Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/06/2024, 14:26
240606-rr1x1agc93 706/06/2024, 14:23
240606-rqb79agc63 706/06/2024, 14:19
240606-rm83tafc5s 7Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 14:19
Behavioral task
behavioral1
Sample
AntiSkid.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
AntiSkid.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Spark Clicker.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Spark Clicker.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
SparkCrack.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
SparkCrack.exe
Resource
win10v2004-20240226-en
General
-
Target
SparkCrack.exe
-
Size
1.2MB
-
MD5
729ef11bb843517bef3f097e4d5efea2
-
SHA1
f691eb21e61535662ed588957ad798fa3f21098c
-
SHA256
821ad7168deab1b2ff27f81298a9c3029ffe138a9d9ff2e4d66be4dfe369f5c7
-
SHA512
f26ad252ac200031e151a31c11851fd306e435ac445070a622a3b860106a59c637764c11fafa37a23cb1da5444e2467940bb60723f9df0dc571f1aef3e6c0e17
-
SSDEEP
12288:JQ2ujPpZeET9mJwTI6v3c/GNg0KwBtzvwVyDQ8C05Ka+33UMAxpBO+3SgCeWG8EP:JnujDeExbv3c/YjF5CwJO6SgCidKK1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133621573005377548" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3724 chrome.exe 3724 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe Token: SeShutdownPrivilege 3724 chrome.exe Token: SeCreatePagefilePrivilege 3724 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe 3724 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3724 wrote to memory of 3560 3724 chrome.exe 107 PID 3724 wrote to memory of 3560 3724 chrome.exe 107 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 4816 3724 chrome.exe 108 PID 3724 wrote to memory of 228 3724 chrome.exe 109 PID 3724 wrote to memory of 228 3724 chrome.exe 109 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110 PID 3724 wrote to memory of 4068 3724 chrome.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\SparkCrack.exe"C:\Users\Admin\AppData\Local\Temp\SparkCrack.exe"1⤵PID:5016
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2628 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:3232
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2864
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffed6c59758,0x7ffed6c59768,0x7ffed6c597782⤵PID:3560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:22⤵PID:4816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:82⤵PID:228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:82⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3260 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:12⤵PID:1252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3284 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:12⤵PID:436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:82⤵PID:4432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4064 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:12⤵PID:3668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4644 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:82⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5028 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:82⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5216 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:82⤵PID:1708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:82⤵PID:4952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:82⤵PID:4020
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9e5b5074-3aa6-4646-be5d-827d76984312.tmp
Filesize5KB
MD59a2442ac6f028104d276087fed97cda2
SHA158f3b3605c2e81c70602edba76270ca027bd20c2
SHA256feed698fb21c56590fb50ac0cb8e8d831030cf289870670facd012324b142d80
SHA512749f2d269c9932ce247ccfb3165608eb6fdda8900a5ad824e5188e61a2aec0d01eed01b5d2e8461291f4b7c0fad45b2173c96d2c0a1f3180255ff4d813d2b880
-
Filesize
1KB
MD5e65cd2173384173c4cf8fee1c304a121
SHA1bc81d468127aeb6083efd2d4b3b0a4ace7a2119d
SHA256aba4e61b238338b1067ac43f51bb2bdb42f89ea3ecbe02b10053230bc9708b9c
SHA51245326c2537c3fc4cdf80a8d480c93817414e44511a2470fb2460c525bc81cdc5090bdc6eebe77413086543f146120be072a5abf1f2cb7e403dedce556c07db77
-
Filesize
369B
MD54dcc6aef969b248e5c93a61e5c5d5cee
SHA1c92665bd97dbcfbc4332e81c2ab127175deab2c0
SHA2568faeaa5aa0b4d27241212e18e383000a3a2a6a00df926143a2a199026f45464b
SHA512c2c8e5cb38bde10134f80d9610c4be8eb5a39ea46c90b46d309f6837ae2ab2cb68bf3abb718ae6ee9dde37ee7a9adf3074ad463d22cafb360387f83664a05c9b
-
Filesize
5KB
MD5700d123c5974d86ecfe6f4c4e9fa4498
SHA134669e30842d652ed79a4d73101e0e8ce95a9406
SHA2563482f04845e5a7174538791fb66495abd90719a4ecee445eac2aff5199c4d8b0
SHA51210bb053bfc735f0fdd3e5adbf478e787cdb43b7320b56eb249731bdea8963c4b85166881f5ae4c229c29c2b64a7058b9eb48ecd6d29b622048117d11a6217972
-
Filesize
5KB
MD5e061c3b7700c403712f7e469b65262ca
SHA19c00d24d5fa00820127f39acdc438219855a2fe8
SHA25674fbeaa3d584fdfb97afbbfc4810251cb58a1bcd140a4e73cbe27cd238095df4
SHA5120de80889da1b7120484e49ff1d4f9a54792459e59b3cdb579d12b162516970c60dd65071008f9e8c72dda6a5fea1bd8a0a0ed4ee2f8c123e20fff7c813e55875
-
Filesize
271KB
MD5b3ba5d9a7708a540d8e0f79dceb8354f
SHA102b4675b91124f3ac6207bd320e9f6c7a01e9a52
SHA256b34287e420cae1e96edae49dba7974a6e47da38349b879ceaad96d25a70919a2
SHA5129bc1e78058ddab73e3e1a3143c870da8b22e22e805bbc2e1c14068f6fdbee0f0fdc0ec9103ff769990f70967c51c3a6d2fd05dc86d829915a8b8bec27f00ec1a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd