Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 20:00
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://m.rltcn4.top/dc51QlpTXEFcclFeSF1yeCR-VUMHYTdDX1cLDX8JEAUuFVUkSFJTXhwtGyE4DAJtGSEaAHZGUW8EIU8FI2IYUiJBdCNaCSc&p=bmbhms&_mi1703109490186
Resource
win10v2004-20231215-en
General
-
Target
https://m.rltcn4.top/dc51QlpTXEFcclFeSF1yeCR-VUMHYTdDX1cLDX8JEAUuFVUkSFJTXhwtGyE4DAJtGSEaAHZGUW8EIU8FI2IYUiJBdCNaCSc&p=bmbhms&_mi1703109490186
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2208 msedge.exe 2208 msedge.exe 1948 msedge.exe 1948 msedge.exe 5024 identity_helper.exe 5024 identity_helper.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe 1948 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1948 wrote to memory of 1624 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1624 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1820 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 2208 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 2208 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe PID 1948 wrote to memory of 1336 1948 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://m.rltcn4.top/dc51QlpTXEFcclFeSF1yeCR-VUMHYTdDX1cLDX8JEAUuFVUkSFJTXhwtGyE4DAJtGSEaAHZGUW8EIU8FI2IYUiJBdCNaCSc&p=bmbhms&_mi17031094901861⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb30e546f8,0x7ffb30e54708,0x7ffb30e547182⤵PID:1624
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:1820
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2208 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:1336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:12⤵PID:1116
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:1048
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:82⤵PID:3564
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5024 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:12⤵PID:3848
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:320
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:12⤵PID:3108
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:3352
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:4328
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:2612
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,15135331649920338527,2392652746544696382,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:236
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5700209d395b657326213c4cf69d93b3a
SHA1fd0b103f93b07ac0a5b5be0ae40008af2b142c4e
SHA256674021df1dc65a3baba51ab747fcf679d71eae8768c2863e07c5ab137a873827
SHA5121b3dc2821e1aa92d808e6fe59a47b37e6d90c6c82fb1aed912a00615bf71fcc7aceb4f0e41ff87f7e9d364034e4978b2ef6813bbfcff0ac8c5a2a82cb836c538
-
Filesize
152B
MD5011193d03a2492ca44f9a78bdfb8caa5
SHA171c9ead344657b55b635898851385b5de45c7604
SHA256d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0
SHA512239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210
-
Filesize
100KB
MD5f134fda98a277b1c8f20ab8fbe2fbd58
SHA1a922796190a1f5bbb3c410c6ec591502050df04e
SHA25627bce9e85eaf3567a4695ba2b612e32615394d80d0a3a2dcb07b1fbfdfababc7
SHA5122b2e8338afb9b0ca9b5fa3d452dfd80368b5d17566120ae6351b6d03572e5a69cedb97f165fbc31ffb3addcc00506a3fc0761cf2404a5d9826a8448a7c4d9f17
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize336B
MD56883a649a5177fe66bbc17259db6c503
SHA177e8cbf37d93f2aa93ff8802304a9ed0abc28b17
SHA25614851eaa112d2501e443e231edd715777c9a1c9a4c98b2646ed80735d1db6269
SHA51257db1edd5e5e4c7525a37be58dc73b9f3a72d6a7f789a3cbdecc44ebd7625c7af6693fa406eb99ff475ed4132ebdadb6bc9f5ba138b22983e8da9d7c2da591d0
-
Filesize
1KB
MD5de8f8d8a3c109df921b95311aef2d2bf
SHA10f7ef2da2fd15d6350b2a66f1f7cfe7854a89a46
SHA256638ef8d2bae2139d151c0d56ac3db491250951b0d211b1c14861c3e438dca6ec
SHA512da0bcbeac500c6adbb8a3e6a9c3697c872e541467d309ebe0b15c29626e5732eaa97cabbfc407715b1808d5868661354fae41c279ee0b143ea359a1eb176bedb
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD513b96c07aad0243cb6551b739e98d538
SHA1142b9eae08a0ff5c665aa54dc473c71ef3e74462
SHA25690594cd9fac9720129696e41f7f8765b42abf2c9337af6d7a801292c3d1ea468
SHA512330036c1c0b7794df0558ddcd3ec181bcd085983157cea1dbbae1d40415eaadaae76b0cd582df1b2ee82517996761fdaccb5d163953f93ec407268e01771b785
-
Filesize
6KB
MD552f9874a611515a2883fb9dc75ad58e3
SHA1df804a2a19d74525a96850de8910eb6a8d031af0
SHA256d076e04b4282912ce9ff3d7c4c0988e219ee71cd128f16bac3a85132595039d4
SHA5128b217c6678c3fc101f14d3f8f2f5b8de37531290349e59005647e6cdc62e54f0f3ee355fb7cf1e12e11f57741a8c20e849b3fb951d7a42796836adfa82852dec
-
Filesize
6KB
MD5203dad0a2f4d9f96b7c91c5335a5afc2
SHA14c8d626ca0ce9459936162e829cbb39263573483
SHA256aa24d938e824b3b628552012a28883bc823142e2d2543ddc87383669294ec330
SHA51288a3a3b309a5e799e4148992410f466b5bc8382a1dbe60b7f6bc6eed39db03235c6d6d7444dc73bbd3e7127a1d57be47a461c6a5c36616ee6447613db8f01344
-
Filesize
24KB
MD5f5b764fa779a5880b1fbe26496fe2448
SHA1aa46339e9208e7218fb66b15e62324eb1c0722e8
SHA25697de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d
SHA5125bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389