Analysis
-
max time kernel
60s -
max time network
70s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-de -
resource tags
arch:x64arch:x86image:win10v2004-20240226-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
19-03-2024 09:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://go-link.ru/oX8ZG
Resource
win10v2004-20240226-de
General
-
Target
https://go-link.ru/oX8ZG
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133553147741888534" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2640 chrome.exe 2640 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2640 wrote to memory of 1540 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1540 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4892 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1344 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1344 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 1588 2640 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://go-link.ru/oX8ZG1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd4a759758,0x7ffd4a759768,0x7ffd4a7597782⤵PID:1540
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1888,i,16118690912666527899,13587255545125826223,131072 /prefetch:22⤵PID:4892
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1888,i,16118690912666527899,13587255545125826223,131072 /prefetch:82⤵PID:1344
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1888,i,16118690912666527899,13587255545125826223,131072 /prefetch:82⤵PID:1588
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2824 --field-trial-handle=1888,i,16118690912666527899,13587255545125826223,131072 /prefetch:12⤵PID:2032
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2848 --field-trial-handle=1888,i,16118690912666527899,13587255545125826223,131072 /prefetch:12⤵PID:3872
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4600 --field-trial-handle=1888,i,16118690912666527899,13587255545125826223,131072 /prefetch:12⤵PID:4884
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1888,i,16118690912666527899,13587255545125826223,131072 /prefetch:82⤵PID:5344
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1888,i,16118690912666527899,13587255545125826223,131072 /prefetch:82⤵PID:5428
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 --field-trial-handle=1888,i,16118690912666527899,13587255545125826223,131072 /prefetch:82⤵PID:6032
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3392
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1816 --field-trial-handle=3052,i,14101965100160104665,10748268734329554182,262144 --variations-seed-version /prefetch:81⤵PID:432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD58347dced13ef2a5923bc694594109cb5
SHA150bc64ba4d19c257eb5744a2f261da32aa646554
SHA25606634cab1311645c16a063146c7af921b1765a9604501a3867bacf7ea15a37e2
SHA5129bc9c4fa4df53a2fa66933be229225795bb9e9692477433ecb47895a1e45712a69e04ef328163dd5a11b2c3f1a3fa27ae377cfd3d0545c3aba582b2ef1fbde06
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
537B
MD5768b57111a09ac7b50525b5697d48f13
SHA1335e894f06b179735d47335a3f4752a6ccd83b34
SHA25641dd5f5e7c712acf2045e6ce5b7c16a6c19e0b88a85debb158e91ba317703f30
SHA5124c9cb2f61815afb3e12890003033f762c59279a069c8126f76407c54cb268766b151511496716edc628ce41148c51f1a3f105855549184ac7c01f4e4fd220de4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5437ed1d91ef27c101da6bb4920ff61f6
SHA1b3c9c36ace3c1aa1c23c4ed89e2ed67e4d381c36
SHA256b1c87a260fdcedf7d516c83403d0ef8a91b950e94870a7baa00e3d916337a1a4
SHA512d894e42ab65007a55c9fa080c93475b69d09e62f9bd39a323448bbf8cb660da388e2a4d9603f8a3126ac364cbb723216e3cdfed2e6ccff0a952ed1e3f686e20a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD51c1522ebc30f304789e29f8df29a51f4
SHA1036ac70a72c6e3291dd25b79125e3ad20f40b65c
SHA256d04bc89f5ffedcb83f62b28aa43503f2ff665b90245d5931207235f1eaaa2459
SHA512e27a570869282ba2124bfefb155194d0eef4e2acf7ee04b5361ac232fb71e4a4d1c383c439eeb9e39c43c28c9bd28cda7f4a7682f0ddc28ee14e1e86f36dad36
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
253KB
MD51918ccf5b60419bb5e01a4f1d3b01e61
SHA11541cc70f7d70e8a7e1822a4a401d3beab59b1ee
SHA2560b9e5fd116c132ce297f62c25a585233029cac13b3740638a71d48c32aa9ddae
SHA512d4821a5cd905db8c02f4bfdb342960bd7757385f7673620730b1d6aa2cad45f7f6f932481601e0f08f00edd9550ede87d01b600230708d1d761289af1976a5b0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
103KB
MD5ad76711bbe3b52da196af5ed7b12ec78
SHA15dc5402dec317ece2c8644f40e9a9939a2247c54
SHA25650cb5ab8e9633aeb0ec0373125f8772c01301a72d539dbbd7fd0f3b4900533ff
SHA512662ba7e721a0c945c4c31b56e674d5171a23c99e67123733bab6e0ea96f1249f3b09ee6e47c9d2588ff0b2d50be238f50a6c5e059a281ec215199a523152c32a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57e918.TMPFilesize
101KB
MD58b13321658d9633ae68aeca96e96c712
SHA15e9757fbdfce4707eeb564943d441949df8dea60
SHA2563f5c0fd7e60aee8dc7d5e36b49dca8d37b22e40477578c1e271f0d6f8a2a7c6b
SHA512200f9cc24b330eb3bfba95f6ade2e3151190a86c316c399f69d904c601ff80fc1a18ba8fae738ff99cfa7b8ba9269dfeb7152740fa4fb4e96cf6f784283bf5d5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\??\pipe\crashpad_2640_KQMNUMHWLTEEPRECMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e