Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 03:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mail.golnanet.com.br/5nlo7cihf82/index.php?zKnBg=ogyxssgz2170-mcbx113333636-578ph2-1719rwy80wor2706
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://mail.golnanet.com.br/5nlo7cihf82/index.php?zKnBg=ogyxssgz2170-mcbx113333636-578ph2-1719rwy80wor2706
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133642769539890647" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 1908 chrome.exe 1908 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4276 wrote to memory of 1016 4276 chrome.exe 81 PID 4276 wrote to memory of 1016 4276 chrome.exe 81 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 4564 4276 chrome.exe 82 PID 4276 wrote to memory of 5056 4276 chrome.exe 83 PID 4276 wrote to memory of 5056 4276 chrome.exe 83 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84 PID 4276 wrote to memory of 5088 4276 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mail.golnanet.com.br/5nlo7cihf82/index.php?zKnBg=ogyxssgz2170-mcbx113333636-578ph2-1719rwy80wor27061⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80fb7ab58,0x7ff80fb7ab68,0x7ff80fb7ab782⤵PID:1016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:22⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:82⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2216 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:82⤵PID:5088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:12⤵PID:2332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:12⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:82⤵PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:82⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5108 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:12⤵PID:2344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4948 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:12⤵PID:3356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:82⤵PID:3608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:82⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:82⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4840 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:12⤵PID:4240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1576 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:12⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3588 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5016 --field-trial-handle=1808,i,5327171039737070991,15234421409756785390,131072 /prefetch:12⤵PID:4956
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5f88d0a6b9a2eec497a3aa93444062416
SHA16ac03a7517edda01a6904aae891830e60d7c9df2
SHA2566628586b7360b1dcc18a3f14b3d0744b6db96557083c7ce5245518d758726587
SHA5125e55c626865622c61f4561a8fbef2c0e9b140769077a607627548624fef906f728c347d70b277526c2f4738b1871e403acd14b010be85795a64cf4bf6cdc74d2
-
Filesize
257KB
MD5c2dc4718ba83206d6743bf903dc8bd87
SHA1ef2295363d49d8996787d1275e88fdace658dc1e
SHA2569e7bc3b8dc8866327693f5bca828b639e3e2cc8dab36e976767de7d713151069
SHA5124a00fc23cc6efbcfe94e6c64eb5bf14095e60aa266c6e3c03d3ffd9ab7e4aca32ba01f2b41676c9bbafac446d6a72709c0569a492cd18c3032580f8ba06634fe
-
Filesize
257KB
MD527bed834e636c66282ea491d1ea81247
SHA1c75de4d1df75db885e994e26359fb16002b0c076
SHA256be54b8ac6254e47c0ab7b49a9d51190407b024ce3e43d58390f7d04ba7f7845b
SHA51220b88e1a00294f2fc61340988e15acf78e4b0a74a6eab951ce86b2311536077cb37c6b6b80daac572119ddeb77e85e7085047ea47b1e0f1980ccb62e3803b39e
-
Filesize
91KB
MD59038c8454827ef2692825c408288c2d7
SHA1b91ff69f403d7c8d059a3a83dc2c6101af3ddc2e
SHA25629f402d22c308290057327340aa71dababf1557dba6b26f9bb0f229f1308baf9
SHA512c0d8433842f300d11ce609bc4bc14c1e5fa0aae2e07856abbb26d659f94184aaf1d6eee0781443f3099f6dcd2cc0bc62859762c487765f7f415977961df0c799
-
Filesize
88KB
MD5282722d24adce0f020c477860b492663
SHA1df8bbe7f199d14b535a704ee40027161d72102ce
SHA256314e1e1e5c491162032a4b05907cb8b294414b77af545c317c4022bee5e67149
SHA512d85b779091417c3c8ea09b98af1da0d38dfc1b8980f1b46fb71c6da10000aa5aeaeddddac9de227510b8874d4f56c36fdb72143cae709d58e48475a7ebfcdbeb