Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 20:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://pesa-track.evincloud.com/vendor/phpunit/phpunit/src/Util/PHP/xx2@/app/?client-request-id=[[-Email-]]
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://pesa-track.evincloud.com/vendor/phpunit/phpunit/src/Util/PHP/xx2@/app/?client-request-id=[[-Email-]]
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133639945729085744" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 432 chrome.exe 432 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3984 wrote to memory of 3080 3984 chrome.exe 80 PID 3984 wrote to memory of 3080 3984 chrome.exe 80 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 4300 3984 chrome.exe 81 PID 3984 wrote to memory of 940 3984 chrome.exe 82 PID 3984 wrote to memory of 940 3984 chrome.exe 82 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83 PID 3984 wrote to memory of 2356 3984 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://pesa-track.evincloud.com/vendor/phpunit/phpunit/src/Util/PHP/xx2@/app/?client-request-id=[[-Email-]]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe986aab58,0x7ffe986aab68,0x7ffe986aab782⤵PID:3080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:22⤵PID:4300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:82⤵PID:940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1924 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:82⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:12⤵PID:332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:12⤵PID:2616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4372 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:82⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4092 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:82⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4340 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:12⤵PID:3536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4132 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:12⤵PID:2668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:82⤵PID:1692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:82⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:82⤵PID:3068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4596 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:12⤵PID:3708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1568 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:12⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4016 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3376 --field-trial-handle=1956,i,8648998483137421648,6771328888155197964,131072 /prefetch:12⤵PID:2160
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:8
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5f2dc1bda35fa42d4a20806955e2b893c
SHA18c599ed92652217a3a1f8b0f962c96d71cd6c64e
SHA2560d15cb356b53ff41547d97fd24d1c551359dbdcc7961d38186e182bc7568c764
SHA51257647cd4f5350d5cd5694ee69c3f95915a147cb7901536a153d0ccb4e0a00660907c2d0d4e135537f45d1e97bd7ee8756553934cd4341d6ff732e91d4602a1ff
-
Filesize
257KB
MD5728d5ca7620ca37a59b764a07a5417de
SHA1485609688a43b7830e34307b53cd54e455d61af3
SHA256518906c8fa313c3547845744e828cfe2e13f1d1813fc2edb343acb6f6a5ab955
SHA5120070405c826d52b2c361544a738b502774a7d3879c687ad118ecd2971e94fa944b07676e1eea72a9dafb83ce09a8673c4405908a99195dbf674938c234177c64
-
Filesize
257KB
MD5b2c7f1e80a89f311ee02d0ec41f30ec0
SHA1e99ecd8aba20e5c6b70047232818ab90cd443b57
SHA2566f5a1f55accbd42148a9a6b764023215ef66eb7b84db0084d38ee3ab8c2bb685
SHA512e86ac0cda2ef4149ad951b0b1cdda77426b0870ec46b4b327f2d85da91b0e6463448bba9458704a7d6b39a06ba3ed3fecbc88ccd72671446b45db416b3146431
-
Filesize
91KB
MD526354ba65e831b6adf663a96220117fe
SHA1d645a80a599e28ce4ef204aa5e26339c97fa7f3f
SHA256aad0ac66bb44069bbb83c6b6cc55c79ea6630c74b854de1967e4ae72c1aeb7c7
SHA512f6416c08f742c8d6ae0cf054aff2d8fd9e90b8d2e6324eb17e00f3dd2c9edf2d854a6b353d4d93800c8418aabf0da286b377e1c3910d31a14cbcc1ba439b01e6
-
Filesize
88KB
MD5d525d4df7ff5298a9de196e29eaba149
SHA16e76100e6571473e3f93cc1b349458441b2501c9
SHA256ab4a93f002df10f16058cf576bcead778413c3390aa1fe19e31831f07e410562
SHA512b86fb8ff652674c68a5ffbf35f620937c66b1a4ab6e2e1d1f491b5c31a2cd97679f6067b1f63e6f0d3fb9c9c285c1e59702bea6f83c401a77dbfcc8c48c30082