Overview
overview
10Static
static
10Aurora.exe
windows10-2004-x64
gui/Auth.html
windows10-2004-x64
1gui/Builder.html
windows10-2004-x64
1gui/CHECKER.html
windows10-2004-x64
1gui/Dashboard.html
windows10-2004-x64
1gui/Loader.html
windows10-2004-x64
1gui/SETTINGS.html
windows10-2004-x64
1gui/assets/docs.js
windows10-2004-x64
1gui/inlog.html
windows10-2004-x64
1gui/jSnow.js
windows10-2004-x64
1gui/jquery.js
windows10-2004-x64
1gui/log.html
windows10-2004-x64
1gui/nicepage.js
windows10-2004-x64
1gui/packed.js
windows10-2004-x64
1gui/resour...pd.xml
windows10-2004-x64
1gui/resour...ws.xml
windows10-2004-x64
1gui/resource/dl.xml
windows10-2004-x64
1gui/resour...in.xml
windows10-2004-x64
1gui/resource/no.xml
windows10-2004-x64
1gui/resource/plus.xml
windows10-2004-x64
1gui/resour...xy.xml
windows10-2004-x64
1gui/resource/yes.xml
windows10-2004-x64
1gui/script.js
windows10-2004-x64
1gui/snowstorm-min.js
windows10-2004-x64
1resource/R...er.exe
windows10-2004-x64
1Analysis
-
max time kernel
64s -
max time network
69s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2023 23:02
Behavioral task
behavioral1
Sample
Aurora.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral2
Sample
gui/Auth.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
gui/Builder.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
gui/CHECKER.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
gui/Dashboard.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
gui/Loader.html
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
gui/SETTINGS.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
gui/assets/docs.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
gui/inlog.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
gui/jSnow.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
gui/jquery.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
gui/log.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
gui/nicepage.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
gui/packed.js
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
gui/resource/dashboard/pd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
gui/resource/dashboard/ws.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
gui/resource/dl.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
gui/resource/domain.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
gui/resource/no.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
gui/resource/plus.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
gui/resource/proxy.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral22
Sample
gui/resource/yes.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
gui/script.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
gui/snowstorm-min.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
resource/ResourceHacker.exe
Resource
win10v2004-20230220-en
General
-
Target
gui/SETTINGS.html
-
Size
45KB
-
MD5
7fe962624d5dd78fe50e9000547f6d7d
-
SHA1
be9aaea6cd7093697da01500502f1822979d91f6
-
SHA256
910b01ae62ac0c3e71e3a037341e7fb72b22bc9c57edb41c7c5418dac2db8e75
-
SHA512
30ed130e18fbadc90e9f05cfd00c6f54274b002a164e540b1e2821e44640c2d897a7aa994a68137e69f320dfee97bd13e80addda66c3fb180909cd2cb76e8132
-
SSDEEP
192:NNOcf0Tazjt+WOZl3bCprc8zHWP89YD8KMn+JnOUnVwnB6nDgn3iKt5qNH0MqPCX:Ncc8azjt+WSXfH0MDTmq3iMXGZQxCG6M
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133267718027979117" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1496 chrome.exe 1496 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1496 chrome.exe 1496 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe Token: SeShutdownPrivilege 1496 chrome.exe Token: SeCreatePagefilePrivilege 1496 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1496 wrote to memory of 4496 1496 chrome.exe 86 PID 1496 wrote to memory of 4496 1496 chrome.exe 86 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 3908 1496 chrome.exe 87 PID 1496 wrote to memory of 4056 1496 chrome.exe 88 PID 1496 wrote to memory of 4056 1496 chrome.exe 88 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89 PID 1496 wrote to memory of 3960 1496 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\gui\SETTINGS.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1dbb9758,0x7ffd1dbb9768,0x7ffd1dbb97782⤵PID:4496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1820,i,1539495986684303883,17967936058264242604,131072 /prefetch:22⤵PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1820,i,1539495986684303883,17967936058264242604,131072 /prefetch:82⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1820,i,1539495986684303883,17967936058264242604,131072 /prefetch:82⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1820,i,1539495986684303883,17967936058264242604,131072 /prefetch:12⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1820,i,1539495986684303883,17967936058264242604,131072 /prefetch:12⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 --field-trial-handle=1820,i,1539495986684303883,17967936058264242604,131072 /prefetch:82⤵PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4828 --field-trial-handle=1820,i,1539495986684303883,17967936058264242604,131072 /prefetch:82⤵PID:744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1820,i,1539495986684303883,17967936058264242604,131072 /prefetch:82⤵PID:2976
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1460
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
873B
MD5765b95199e0ce0ca69429f32a8c9fb8a
SHA18247ec7dc6c9daf8e90c17366240ef27bda0c28d
SHA256096e77cb814f58869694c5cb9df094664699f0d3e8148d4b1976db49ea18acaf
SHA5124d445f47166c360860092b179cdc7decfb4590932b2f283854e41c7671bf50ebe08c1a1defaa94bd7ea6b793e38a4d827cb371131aa9f7a9b4e3694c30f64399
-
Filesize
6KB
MD55e7e84a82e6e23b642add7c37fd8b3cd
SHA1b69762cdfaa88a5bd73eaaff8b0f7dbce92ac929
SHA256cf2f116589c60039ded9b92d7446205dc12987ba1f546f4c6351287daf3e177a
SHA5122e3e76a31ca0b2a511cd3b163cc96736ec6bc3fce813744b5d11e38cbd91d665436584fdc924447872e634fbea5b12ff224f23890f5792ad52a791d2531bcf04
-
Filesize
6KB
MD5da0aa25e39a27317dd14282bf938990c
SHA1c6bdc60ec53583728085fecea91545dd808dd21e
SHA2561145ab896c6889faf672928bd6d23370b70b8ea5760981b4929d0086d53ec467
SHA512ea76a860bb239e5866c35a4a4db562b36ea32e2f10f1d6935dfa1a70d3bdd5e4cfcf380d89c25e736e416bb7bbf47030022875b7ee25a7a08897decc8a8f6f9b
-
Filesize
15KB
MD5629d5320d589e14f6b2897fffb260377
SHA1f2b7511cec4fc2b2b1ef14eb92b771361a411bb5
SHA25638b90c903d9ac7b5da004278dc3b92c9496f6ec57beb17e2a06cd9e2b7e6dc4b
SHA512f27b959f7b78145623e7b56672fea7b462c4f8ebd81b0242a1c99126ceba771d4528cf2ebe49fd7923badc607e15e4dce8f719a25565db428fc1bf77247a4e89
-
Filesize
200KB
MD582a44f47c745a28ef301fce75789682e
SHA148e8373dabb93353ce78024b4b64c256a6979182
SHA2564a036764dfa60ea0154c8d4a01f716b5daae98af0810991d03171754c11a87fb
SHA512fe6a5df24e5579310f5ce8dcb7df8de839df344db8d4b10e4568d550200e5b9ac384c974cb1a687828457c0c5e65ce50780f4e7f1d82f8144894419459513202
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd