Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 00:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nezur.exe
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Nezur.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
Nezur.exe
-
Size
7.8MB
-
MD5
cc950ea8c02c620601f65b9048c4df74
-
SHA1
ec7caa93fbdf813cb67f14ac956ab91633a09e4e
-
SHA256
64bf358b68cb4ef856218f985948a4a196797007fa2643473902fb94c1c4198c
-
SHA512
d9971e2597f3f3ab7ceb04274a8628ce9e5dc3364619ea01db9cd8b613aa52c067cc39f136e0e7ba10f8dd3b8ad0e110e3e67c26d164e41e53f9fcb3ee569b0f
-
SSDEEP
196608:C/xEEFlhbjsCmaaqULXNfwS4IlJ9aY43kP:pwjsPqUDeYbav0P
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133629715507252379" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3064 chrome.exe 3064 chrome.exe 3052 chrome.exe 3052 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeCreatePagefilePrivilege 3064 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 1712 3064 chrome.exe 88 PID 3064 wrote to memory of 1712 3064 chrome.exe 88 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 744 3064 chrome.exe 89 PID 3064 wrote to memory of 1164 3064 chrome.exe 90 PID 3064 wrote to memory of 1164 3064 chrome.exe 90 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91 PID 3064 wrote to memory of 3668 3064 chrome.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nezur.exe"C:\Users\Admin\AppData\Local\Temp\Nezur.exe"1⤵PID:4732
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa7f8ab58,0x7fffa7f8ab68,0x7fffa7f8ab782⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:22⤵PID:744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:82⤵PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:82⤵PID:3668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:12⤵PID:3448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:12⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3600 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:12⤵PID:1448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:82⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:82⤵PID:1192
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:3604
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7675dae48,0x7ff7675dae58,0x7ff7675dae683⤵PID:3620
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4724 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:12⤵PID:1228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5044 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:12⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3252 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:12⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3348 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:12⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2384 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:12⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2704 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1852 --field-trial-handle=1912,i,544893570803489814,7971031957861386782,131072 /prefetch:12⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5bf2fd948e79dc3782412c5c748a88309
SHA1dfe6242ea7e6a67106f043a68bce3578e7a03cc0
SHA256e41176f541f6c29f3fadb3dd529dcc1192a3081ce19ac87021f20ff019ef75e8
SHA5127a9bf1548241e02a3b50d9822762d70a206023d7ade875a75938c9b628e71a2f14650c9d55d3d93f669b63a2ebba59c6143f03f53670e817172a6f948deccc15
-
Filesize
7KB
MD5a5ccc620b533df2ca060e87ab83bc37d
SHA14fc13b65bfecf54c59c92fd76928410e2b70bdb6
SHA256b32b2e2285a8019f2b0bfb49e989ca10bb7af4af3b5fecc2ce68011f7ea215a6
SHA5126df1b4bb20374d92d5de241ef1eba9742ba2cc3baba24ccd225184774f61bfaa942b5d9a6e13f256bd6ecd67853a278b426d172eb35303ec2ad1543a98e567c8
-
Filesize
255KB
MD50a6e7c247d8b94971d12858df2e71844
SHA1676a4f098644bfdd17a4621cebb0bbb6eb89d9e7
SHA256ab7c1d5330028957701fd8f7afb8e83cf27a7e9774ff094a686286d83cc06323
SHA512aa024b632c56f97bcc2958c317e5a3617786e5428cbdbd95cd2ee0183b56ad39eeffc9b95af080d063ec29cba8d01ba7b3ac743031dc082988ce29a467d9dca7