Resubmissions

21-05-2022 11:43

220521-nv2f6aebg2 10

Analysis

  • max time kernel
    3873472s
  • max time network
    21s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    21-05-2022 11:43

General

  • Target

    f1358f3f898b94b1978adb900614ec29809073d4e6d87ae0d8fcdee9bc2e2e5f.apk

  • Size

    1.1MB

  • MD5

    7d10305381f160edad0e07150adb8476

  • SHA1

    9696327cae5915a556274e48ce394dc06b7310eb

  • SHA256

    f1358f3f898b94b1978adb900614ec29809073d4e6d87ae0d8fcdee9bc2e2e5f

  • SHA512

    07ccebfeaa4d4f897b0b303ada77575aca996694826fbcc80f9743eeca130a211cb0e4c6d8da3fc460ddd6edbc7b6ff1c39861c980b802fa498e101f5a1e1d6d

Malware Config

Signatures

  • Agent smith

    Agent smith is a modular adware that installs malicious ADs into legitimate applications.

  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell location.

  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads the content of SMS inbox messages. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • herd.zmwah.tnccjxq
    1⤵
    • Requests cell location
    • Loads dropped Dex/Jar
    • Reads the content of SMS inbox messages.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:5196
    • /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/herd.zmwah.tnccjxq/files/one.dex --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/herd.zmwah.tnccjxq/files/oat/x86/one.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5442

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/herd.zmwah.tnccjxq/app_jar/lpdf.jar
    Filesize

    35KB

    MD5

    e1ab911d4b585a26aae02d8540575013

    SHA1

    ac148f7bdf95edddc97d9224ff51a771f1070520

    SHA256

    8a71fab57b4a03f0b37095daa2eaa086ec6ed6c1c6166ca67c0e0a9e14cc85ca

    SHA512

    983ec12cde3cbfaffb414b8c8eb17c793bee558eb51b9d5e630f9bd5f312e0ce55622719aad6097a799286c25001212b26d7053e7e110a4918beace33d3bcbc4

  • /data/user/0/herd.zmwah.tnccjxq/app_jar/lpdf.jar.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/app_jar/oat/x86/lpdf.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/app_jar/oat/x86/zdfc.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/app_jar/oat/x86/zdfc.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/app_jar/zdfc.jar
    Filesize

    37KB

    MD5

    d975ba5ae6b7007b97d64b347e64d5a7

    SHA1

    b071799508ba075b7db27c36882cce8a913395af

    SHA256

    868642bd739f6ed6f15a7073c45158eeb4d7fb12b38ddbe8a0133444ffaad9b8

    SHA512

    ad3787c2fad325c27e488f460f9db58d1f0f081fbb5c105ab942cdf942706c28daaa5d6c674ecf5bae5b0e3595a6f7eef8ac95a9d0a35fcc66b370333ab52fb3

  • /data/user/0/herd.zmwah.tnccjxq/app_jar/zdfc.jar.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/app_webview/Cookies
    Filesize

    64KB

    MD5

    cb7543c4df600f2af58097cce0e334ba

    SHA1

    83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

    SHA256

    64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

    SHA512

    ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

  • /data/user/0/herd.zmwah.tnccjxq/app_webview/Cookies-journal
    Filesize

    1KB

    MD5

    a73f2651552cc4b2fae97e569b2cf3e2

    SHA1

    91436d49cd8e393a5ff1f8e3f2ca044d70f2d930

    SHA256

    4ee262c565c1001281513484871d3f07e6390290dcbdd6c752ebf1e17aa6a20e

    SHA512

    3c4866aca46293961ab54955bfd8a9a8d2d2c431e941f5dc5d711b00fb6c487ddc622586f6cce465e94284812434d8027155d673c6253898785b792a9911baa1

  • /data/user/0/herd.zmwah.tnccjxq/app_webview/GPUCache/index
    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

  • /data/user/0/herd.zmwah.tnccjxq/app_webview/GPUCache/index-dir/temp-index
    Filesize

    48B

    MD5

    f7e25ce37cc9016de53ab82a1d4b9c79

    SHA1

    38cad3ede57a1e023ad7a9ed73fb0ed28a86146f

    SHA256

    ffe4d448ae6b3a53b7e0fcedaac647f35e405eb8f1349781f91217430895c196

    SHA512

    1dadb361426ffe50ef782c37ac97076630450fa4af4987999ff3824b9b453b84091782caa02eb2d9c773a767b8e44aeee7df3d601692da66116c4884b3431cb1

  • /data/user/0/herd.zmwah.tnccjxq/app_webview/Web Data
    Filesize

    104KB

    MD5

    dc79f9ce5f3ab5270b33e61119dfc959

    SHA1

    1844bf222a5144b513dcf2fb50a18c011701c647

    SHA256

    47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

    SHA512

    18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

  • /data/user/0/herd.zmwah.tnccjxq/app_webview/Web Data-journal
    Filesize

    1KB

    MD5

    af3b5ad461e0a36acc7b03067d1f5664

    SHA1

    b70cedad339833861185cf1a6c6183a51d541981

    SHA256

    27ab628bd360b23c9841afa4b669ba9d4bda732b0493383515b0d9d25b80a056

    SHA512

    634c36f653581d220cc7f3827ef2bdbba42a4220008940baa4b66f4450d6f7142ba1f9eaa52eb89d360c0a34c5100cc2e284646f59a5d0015557b536ee71924e

  • /data/user/0/herd.zmwah.tnccjxq/app_webview/metrics_guid
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/app_webview/metrics_guid
    Filesize

    36B

    MD5

    ab44a27390bcbd7212d00a88da46dac7

    SHA1

    793c19f5ab090799f1072e8ab1d2271779b184e1

    SHA256

    12f7d2086f1b02cb5c32d08b00461dd570499f690a5a266c339a8d26af09a52d

    SHA512

    480f353f08300e5b53654a6775f1a1de762858ed260a935980e9319cb003406dc6b2cd18348e5bdbb7bb754ac95222a28c67713779fdf3d75c71da126ee4eb39

  • /data/user/0/herd.zmwah.tnccjxq/app_webview/variations_seed_new
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/app_webview/variations_stamp
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/app_webview/webview_data.lock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/cache/org.chromium.android_webview/321b96f4c21f6427_0
    Filesize

    110B

    MD5

    67fead22ad18180be95fd6e459d6fb64

    SHA1

    65ab97c7fca2fd7ea101525be9ed9f0ebf300785

    SHA256

    74dcfb8e2d02fc5643cb788735a35e76d40ce4b931afb54a06880ab9e6d06efa

    SHA512

    9b898ee6ea67acdd2339a5d6fabc0fc8ac846bd9119dc2e1660dfb2fb0d28c3063c22ab779ba39ed3532e19b8d3e17401f144facc083989b74c383e705774361

  • /data/user/0/herd.zmwah.tnccjxq/cache/org.chromium.android_webview/5c91c981181bdfa4_0
    Filesize

    40B

    MD5

    58440c07bbb93226f9289cdea21c653a

    SHA1

    d33c0697bf814d9ef1f58fd109025df0c74eba7e

    SHA256

    b69cbecd7fbecc85ccfba9f2f601aedf114f4686b6eca48bfeb72af2220f51e7

    SHA512

    a24b4c2529ec7bf3d5a514c90245f68a84a12773ddbd49e444fd84e64131763686ca078d56859a361aeae2b95c9141ab870e611c69034fd5470e22ef12ff51a0

  • /data/user/0/herd.zmwah.tnccjxq/cache/org.chromium.android_webview/9e3c2dac3550838b_0
    Filesize

    42B

    MD5

    ead91c62fab3ce6e497e8e744d7b5aea

    SHA1

    7b8342aa6f60e33b2dde920b508570d5190ccc14

    SHA256

    ed0ee1d89e626b830de0bfd80056bc88c61979e5e1de2caa70b0a5a5aa28fc9b

    SHA512

    97dea420cc38f843418a2d904f0f856417882de8dded41a4d3429a70563e612f7615311c3bf328953ea18c3dd108fff2e9c09e0bdd8d812f1082ce4c8ad30879

  • /data/user/0/herd.zmwah.tnccjxq/cache/org.chromium.android_webview/db2dbc3b4a572a15_0
    Filesize

    48B

    MD5

    364fb94c1e8e5785c04d3bcd075a068c

    SHA1

    80b6eda5217406ed0e5ad7071e22f81939909227

    SHA256

    0a64e9e86a1028d58ca7fd919ee703c6e85d531a3bd2ed21d81ae9d316aa4570

    SHA512

    da9233f9f59dfc3c7f0efbb4e5d24c87a76eccb24531f01c1c838c7821afe2cf2d98994ecbcc3020a911d0653b0b45a727e9c50111fee052407674d55747c632

  • /data/user/0/herd.zmwah.tnccjxq/cache/org.chromium.android_webview/index
    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

  • /data/user/0/herd.zmwah.tnccjxq/cache/org.chromium.android_webview/index-dir/temp-index
    Filesize

    48B

    MD5

    2941dafdf19ee0cce69cb02ae24ed325

    SHA1

    4be18b6806785f3ad9db01f4834845c3e6d92a1a

    SHA256

    5670582f87e5c2a782727ada3f4c89ce3edd8b41d360a02bfb37a24901479afc

    SHA512

    783ffec9f24b47dda06aad12fb8ec098d5b058ab2973b4ca1e97374c2b012ef14e992dca6b4b644bf466d0311350da6b1b34c6500241196b5690fcc2110d223c

  • /data/user/0/herd.zmwah.tnccjxq/files/beacon/comp/1.jar
    Filesize

    71KB

    MD5

    b50ec0cc46b99c26250d1bb787ba2fed

    SHA1

    73352ce0e370c1e0e54f8456a5ba4a1996ba3566

    SHA256

    685e1d0de3e1adaec20a531153d2da3724fb53a88d6e4d009b856721a2b8bce6

    SHA512

    272d4ee7d4adb5dc1dc4ae9a0a3ffdecb25d460813040d906151704ece167c4be8654ba936e1716c69a357b84a63a737f2fbebcf223f88ead71b6dc110afa5b6

  • /data/user/0/herd.zmwah.tnccjxq/files/beacon/comp/6.jar
    Filesize

    7KB

    MD5

    740da537d28e32d8d4a97bf500fa2e51

    SHA1

    6577926b6ec08ec773c87462388a9683c66126e3

    SHA256

    ba687a019040fbe7b354328d5352504063f75801961c0c4874d73f2189737373

    SHA512

    bd47155786e088ad0b2180e32bfc820cf3888b451c077cc8bcfded921d435f13aad766fc26f93ffb67bb42be82f5f45f117abed4959e24e208ef151186361dc9

  • /data/user/0/herd.zmwah.tnccjxq/files/beacon_cover_check.lock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/files/oat/one.dex.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/files/oat/x86/one.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/files/oat/x86/one.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/files/one.dex
    Filesize

    59KB

    MD5

    1b5c4ae7e385db4551ced8c19386abe0

    SHA1

    12d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4

    SHA256

    8211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70

    SHA512

    f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b

  • /data/user/0/herd.zmwah.tnccjxq/files/one.dex
    Filesize

    59KB

    MD5

    1b5c4ae7e385db4551ced8c19386abe0

    SHA1

    12d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4

    SHA256

    8211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70

    SHA512

    f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b

  • /data/user/0/herd.zmwah.tnccjxq/files/one.dex
    Filesize

    59KB

    MD5

    1b5c4ae7e385db4551ced8c19386abe0

    SHA1

    12d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4

    SHA256

    8211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70

    SHA512

    f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b

  • /data/user/0/herd.zmwah.tnccjxq/files/one.dex
    Filesize

    59KB

    MD5

    1b5c4ae7e385db4551ced8c19386abe0

    SHA1

    12d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4

    SHA256

    8211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70

    SHA512

    f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b

  • /data/user/0/herd.zmwah.tnccjxq/files/one.dex
    Filesize

    59KB

    MD5

    1b5c4ae7e385db4551ced8c19386abe0

    SHA1

    12d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4

    SHA256

    8211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70

    SHA512

    f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b

  • /data/user/0/herd.zmwah.tnccjxq/files/one.dex.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/herd.zmwah.tnccjxq/shared_prefs/WebViewChromiumPrefs.xml
    Filesize

    127B

    MD5

    21223e9184445fe043476484cd8cb1f9

    SHA1

    2b4813f849121d60ba35eb0889080668bb62c778

    SHA256

    bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

    SHA512

    be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48