Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2024, 23:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://r20.rs6.net/tn.jsp?f=001NYHt_gJAxl6JlMDvhDMDYms-PfvQ6xp_WHLpNFre5d7gIGfpNULiBbTKsqoqDJqKRj8uZU6uorjV78K24owm1WXSHJO-A-bd4CJz53ssCva61TJjUeLvRqRidWk4mh23LkS14QItGZuLDl36p0GwEQ==&c=&ch=&__=?YYY.4h38-.cmxlbnRlbGxAbWFudWxpZmVhbS5jb20=
Resource
win10v2004-20231215-en
General
-
Target
https://r20.rs6.net/tn.jsp?f=001NYHt_gJAxl6JlMDvhDMDYms-PfvQ6xp_WHLpNFre5d7gIGfpNULiBbTKsqoqDJqKRj8uZU6uorjV78K24owm1WXSHJO-A-bd4CJz53ssCva61TJjUeLvRqRidWk4mh23LkS14QItGZuLDl36p0GwEQ==&c=&ch=&__=?YYY.4h38-.cmxlbnRlbGxAbWFudWxpZmVhbS5jb20=
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133505260000575361" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 700 chrome.exe 700 chrome.exe 1792 chrome.exe 1792 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe Token: SeShutdownPrivilege 700 chrome.exe Token: SeCreatePagefilePrivilege 700 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe 700 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 700 wrote to memory of 4920 700 chrome.exe 88 PID 700 wrote to memory of 4920 700 chrome.exe 88 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 2336 700 chrome.exe 92 PID 700 wrote to memory of 1412 700 chrome.exe 91 PID 700 wrote to memory of 1412 700 chrome.exe 91 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95 PID 700 wrote to memory of 1220 700 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://r20.rs6.net/tn.jsp?f=001NYHt_gJAxl6JlMDvhDMDYms-PfvQ6xp_WHLpNFre5d7gIGfpNULiBbTKsqoqDJqKRj8uZU6uorjV78K24owm1WXSHJO-A-bd4CJz53ssCva61TJjUeLvRqRidWk4mh23LkS14QItGZuLDl36p0GwEQ==&c=&ch=&__=?YYY.4h38-.cmxlbnRlbGxAbWFudWxpZmVhbS5jb20=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffbb079758,0x7fffbb079768,0x7fffbb0797782⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:82⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:22⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:12⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:12⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:82⤵PID:1220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3908 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:12⤵PID:2388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3176 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:12⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3940 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:12⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4604 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:12⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5196 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:12⤵PID:688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:82⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:82⤵PID:4248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5724 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:12⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3780 --field-trial-handle=1952,i,15777569684696683836,32320919562326917,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1792
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD549b26abb5eaec5aec01b61d38bad539d
SHA1c45fc25d49aa7edb9ecf68c0403353ab4871efae
SHA25649bf75787a422ed003729514ef715f2daae1dc5e2e5922b2a447b0eedbf1b20c
SHA5124a91c4867b294b5bbe1adb1eb4f66597f87d98f336149e6d752df2d1bf6d7400246c0a460f664251940847d224448d130862b46fd8869e6fdad9a140bb6bcb17
-
Filesize
2KB
MD5bc28e08a6dfd5c1fdfc4742568129278
SHA1d0ef5df59ae2d281939eaa70dda2c84ffac69539
SHA256cca4f19ac689c384a993ff47748ec566ad98551c1be5e4613ec2c4528349e8d8
SHA5126687fa7c9f7ebbc4c2773df0329244e494d3a0c9d510192dac282e6be2de46f567ee085c8bb29a2524b7ac3c9b613db7d3d62d2723f75961d023ed35e868b4ee
-
Filesize
536B
MD5ab07efbe460f8573ddf43723e66983cc
SHA187b113aade332823b0a248bb8e792bca38ddc32b
SHA2569554b19eb3f9fb484fa05a9ab9b0a007ad3c7a7184567ae3f5349aac5b157bea
SHA512449ff8fcfd8bbbe80de21c78a3adb942b30dedff1c36f23726b7dcebaa75b30734d2c21050cb9ffe42fade2375ee9313d8a2b8a312589f86ce732131ae16db23
-
Filesize
6KB
MD5663efeb58c40b3b21fc40a9fc4412a21
SHA1e74c3a24d1d677a07bb91a2b44169a42168c7b8a
SHA256b1554bfed36939b4e9ddf9829629eae6930f678873c0a5aa71a5c610515f0910
SHA5121f902ba3c9adf22a389a7c5dd1c88a083bdce9a0ee3b9cb36fa7512787e4281df977615606f910cb8a2fae525d135f836c0352a2baba5b0b08b6581175e47d14
-
Filesize
114KB
MD5ab253798592253f3a73d0fee945007c8
SHA144d98b048902fb9ec051aaeb55aa2874ce6f4b80
SHA256441ecaa363c38ebe3bb4b1e9f7a0eb48813958c208d69efe2ec4e47aae388b37
SHA5120bf81f276767aee500fdc9fee306cedc7cd1e49798952b832f027c4efee03c71f1f9f4220b26ffe861ca4480d19f8a4196812b8085c686ac04937709bdae1f10
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd