Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1748s -
max time network
1747s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 13:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://restorecord.com/verify/DPRK%20THUGS
Resource
win10v2004-20240226-en
General
-
Target
https://restorecord.com/verify/DPRK%20THUGS
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
flow ioc 111 discord.com 155 discord.com 100 discord.com 101 discord.com 102 discord.com 103 discord.com 104 discord.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{6184FFB6-D8CB-4EE1-AF6C-DC34F0069008} msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3716 msedge.exe 3716 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3716 wrote to memory of 2916 3716 msedge.exe 113 PID 3716 wrote to memory of 2916 3716 msedge.exe 113 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 508 3716 msedge.exe 115 PID 3716 wrote to memory of 3888 3716 msedge.exe 116 PID 3716 wrote to memory of 3888 3716 msedge.exe 116 PID 3716 wrote to memory of 3536 3716 msedge.exe 117 PID 3716 wrote to memory of 3536 3716 msedge.exe 117 PID 3716 wrote to memory of 3536 3716 msedge.exe 117 PID 3716 wrote to memory of 3536 3716 msedge.exe 117 PID 3716 wrote to memory of 3536 3716 msedge.exe 117 PID 3716 wrote to memory of 3536 3716 msedge.exe 117 PID 3716 wrote to memory of 3536 3716 msedge.exe 117 PID 3716 wrote to memory of 3536 3716 msedge.exe 117 PID 3716 wrote to memory of 3536 3716 msedge.exe 117
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://restorecord.com/verify/DPRK%20THUGS1⤵PID:2640
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5256 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:11⤵PID:3620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3688 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:11⤵PID:3180
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5288 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:1460
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5556 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:3240
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5744 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:11⤵PID:5000
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5376 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:11⤵PID:4592
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=5564 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:11⤵PID:4312
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=6200 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:1496
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6236 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:3240
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --mojo-platform-channel-handle=6236 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:11⤵PID:2204
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5508 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:4052
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --mojo-platform-channel-handle=5784 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:11⤵PID:4564
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x23c,0x240,0x244,0x238,0x188,0x7ffdb24e2e98,0x7ffdb24e2ea4,0x7ffdb24e2eb02⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2268 --field-trial-handle=2272,i,8754842712433851915,12340728246151596117,262144 --variations-seed-version /prefetch:22⤵PID:508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3264 --field-trial-handle=2272,i,8754842712433851915,12340728246151596117,262144 --variations-seed-version /prefetch:32⤵PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3348 --field-trial-handle=2272,i,8754842712433851915,12340728246151596117,262144 --variations-seed-version /prefetch:82⤵PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4312 --field-trial-handle=2272,i,8754842712433851915,12340728246151596117,262144 --variations-seed-version /prefetch:82⤵PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4312 --field-trial-handle=2272,i,8754842712433851915,12340728246151596117,262144 --variations-seed-version /prefetch:82⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4376 --field-trial-handle=2272,i,8754842712433851915,12340728246151596117,262144 --variations-seed-version /prefetch:82⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=2272,i,8754842712433851915,12340728246151596117,262144 --variations-seed-version /prefetch:82⤵PID:1112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4692 --field-trial-handle=2272,i,8754842712433851915,12340728246151596117,262144 --variations-seed-version /prefetch:82⤵PID:2620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4160 --field-trial-handle=2272,i,8754842712433851915,12340728246151596117,262144 --variations-seed-version /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3832 --field-trial-handle=2272,i,8754842712433851915,12340728246151596117,262144 --variations-seed-version /prefetch:82⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2384 --field-trial-handle=2272,i,8754842712433851915,12340728246151596117,262144 --variations-seed-version /prefetch:82⤵PID:3192
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD5c9908a4d1fe0e5e2e3a8885331546d64
SHA1e66afc5539607adbfa89b31b11fc8d286578634f
SHA256d99710671837ac6bb85f2bf1daa269da02784cd96106bd876f66558662ed2fb5
SHA51288cfab89c9827633313687e2b1a7238e8697c4bdff130672ff278347d935f4dded1bf0413d0ec5285b79c9afc48bf5c52108df32298ba3298a078faf67342e86
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
2KB
MD51e32ffe3fd1b0408ca4bf6de83f3c8cf
SHA1e4d9d07f744d44a89b627520444dc6bb98a517e7
SHA2566d0de43307b4342767e8fa7495ef233d59e28cbeabb6297eac72f7d62987cb5e
SHA512e46c197f5ac974cfa701984c9b35a85c0c3285aa60c0604e027d353cae6ae5c5ff1ffebc018011b69614d89d570c845010fb451b7e0f09130645005ca183632a
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
11KB
MD5a3f1953221e254fa4ef2eb24d65939bc
SHA1ee1df9ca38421d33f9aefaaedd541bd6aee34067
SHA2568d6b60a963df0926deae548493f041a59ae118466e399ef1ed025231b308fcda
SHA5123d669d68035fe16ccdcf1db5747f1d8dbdcfd55a4dd9446d869bed1903243077cc1ba35d54b5da1a4880926d151482aca7484b4505e18004c0126032c7e5c4bf
-
Filesize
30KB
MD57f0d32c26835ba8645081001a57f63c5
SHA12c82706a4d5cc2921f7232188730646c2c00d546
SHA256d4a8ac3fedaa9c0fe42ff36348b856d7be982d318ce2eaa01fcf50752a30c004
SHA5125ea5a4a0ad998d8aeea1aca987c036be3c2f9cbb10939ad6c7f2cfcf5ba8b8844919f4b203b757675e03936d9acc76f43c8bc950982b156f3ede83565f8d3671
-
Filesize
72KB
MD501902c8552a4d9766e2f954249333bb3
SHA12ed52a8e517dfa0703645ff7c9bc5ef1f078407d
SHA2565420ee2bdf57ddf27fc34f585e3b9bba82ea40f978b40e9b9992513defaf3f9a
SHA512207554adaed10d757a2dabf7dc703f0ac7beaba4795c0e1968d2e673495d8aaacb594f9123376ac17bb2ce4682c9da80fd3ca0b14690e85fe5e355c2b2cd08d7
-
Filesize
63KB
MD5de230a3e1d566c5d56dec39ec1a8788a
SHA11cf1ce707727232d315b31f27f83e126ce90ef36
SHA256d8afd4ec4cc35f5624e25f559b9b684d0d7d5ddf25720834f2ef13c851d881bf
SHA5127791b3afca162b338e7a9b2a50c577a7114c393f2c00e2b066eae0574850893a63a446e12fcf81680e59b88964be5de684c22a83c6f82bf6f0414d7f20a13384