Overview
overview
10Static
static
10Aurora.exe
windows10-2004-x64
gui/Auth.html
windows10-2004-x64
1gui/Builder.html
windows10-2004-x64
1gui/CHECKER.html
windows10-2004-x64
1gui/Dashboard.html
windows10-2004-x64
1gui/Loader.html
windows10-2004-x64
1gui/SETTINGS.html
windows10-2004-x64
1gui/assets/docs.js
windows10-2004-x64
1gui/inlog.html
windows10-2004-x64
1gui/jSnow.js
windows10-2004-x64
1gui/jquery.js
windows10-2004-x64
1gui/log.html
windows10-2004-x64
1gui/nicepage.js
windows10-2004-x64
1gui/packed.js
windows10-2004-x64
1gui/resour...pd.xml
windows10-2004-x64
1gui/resour...ws.xml
windows10-2004-x64
1gui/resource/dl.xml
windows10-2004-x64
1gui/resour...in.xml
windows10-2004-x64
1gui/resource/no.xml
windows10-2004-x64
1gui/resource/plus.xml
windows10-2004-x64
1gui/resour...xy.xml
windows10-2004-x64
1gui/resource/yes.xml
windows10-2004-x64
1gui/script.js
windows10-2004-x64
1gui/snowstorm-min.js
windows10-2004-x64
1resource/R...er.exe
windows10-2004-x64
1Analysis
-
max time kernel
62s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2023 23:02
Behavioral task
behavioral1
Sample
Aurora.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral2
Sample
gui/Auth.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
gui/Builder.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
gui/CHECKER.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
gui/Dashboard.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
gui/Loader.html
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
gui/SETTINGS.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
gui/assets/docs.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
gui/inlog.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
gui/jSnow.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
gui/jquery.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
gui/log.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
gui/nicepage.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
gui/packed.js
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
gui/resource/dashboard/pd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
gui/resource/dashboard/ws.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
gui/resource/dl.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
gui/resource/domain.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
gui/resource/no.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
gui/resource/plus.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
gui/resource/proxy.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral22
Sample
gui/resource/yes.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
gui/script.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
gui/snowstorm-min.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
resource/ResourceHacker.exe
Resource
win10v2004-20230220-en
General
-
Target
gui/Loader.html
-
Size
27KB
-
MD5
53b77ef10f8580f43e5c23ac6f50dadf
-
SHA1
5330303de1b34eb091de895bc91fcf22da33d94b
-
SHA256
3239679b3ff2d5e397670ec59e71c28826fd0c63d8cfeb350ea15dd2e9cfaaf4
-
SHA512
2c38ab2f36ba6f3ae6f76b8458b6ba75b18eb24b16499de4731a743377cda1e9cd08563731518c1cc2ac4bb3467c43654690a383d7cef1ebf61b7a94c608f5a6
-
SSDEEP
192:DaCOxrP7PFPOWW3+l3bCprc8zHWP89YD8KMn+JnOUnVwnB2nDUn3iKt5nu0MNq62:DaNxrP7PFPOWWOXr0MuWj7pgQ56JK2CM
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133267718019651513" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4432 chrome.exe 4432 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4432 chrome.exe 4432 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4432 wrote to memory of 868 4432 chrome.exe 75 PID 4432 wrote to memory of 868 4432 chrome.exe 75 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 2808 4432 chrome.exe 78 PID 4432 wrote to memory of 4124 4432 chrome.exe 79 PID 4432 wrote to memory of 4124 4432 chrome.exe 79 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80 PID 4432 wrote to memory of 4620 4432 chrome.exe 80
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\gui\Loader.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc12a9758,0x7ffbc12a9768,0x7ffbc12a97782⤵PID:868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1792,i,11870492694587231422,14108431451972411908,131072 /prefetch:22⤵PID:2808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1792,i,11870492694587231422,14108431451972411908,131072 /prefetch:82⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1768 --field-trial-handle=1792,i,11870492694587231422,14108431451972411908,131072 /prefetch:82⤵PID:4620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3224 --field-trial-handle=1792,i,11870492694587231422,14108431451972411908,131072 /prefetch:12⤵PID:2708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3244 --field-trial-handle=1792,i,11870492694587231422,14108431451972411908,131072 /prefetch:12⤵PID:1944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1792,i,11870492694587231422,14108431451972411908,131072 /prefetch:82⤵PID:1692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5080 --field-trial-handle=1792,i,11870492694587231422,14108431451972411908,131072 /prefetch:82⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1792,i,11870492694587231422,14108431451972411908,131072 /prefetch:82⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5020
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706B
MD511364d7346a86ca4e2294b83efe5d40e
SHA15e04dc1c4c96c78aeb38d166dc7a1b53537eff5f
SHA256df9d8d86058df05bf8bdb8b23713905825f26d1208bce98de6be9210fe74e394
SHA5126dbf63cfffd4ae8a259f5322dc174bc03873c7df97c0dafd4856b242be78ab4aa2d3d8a3ece04081b79fa1dd679760df58a70fe99ed733e64076bc0ea9bbafb0
-
Filesize
6KB
MD5c0f8b169f6e278d43fd62579419f45da
SHA1c1e391a5859f304da97dbc68fa6775e0a1dbc357
SHA2560e747d9c5f2e7c1810bd246175f4b9ae18b09b598b0b283570c88fc30e837227
SHA51291a41e431cb9c9760c6252fbcb21f0f334a5afe86383c86c49561e3c38fc1d4b189f64c1ec0941889319d7b0be68194f46ab686c30182e6cea16caa10cb8fe94
-
Filesize
6KB
MD54e6152b50b673d2cffd6733128acc258
SHA198d591a974e239038ff639b59931151258a35df6
SHA25617fb822b2b8c8df03b1729d50f3ad50d9d519308dcf73eb82849678f5bd2c725
SHA512b4f0ed2e494235c883763b55458a99c4612779ff8e6ec97d32eb92b4c633b29afeb4c838991b7f6faea322a65eec1da6c9d4d80f1c6c6fe36a779188b7cf17b9
-
Filesize
15KB
MD5f82b90c51e2a97bf5d7ed31638e8bcc5
SHA1537648e4d469f40bcc31c15920825e2165745b67
SHA2564b260990b82ab7c5090ffaf73c5a0e0ced613e12b754af48111235597622d7a8
SHA512d89c5a94c79ab85e5ec6c7e9ca7e7b82db5f149aa2c5fe70c994b1fee5de970b4870e9715c89e23d3cb128cbc9d6a49b12801c80429030a702b8d9409d12775c
-
Filesize
200KB
MD5d7f36f6d3d9fb3ab6ece12ddfda0bc68
SHA1c02b09249ccedffc51558c1d696b228dbde97d3c
SHA256a7114182ab9e6c72b5081b8c5fce20be6a1f8b8aa3f3486b6c7c19c17e7673e9
SHA51266b81eb7c612a5725104721caee406b3e5c1f17b843e3080ecc7352e5342ed058bf70293e38c48ab33de3b11c1b3f50a9f0820f7752dfccc3e28bfe25aa0836c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd