Analysis
-
max time kernel
77s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-03-2024 06:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bucolicmason8460.tumblr.com/QRUBpeX
Resource
win10v2004-20240226-en
General
-
Target
https://bucolicmason8460.tumblr.com/QRUBpeX
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133547000400478481" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2264 chrome.exe 2264 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2264 wrote to memory of 3148 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 3148 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 5080 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 4600 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 4600 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe PID 2264 wrote to memory of 1248 2264 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bucolicmason8460.tumblr.com/QRUBpeX1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe08ae9758,0x7ffe08ae9768,0x7ffe08ae97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4616 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3684 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3948 --field-trial-handle=1868,i,2861993986225051356,8410228087747365449,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
216B
MD59de152bd9fb19d4b16957b8080b17499
SHA1493caeaa38e10cfd57fbfa2db533bb4a29d8b72d
SHA2568d6d804b6c59cef612276c719206cd7098d3bd639796ac8f72c9289e9c52d8f8
SHA512f789728debbaf96cab6d24e98bc4ee0fba6d72d89dc046b6d6335a7f4e9e874872509d6a1abf753dc1660f5d5281bdb350220d03bc2480defcfbd9c7daac2450
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
408B
MD5e94cba48ce24e99dc07152ae1380b2cc
SHA1aa8f3813dcfd1ea4c5a118ac8f1c5120e9b2f0bd
SHA2567af4ec3136809ef85bcd1167070ba880903b2b6907f50dcb8fbc764eb386f665
SHA512f6ae7082354b7afa446f49d718da2517dc24cc59658a04df804f94dbccb9650ad383518c7f221b8e46dca85f95057cc8182ef718d792faa54767dbfbe066c1b6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5a737d02ff74f9497e6a330230e4244c1
SHA1f91eccf1f6cc0429080204e5a9a3a6e2597ef729
SHA2564d0fb2bb30fb9ea31ac616390b103fd3e077c62f6a59add62cf708add560623c
SHA51294395d7402ee0699c3266553d3d28027ec95b69b85c3a26f3acff6451be2c1c7c1e0f762cc38bf0584fd4c73492f909d690cf13814be756a7d7fca05ce05b1e1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5e64eacaad73cbaf06d27c624000f07d8
SHA14e18537aaf7edb8c98f658fa40568b5b69e9084d
SHA25653beca9da8d79adaa37710f9c40e34aa6b14e68879fa376fe45facaa71096e32
SHA512567332f02f1dc9ae5396125db657146413fa859a1ffef2efe7845e308b45f6774dbd15fe86e9b9409753da5ec247b0276f5e2bfb78dc7928350d6a912ea82607
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD59a1dba7774e4677f87aa59da5c70bb7d
SHA17a7bd7d6ed5ab1d8c5acbf206017c1fa7e73a74d
SHA256cd1e70171c95973e18cbe74f2c82dd3dc83a2997eefdc408f1348039a1915bd9
SHA51296c05e6a573c4070edb71e491657403a70531d8f76d2b0f9aed4735ae408467cc669ddefa34db0cb5ae97709f47c72ca2559b44b4d355b80124c44bdde8431b3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD57ce8682600d680d75c6a07e149b169e7
SHA1a6e1c88c4b164a362ea6d899e2b913cd4ea0153b
SHA2569f8ba07540b2ee77536c827edbafa7d42ad034be1bb2f6bf1078fba32bd0e4d5
SHA512b7a14694c1d34a4fcad185c52d3f5a880f31a8139b29050e1285354279538a96ecaa634b4b5260501a4aa446fe437d41839ba4187ffb77b887a9e02737273d9e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD56f59a4f78749b4c5f5fb38219db58c08
SHA1d5902cff61582b2e86774b8b52c020e283f3140e
SHA25672f36006c784ed5241f669cce9ec2faa74bd83729ccd6d7ddf9bead09338592c
SHA512c3b1032afa32a3df5b20105f1a8ba35fec8c263d9a50be200278f9cf88e1d0714f4ab685dfbbe95e4727da6512f0e1697abee45e7eafae3ea4045af3485b117c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
128KB
MD500cf55c42c96b196d3d3d7064dd6c6d8
SHA127139988632eac8416575a768cea9cb37bdf9338
SHA256ea0eaa307b3beb0b0b4d7d0bf9bb3ec019a064d74e4198fcf8dfa491e8dd0342
SHA512644411d4060908d0b186499809c93194bf7a4564b6e947222a234c4d885bb0da508bddc46f9cc098906c66c4b9474b0332b94bcd495abf23f0c2c469b0b6ba21
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_2264_BYHLBXRBXVFMTKLNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e