Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2023, 17:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAA3AAABLblqZhBYlRHrzecMfzS0L350WpXV-OSurOkxseFulRYbRI8QqpzTQyAdXEw6WCADC_HoCUIs5tPBb8lcz_-CBuUBATIG&
Resource
win10v2004-20230220-en
General
-
Target
https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAA3AAABLblqZhBYlRHrzecMfzS0L350WpXV-OSurOkxseFulRYbRI8QqpzTQyAdXEw6WCADC_HoCUIs5tPBb8lcz_-CBuUBATIG&
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133226831111218412" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4344 chrome.exe 4344 chrome.exe 4716 chrome.exe 4716 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4344 chrome.exe 4344 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe Token: SeShutdownPrivilege 4344 chrome.exe Token: SeCreatePagefilePrivilege 4344 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe 4344 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4344 wrote to memory of 3048 4344 chrome.exe 87 PID 4344 wrote to memory of 3048 4344 chrome.exe 87 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 4900 4344 chrome.exe 88 PID 4344 wrote to memory of 5088 4344 chrome.exe 89 PID 4344 wrote to memory of 5088 4344 chrome.exe 89 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90 PID 4344 wrote to memory of 4372 4344 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAA3AAABLblqZhBYlRHrzecMfzS0L350WpXV-OSurOkxseFulRYbRI8QqpzTQyAdXEw6WCADC_HoCUIs5tPBb8lcz_-CBuUBATIG&1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9578e9758,0x7ff9578e9768,0x7ff9578e97782⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1816,i,15229946316130055482,11213892267449509129,131072 /prefetch:22⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1816,i,15229946316130055482,11213892267449509129,131072 /prefetch:82⤵PID:5088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 --field-trial-handle=1816,i,15229946316130055482,11213892267449509129,131072 /prefetch:82⤵PID:4372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3180 --field-trial-handle=1816,i,15229946316130055482,11213892267449509129,131072 /prefetch:12⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1816,i,15229946316130055482,11213892267449509129,131072 /prefetch:12⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1816,i,15229946316130055482,11213892267449509129,131072 /prefetch:82⤵PID:1988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 --field-trial-handle=1816,i,15229946316130055482,11213892267449509129,131072 /prefetch:82⤵PID:3488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2792 --field-trial-handle=1816,i,15229946316130055482,11213892267449509129,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4716
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:820
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288B
MD55dcaab28efce40de9ce9fb4a61c1be85
SHA1c84162dc2b346edbf759d3a169166ec658bab054
SHA2560eaa795153a9df233cd1f985ec0fa37da576109029920fa21d24e8b11c3e5669
SHA5127f0f325f37fce356ccc319fd5b61e2b3e821addaf8cf2723d2cb1ebd90273eb7ec73b75fc43054d94ebbab5363a1b403ca29a1625623fa9747ee16608378effa
-
Filesize
1KB
MD5fd3b4393c59971f8be91cd211c6056e0
SHA192b0083c98c13dd03c8be30a54a46cc640539d20
SHA256ddbf82273a1e8ea294afffd120ac3e9c856b6c95a2c98442eb32a9180147b192
SHA5122fd4a152fc3c16790b159c6827891e535f9bc7e1c38b84ac4753a23f6abe07c6a8ee1eb0bbc5f3fe5389fc1a00d38db22c7d7e6ac1f58d10d027c5af3bc4c7e7
-
Filesize
1KB
MD5b20c78cf7bb0859c1a67bbbcf32f43ae
SHA18ad1da7f535f0d2ee8d76e36914e246b8cf2ce64
SHA25657e5010a6880e520eae7ee1f9a3fd34b2e6e814677522ae4b6a8361673264b47
SHA512a9562acc100f6290f43e12865587a4ae084c7b0b92146fa2dabc1fc6c7c4dfda144bb91fc8f68688c06ffeebb01311ac2f31b2cda5212b9e38482380091d9aff
-
Filesize
1KB
MD5f60c8a38e74169335fa9b0cac506b324
SHA1e64229537dad35daac4ade8cf2902dc4195dbe48
SHA256857fd94f3ade4eb9b66602eeb2cb9a93d9145bf7fc2fd1d550512d9e7a740c6b
SHA51234d6da1821e97e0b3627aa00ef5e9831f7864355fc9408411a60fe936a406c88d3f90902f7693c4e69068c242a9e20e7c28f39ca6b7de484e14001918ac8c3cf
-
Filesize
1KB
MD5926d1f2dfb65a244a6c8cf3720c99010
SHA1c858886e42e16dabe7f9ba7eb976301e4ce82fd2
SHA25621be6bbadb7239a285e29a04626ef67fbca4159418a91b793fa3a0c7a8e72c2c
SHA512c392c1eaca7bb2819a8cdfd2578bb50729ea8e45e2e4b267d0b46259d2a9e2ea881eed4d3609cd3a741ef7007a5344ba2032ad7391f03e083ae1f468f0fc23e8
-
Filesize
5KB
MD5c047d09ebd137640912263843ec98d81
SHA154681fa0d096cc3bfeca302bf650b3ffd4650b8e
SHA256c2f747c9ab5037eda73ef76832a7ca9158e18d1b48c38f72671ee5ccbf1f9725
SHA51274a5c1b3c6f636e7bed9b615b260afc9a689ab8d15be132897a430931ba0d5a2f29b95b3b6cd6392a6bfafbb18b6c684ac00102474468ff2217e8c89f085d49e
-
Filesize
5KB
MD5ea9a98513bf909aedd2130fab1337005
SHA1907c5e1eac47b657cddcd9f02017d746edc00c13
SHA256495d503cfe773bea85ac1b2a64f3b61d372c781a55a746392324e2f0cda8e8f3
SHA512fb541304d72637b2e40f3be104415b4ce9da74bb01e3e1140b0ac7dfd29ac6061a155b3c565f5bdd35cf6d399d352857e8ed8db9eb62ffdfdecfe6f19c007155
-
Filesize
6KB
MD5c949df56423134fc07245198f235041c
SHA103172431176462d73e944a93b21fa6b3ec3135cc
SHA256d7fefe0efa4fbebb5426a4f5354566c7310ed19f0bdd920f4087f3260ebe1513
SHA5125a59e78657f9d78ea14836369bd7d26c519ac2d8f86ae98d1f6fcd718fe60e393ea7e338265ae34e792fec3257e1386de4bca5e8da66ec9889bfd441f144f9e2
-
Filesize
5KB
MD50588bc9ac3bafffb021da26ff8199c3c
SHA1c578328dff142a0c6b8f826471338e6ab84e18a3
SHA256a650ea81f28b99d5ce8a5b4f77750704fdb625b67d0f4611747e47020491f8f3
SHA512a7219483d0b612f29bab07a7aa1b838443bcc2db9c8ca69ff3199678fa11b1db1e8cc5dc9d031027edb3f5cf601ab983811414e238ef85c5ed439b37c3e7ea6e
-
Filesize
6KB
MD5964e6d596db8cbfe875cff051bd1c090
SHA112cf73a87b16ac283b439e70752830c4be7cb60f
SHA25686bbceaa7fa8b67fbb455ff8ff4905f7d8651b841edf00ce73ecf0998b8b1fcc
SHA5129cb03d57947edf4a7b0eb177d23fbdc17aea486b274bfe358f3f596e4dd5ee401133b1bb5deb1785a07692d7c2477ad538cd908267926f14b6af3b72b1f5eca6
-
Filesize
143KB
MD5de3b4c9c3f85614ef8c3782e9c676281
SHA143c1ed05e759e4b00956e7b52b9605f375727818
SHA2560833e7a5dc10d16dd7c42dd35b87c489f00f5a2dde4b70b3817fbdf02740ffe1
SHA5120824ab32bb34e7d70ea37434fb870b44b63eab5df5a4c3289329d25309ead4a32113f017f50fc3541a174bc95e0a8bd7e29e906672b394c77cf1eb67394da093
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd