Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
54s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 15:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://click.email.thebidfinder.com/?qs=883b4b7dc52d89fffc0d035ee2a5edf8bfb37212a5a25150652970aa1ff9a3c2f04c524b7a5ea06a384408e4c5f65d2a1d1d6b7b519bef2f
Resource
win10v2004-20230915-en
General
-
Target
https://click.email.thebidfinder.com/?qs=883b4b7dc52d89fffc0d035ee2a5edf8bfb37212a5a25150652970aa1ff9a3c2f04c524b7a5ea06a384408e4c5f65d2a1d1d6b7b519bef2f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133419445503853575" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3564 chrome.exe 3564 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: 33 1340 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1340 AUDIODG.EXE Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe Token: SeShutdownPrivilege 3564 chrome.exe Token: SeCreatePagefilePrivilege 3564 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe 3564 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3564 wrote to memory of 2120 3564 chrome.exe 38 PID 3564 wrote to memory of 2120 3564 chrome.exe 38 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1164 3564 chrome.exe 92 PID 3564 wrote to memory of 1668 3564 chrome.exe 91 PID 3564 wrote to memory of 1668 3564 chrome.exe 91 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88 PID 3564 wrote to memory of 4796 3564 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.email.thebidfinder.com/?qs=883b4b7dc52d89fffc0d035ee2a5edf8bfb37212a5a25150652970aa1ff9a3c2f04c524b7a5ea06a384408e4c5f65d2a1d1d6b7b519bef2f1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dc059758,0x7ff8dc059768,0x7ff8dc0597782⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1904,i,15138449707891666251,6921302981007930902,131072 /prefetch:82⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2944 --field-trial-handle=1904,i,15138449707891666251,6921302981007930902,131072 /prefetch:12⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1904,i,15138449707891666251,6921302981007930902,131072 /prefetch:12⤵PID:912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1904,i,15138449707891666251,6921302981007930902,131072 /prefetch:82⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1904,i,15138449707891666251,6921302981007930902,131072 /prefetch:22⤵PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4904 --field-trial-handle=1904,i,15138449707891666251,6921302981007930902,131072 /prefetch:12⤵PID:4256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4736 --field-trial-handle=1904,i,15138449707891666251,6921302981007930902,131072 /prefetch:12⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3152 --field-trial-handle=1904,i,15138449707891666251,6921302981007930902,131072 /prefetch:12⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4588 --field-trial-handle=1904,i,15138449707891666251,6921302981007930902,131072 /prefetch:12⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5328 --field-trial-handle=1904,i,15138449707891666251,6921302981007930902,131072 /prefetch:82⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 --field-trial-handle=1904,i,15138449707891666251,6921302981007930902,131072 /prefetch:82⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 --field-trial-handle=1904,i,15138449707891666251,6921302981007930902,131072 /prefetch:82⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1232
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a0 0x33c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
864B
MD557fc4065ed615d9ed1ae740807704727
SHA143bae4523d4ea1db8895e953437ee8b7b3d1544b
SHA256da7f05c991afa81a3dfb869fc88ef8dc9b0d365c5c5a746c40d0474b57d89249
SHA512bc742b807598ed9d889d4d559a01120ead3bea56d3dcfe1bfc6ca24e31de0b2d97cf95669d1a987476851130310a202f6f3b953e30c235f166f09fe9ef628e49
-
Filesize
1KB
MD55ee593af47c64bfabe1049238b5f0b96
SHA13150d572634f40e1ee9aa32cd717685a54333d87
SHA2561aba72dd56b93738552d5277157d3c4ee56bcf508820fe85b2442a90d2354cdd
SHA51251c37637e0f34aedd73951f97c040a8ce29d425a691474a4406fcd13872973353ebe775fdfe33fd76229ec0c2628d23ffe2cee5b3978253fe142cd93f7048a4c
-
Filesize
3KB
MD5071d8c8ff12697c380dd685e50f80155
SHA110b96e7a076dc4d756775db846c8e3d1f426a850
SHA256513c4dd452a6ba0ca4b4a5f1cbf2098215cb3af4a79fc745a5fbe6df58e75dd5
SHA512a6b005e1eb971f9082268cd1a64980909d2aa9576b684d9fb4c648db58211fd5bc78296ad12701ce050e3424e4296f212da12387b9bdd02d89992cfbf07a1d8c
-
Filesize
3KB
MD5cd48ccf91a2aede0bd131bdf34b1ecaa
SHA15443e19fdeb50ff21af12e0fd53b6ab5cacd4961
SHA256dfc4dc92f9ec794e7f9bdeb355c4da23ab708ca4348bf1c0b81953a37f3c48c4
SHA512361ce5b01cf4abb3c2f205ff66da9ccf2a888e30a31e2949b0168f5740bad1db15a5d903493348c17f02dd4f5bf88e31f26f4c7aafb773570caf4c1ce5c7bc0e
-
Filesize
6KB
MD5b3bfd8bc69cbbe03d77a6bf4d378f167
SHA110505edfc74529d562812469d3611d54b365c07a
SHA256b5fe83103287b1683c4f1bbf0e1c83e4970b5b278513a43c4adc978001b59314
SHA5123c4813d757bcd08dfcd189a7d0d9dc46b25a0a5136e14719db0d28bddd470214cbb201c588ede12d24638469f3dc42af82f021b5c297036626cc04ba5aab06ec
-
Filesize
6KB
MD59354ef2e5c827d60ead7bdc8f1999fc4
SHA1ce82c725503d5da01a6bcd3df4558fa923b7500f
SHA2565b82c7854af860fcca67b8fbfb4f80681cb8a8b68bdb7d8a36bdf20e41271d54
SHA51240fb577265400a59cacf53f0a21754df9653640dfa26a67bb9bae3b2aa4cab463bbf14dd0f8ac1017367fed8e1c292c08b0b878487979e2d7d06e154a70fb6e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\db415bfe-b638-4999-ad4b-375e8c546aaa.tmp
Filesize6KB
MD5b1da962627f7e615da147055b39bb006
SHA1d6b2a4d21b108ccdf024517d0c8bdc1f1f1872bb
SHA25640a034cb358d6923868682a7ca0dbc6be137a002bc2b9dc0e7cbee99d403b673
SHA512ba79b74906d8508a26704a7989a95eae66b60ac88349ed6788bd92a14e3ae95b17f9a1331fe8cdc831410f4c87d74f59348885711e8e871edb1e33cefd3367a4
-
Filesize
101KB
MD5904b0044d25e2b646f72ac3be32936f2
SHA15ff72f10ab56dfc7610e473a0775a11241d89b89
SHA2561e657205227e8f647442c87cfafbb32c5537d1fcb25f34ae3ea6c8ebca215e32
SHA512706dfdec35db2a069903d6a10daee84be9c22712322d85b15a784df3466e52249457b215d8bb0a63e33b764d1b893dcd3dc7a7f27fde5c25ccb1363ec81bfddb
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd