB Support Base.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\AFC Drawing for POMB Support Base.exe"C:\Users\Admin\AppData\Local\Temp\AFC Drawing for POMB Support Base.exe"2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\Khqvd.exe"C:\Users\Admin\AppData\Local\Temp\Khqvd.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\Khqvd.exe"C:\Users\Admin\AppData\Local\Temp\Khqvd.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2616
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
Filesize
2.4MB
MD5b5cee02be482d633cd6c05d22a0ce915
SHA18d1faa29acf831ab9ae278e3d7137259a5698036
SHA25648be2626fef09829a17197246cbd3ae2e7be8a9885d8740aefeb260abfd3248a
SHA5126bf6b94b0ea6a5a126723e913bb6f0b5725f86413e5eb22b8d6d9d32a87fe30c6b3f9776a1c42719f634709ee1fa8101ba5b3b3a5c963b3ac52a0d29efc9272c
-
Filesize
2.4MB
MD5013509ef3b108013bfc2d6c7b162e72d
SHA1212eea3ac01b8724a91eb8264e4415a37579a428
SHA25609e6b503aa842d1861a0a6fb468ecad81e9307fa9e628a46bc0d119832735340
SHA512003fd9ff90b49fdcc933a1f561c72d1854295071a74afb417d7108bb775a03c8611d4a8692a54921a65fd1397342fad2ba5a2b78a68a3e6599137be9c6e73fec