Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1200s -
max time network
1172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-es -
resource tags
arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
02/02/2024, 14:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://072h6.mjt.lu/lnk/BAAABSMCo6UAAAAAAAAAAdM6FiMAAYCsm-gAAAAAACOJOABlu7HgPIStqQg8Ste74n28Bf8UZQAhTkM/1/6FntaRzL12WlSY72w7VlDQ/aHR0cHM6Ly9leHRyYW5ldC5odWlsYS5nb3YuY28vc2l0ZS5hc3B4P0NvZGlnbz1FRjBBNTM3Qi1BQ0Q2LTQ4REMtODUxMi1FRTI2QjgzNDY4NzImcD0vVmVyTm90aWZpY2FjaW9uJklEPTE4MDY1ZWI5LWFjMzktNGZlMi1iZWZlLWJlMTkxMGU1M2JiOQ
Resource
win7-20231215-es
Behavioral task
behavioral2
Sample
https://072h6.mjt.lu/lnk/BAAABSMCo6UAAAAAAAAAAdM6FiMAAYCsm-gAAAAAACOJOABlu7HgPIStqQg8Ste74n28Bf8UZQAhTkM/1/6FntaRzL12WlSY72w7VlDQ/aHR0cHM6Ly9leHRyYW5ldC5odWlsYS5nb3YuY28vc2l0ZS5hc3B4P0NvZGlnbz1FRjBBNTM3Qi1BQ0Q2LTQ4REMtODUxMi1FRTI2QjgzNDY4NzImcD0vVmVyTm90aWZpY2FjaW9uJklEPTE4MDY1ZWI5LWFjMzktNGZlMi1iZWZlLWJlMTkxMGU1M2JiOQ
Resource
win10v2004-20231215-es
General
-
Target
https://072h6.mjt.lu/lnk/BAAABSMCo6UAAAAAAAAAAdM6FiMAAYCsm-gAAAAAACOJOABlu7HgPIStqQg8Ste74n28Bf8UZQAhTkM/1/6FntaRzL12WlSY72w7VlDQ/aHR0cHM6Ly9leHRyYW5ldC5odWlsYS5nb3YuY28vc2l0ZS5hc3B4P0NvZGlnbz1FRjBBNTM3Qi1BQ0Q2LTQ4REMtODUxMi1FRTI2QjgzNDY4NzImcD0vVmVyTm90aWZpY2FjaW9uJklEPTE4MDY1ZWI5LWFjMzktNGZlMi1iZWZlLWJlMTkxMGU1M2JiOQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133513594874941771" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4496 chrome.exe 4496 chrome.exe 4780 chrome.exe 4780 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe Token: SeShutdownPrivilege 4496 chrome.exe Token: SeCreatePagefilePrivilege 4496 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe 4496 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4496 wrote to memory of 2216 4496 chrome.exe 84 PID 4496 wrote to memory of 2216 4496 chrome.exe 84 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 1028 4496 chrome.exe 86 PID 4496 wrote to memory of 3400 4496 chrome.exe 88 PID 4496 wrote to memory of 3400 4496 chrome.exe 88 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87 PID 4496 wrote to memory of 2184 4496 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://072h6.mjt.lu/lnk/BAAABSMCo6UAAAAAAAAAAdM6FiMAAYCsm-gAAAAAACOJOABlu7HgPIStqQg8Ste74n28Bf8UZQAhTkM/1/6FntaRzL12WlSY72w7VlDQ/aHR0cHM6Ly9leHRyYW5ldC5odWlsYS5nb3YuY28vc2l0ZS5hc3B4P0NvZGlnbz1FRjBBNTM3Qi1BQ0Q2LTQ4REMtODUxMi1FRTI2QjgzNDY4NzImcD0vVmVyTm90aWZpY2FjaW9uJklEPTE4MDY1ZWI5LWFjMzktNGZlMi1iZWZlLWJlMTkxMGU1M2JiOQ1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeaa4d9758,0x7ffeaa4d9768,0x7ffeaa4d97782⤵PID:2216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1872,i,10981746416907656721,351706535553680944,131072 /prefetch:22⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1872,i,10981746416907656721,351706535553680944,131072 /prefetch:82⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1872,i,10981746416907656721,351706535553680944,131072 /prefetch:82⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1872,i,10981746416907656721,351706535553680944,131072 /prefetch:12⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1872,i,10981746416907656721,351706535553680944,131072 /prefetch:12⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3920 --field-trial-handle=1872,i,10981746416907656721,351706535553680944,131072 /prefetch:12⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1872,i,10981746416907656721,351706535553680944,131072 /prefetch:82⤵PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 --field-trial-handle=1872,i,10981746416907656721,351706535553680944,131072 /prefetch:82⤵PID:3208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1872,i,10981746416907656721,351706535553680944,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53d1371916228b2077f39516bacc557af
SHA1b81ff8a928e294916fdc77bb3f2d71abd07b2744
SHA256f10c8d33f44ccc9923159249e11d6e2ff65b1a090d4ab5e1984782847b915521
SHA5127ad82d0a82ec4916d3aa679e33cd58d0221fc42c4a7e10143c9b2c2f93e84c71601c7595e422945a064858a0fd17a96b5a041eb9f4f685a92b2b07fa2df7e16e
-
Filesize
1KB
MD5954ed4f83242d0cb55117ab955c1574a
SHA19c32cad5c8f69a683abefb49afa2694647f12e5c
SHA2563afa55227726bf8d14eb188db2a0687ac740e2d30c521d32eeb9b44c07d905ef
SHA51225cff22e708ec4fd804d452abef6121730a677972100f95869cb47ba136795de75bdde26bfc422c962e3d50c238c8e70822abc7031bac1c129919f3f6f92a58c
-
Filesize
1KB
MD5b488804683f6abf91a3f0716f4ea55d8
SHA151ed1a0f6e5378b38219f223560c7ba31b48b057
SHA256700b400c14c6b2c78397e2aed442d6095d0cf3279ffcbb220195457aaa3674dc
SHA51296c85f016b12383598c4c19546f8f8889ca465df8599e01cdd3ca68c16355162ac0a12cf3e6a23b001f3ea508f9c2b1964010923817b0344f0dbe57734781e2f
-
Filesize
1KB
MD5a56df7fb4b97b2f284500172506c5194
SHA1cc7058023ad79a9a88e8324e51612a54dfb98c25
SHA2567f74bd7b3656c2d28528690ddf8c341397f3b8fc59b60dea7a2b0a31028d6caf
SHA5121bc5081db5ca476ca834801b2155e76e8e8b5e0ea4696a9c0bdb4da183d480c2fd18fc5640d6db7be25ac4c3081e9b8fac3429fa37faf311dfb5b496e065b5ff
-
Filesize
6KB
MD5a6456f022dc44e6278ff854b66f26b45
SHA1feb04b0505646cef5f88fe55106f3907dc128494
SHA25654d6f7a632974bfb06e98008fed328abb955717119e519bc54b38c55f1a889a5
SHA5123a5f38932eb7a88f19ac3d43bbd4ccf606d46049f806a278206d00495d5e48db93aa1603efeda4faa237fb21e77c539bd01da91e6e2bf7f454389e7b24d38421
-
Filesize
114KB
MD552e22661f606d2be39a6402963ebb0fd
SHA178cd226a0e8520bae94062f764d188575461ebb4
SHA256d403a271516311151907636dd49fe87293fa82c2076440a922999477c168fe3c
SHA512e357eb852bebd00de4ad8a2d4b23bbfbae26447416b27bd06c2eace655dfc5de68265f879f9b950858e17a73a4534c95a1b7e2c1cbf1336a0d8c0427dda5911d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd