Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2024, 04:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://autooincomestatement.de/EEFT
Resource
win10v2004-20241007-en
General
-
Target
https://autooincomestatement.de/EEFT
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133766379350031588" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4996 chrome.exe 4996 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4996 chrome.exe 4996 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe Token: SeShutdownPrivilege 4996 chrome.exe Token: SeCreatePagefilePrivilege 4996 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe 4996 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4996 wrote to memory of 4072 4996 chrome.exe 84 PID 4996 wrote to memory of 4072 4996 chrome.exe 84 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 728 4996 chrome.exe 85 PID 4996 wrote to memory of 1440 4996 chrome.exe 86 PID 4996 wrote to memory of 1440 4996 chrome.exe 86 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87 PID 4996 wrote to memory of 4960 4996 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://autooincomestatement.de/EEFT1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad178cc40,0x7ffad178cc4c,0x7ffad178cc582⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1904 /prefetch:22⤵PID:728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2164 /prefetch:32⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2484 /prefetch:82⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:4828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4584,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4600 /prefetch:82⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5048,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5036 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1804
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD50baa3a9e8a881854df872a74cbec8db8
SHA111acc4a0b43e93b5db9a264065684cb8df3e24bb
SHA256a495e250f960568b0b98993b1a3d6878239470d7e4cf59d4b97b636b4b4f47cd
SHA512bdf95376065d1c9edef702c08863343582c87796c733749b77ea0ed5aaaf21b7b7fcec5f2aa6643a63a6b63180e30902767ae4512a97b75422809b7c54444a65
-
Filesize
120B
MD5e502fbb1cf75a1ffad255cca1b6259eb
SHA1bbdfb75bd1da319fc375461d3ce7843e5e5711ab
SHA2565b7061ac485a516541212665da3682c17831d4175da23a74041ace614815f36b
SHA512e0669223cdcd6ff263709c9bde2f8457a23d4bcb6a450d86aa940f0a3b71672713c1ef10081fbb44d4dd21397349f554b1bd5645194d4b4f076b53c230877b33
-
Filesize
2KB
MD56c54df32c69d29a31ee867ce4e6d25a7
SHA130cfac5df9176d8aca86421feede421365798ade
SHA256b58072ab47a0dca706d766e8c2d8b432a1fdca0bad6259a614354d8b21a6cedf
SHA51249df0f33f73edcf6c9105dc02a99277a21ffa6ba1bb96b3a42de6bfc4cf0024e1b8e3de91b60040b2da5d5b8576916d93196ded3b74e788dca7a946fa242a01a
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD5b9bf796a9faafc4d57c3835cae700b53
SHA16ef6a484a1f16e3ead54d35604b5d042f81b7e95
SHA256a84f3d81ecd7b4d6ceb7b6da7ea1c61f23e5dd12955e9eec3ac9a4c040374b34
SHA512f3012a8a299e335c558711473a0ea892277a9a963e1e72a96c7f034c0650329a09cca514436141f74f27467a4acf82d83d0a2017d596fcf69169a79e4610e11c
-
Filesize
9KB
MD5f90d544cbd53c52522f7c96e7e99dfd6
SHA1309e3e8d1f1f653ad35cea3fac6796a9bbe7e386
SHA2566b0784d4373f47f7bdb9a7786d45df8acd43e8b0e9b65b97a9b6cd0cf256270a
SHA512c030a8ccf997b6b8619ff4f98baff5ddd6b533a87f87a6cea448c3fef7acd7f0945456f70ecf4608e22e98ac0b8a72e6213d21e972ff9721cf1763c0a8157c69
-
Filesize
9KB
MD5327dd8497b2e2462b383897c9eaf4c23
SHA1cb234a55d35038293ca5ea63213620bae2fb5859
SHA256a63f754ec3fa1365be0d7727f04564d690ae7fd5f22a46e93a761edcf3cf3a3e
SHA512e58443f18d503cb518ebac442bc3e5c508b2c659d9fbb829b6a4deabc78f552d3a62ed884a98db2213f023356747c173f810666742614926e038cd869a72248f
-
Filesize
9KB
MD52eaeabf48192800024de3cf0361a2b4a
SHA14d763967342d3ef0d8c7ac4fab27fd49193bcdb8
SHA256e7f9a2be3f5288ec75447d44803471f540496bcfe57b699dca26392b09795324
SHA5128c489e6cfaf391fe8f305720a3dee269b8b0ef7e3bff07d8c792237d44bbcc96370b9b137a4cd15820cc40909d454d3e7d2c6bdde293e832960c1bf6ef3c8761
-
Filesize
9KB
MD58087d6ee36385a932673967aa6ec30a8
SHA1b0c3a21f499ad36e0838472a789af27b7c94ed1f
SHA2566572632ba4e3f52626ebe910ac2c1b30f31c02a09e61a14ed09978a17779348c
SHA5124f2c9a2d982a66cea4de6f3e994b630e5eadd4ee18ee509249db73c0ec2d4cb251edd6cc30526b3a817c181a7c34b29a655fded1e8f4e189f2038b26a8bd12d0
-
Filesize
9KB
MD5e9f27596183fe93313ca4ed07c4a46e0
SHA1cb3bc9df6fdad4440841ba92867563c548faeec9
SHA25677d74a6e6eb831402794860459a79340c8bb94d864ea0a58e3e202baf9057033
SHA51269f76f2d1600d9ea259d00119852ecb32e9b17d60ac12f0ac478d63ae044976120b1bad260515ab7d3268fb3bd616558de1ecf73238d842140270cbbb0fd9799
-
Filesize
9KB
MD57afabc30644fb8b8480c751688a89c6a
SHA102cde2cea6eb59f23431c65d9c393ffeadef3132
SHA2565979d8a48e0ee940c0008e617789fb1ecf7d9c76fc3789ac306750400df92d97
SHA512de28620b59505e559c2bb865289f3a97a4db6a2b30dc7a05b01ff9d4a17f9408f8a5f3ea4b7f1e3167b49caefdd172cdf1b46d48360372f82b0352559a09a0c2
-
Filesize
9KB
MD5a9a70d1da9290fb4980bcd40b72e76b0
SHA13cddff4d22543c810906d2dc509f5214ee844fa5
SHA2562f230f09e6e2ac75b7c69489b11da393fd5a91cafee24241a80789dc0747d07e
SHA51229394666915eed1fd56370a8b725daedb2c059eb95910947856c20d7bbb0205e5acbabf8e82fe2f1fb074fd2800fca0fbc0b55cb1df557d06ca20db38f650879
-
Filesize
116KB
MD5a7a754d40474cdfb47058b425d36c495
SHA12a71391452a4fe245d6fd320a63fe284f2086ffc
SHA25641ed396993dddb92f2dd1c1f24b4d2e71ae4dec20463b46b08990972546cc206
SHA512ad33d8edcdd866378f6457dc9bcc325e9b5324b54a70b3cdb0cec5b62b714753b49bfd9072b34786b13b98570bce33d3dd62451e2ef8165790074612e1f1fe9c
-
Filesize
116KB
MD55be2f0581fa379acb081003c326f6ae2
SHA14c5ad30844e68e2dd5ca49b451ea406cb218f8da
SHA2560bc8943d1a2ce7d1e25a863beaab413da899c98c87201e0567705dc60d4b98a4
SHA5121bc6bee43f22b9d14671ec6ae7023994728e8416771a82fa730daba0fd22c1c195a2d4369479a70ad041420516e978a35b8b32813b4fe7468fcfea4163b7bc27