Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 22:44
Static task
static1
Behavioral task
behavioral1
Sample
f6bc621e51ad25ac875566da8e5c746e_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f6bc621e51ad25ac875566da8e5c746e_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f6bc621e51ad25ac875566da8e5c746e_JaffaCakes118.html
-
Size
43KB
-
MD5
f6bc621e51ad25ac875566da8e5c746e
-
SHA1
88f85c9b0661e07faab4aca0ac976348dd8cdb34
-
SHA256
839624b20fc1fc57a4860d8073876d6adb2cc51cc2fb33500ac2a0ce0320ddf0
-
SHA512
9fe3b5d1085ffbbd97a196f70e11f2444cef6f35889e87e8cbde3553a4f8447673dd3cb0c5a802e2c4081262b710ba14ae4012165324d5cb16fd460c9a4bd6c9
-
SSDEEP
384:ht/eOxXW0ebaJr4aSgHM2hs3qTt+ss3eIVL0JRTlbSJelilCQJ3m3lEgIk1hAhpl:f/eOxjZHz9J2elii3Ak1hAhpXeWQrz+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 924 msedge.exe 924 msedge.exe 2476 msedge.exe 2476 msedge.exe 1172 identity_helper.exe 1172 identity_helper.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 1700 2476 msedge.exe 83 PID 2476 wrote to memory of 1700 2476 msedge.exe 83 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 1784 2476 msedge.exe 85 PID 2476 wrote to memory of 924 2476 msedge.exe 86 PID 2476 wrote to memory of 924 2476 msedge.exe 86 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87 PID 2476 wrote to memory of 2684 2476 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f6bc621e51ad25ac875566da8e5c746e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdea6646f8,0x7ffdea664708,0x7ffdea6647182⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:1784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:12⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5160 /prefetch:82⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:82⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:12⤵PID:1068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:12⤵PID:676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6246097663788793105,15843378945576669112,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4300
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4788
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x474 0x2ec1⤵PID:1688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58c91c8582b0c918416d14bd7eedd686e
SHA1b2ff8149bc21144fdcec64111afda492965c6621
SHA2561e839706b748c04adf8efa2790564ca1efd707fdf6451e71af6862e07123717e
SHA512a93be868d9f08097bff39069378a0bfa0f5c78e74e9e8df820be9b0426cbfe84e03e9638b329b6142279ed140a120c4c4c21857f410fc4789a370445c3919dcf
-
Filesize
152B
MD52579d07b98bbefadc929d80fb3dbd32a
SHA11ceb57c4b81f0f23500e118a4b9a225116a467de
SHA256b8443c289ad36568a2bf794ac9ec1f259a9dd930c36680dafc8d0cb4de81feb6
SHA51253522ad5e8e2a272d5b1bff9b9226b7d976d47413891c60d7efebd4365baff12b6891e3f79b20e14892ec7c654ad2d437941014290c428c6b1bd78a7b3e557de
-
Filesize
100KB
MD5145d8e2433b698581b23185393a6d645
SHA15bc18f8fc0805d85f8a1d193af365a019879677a
SHA2568e95250698db60e973fd290424d77126ae25ddca76f644a83fc7165ec285212d
SHA512a86e5b35053b4a402bc254c5857a04a165ed51ab90782e6c4572a6741904edd736aab8419d3968c8d3fd1bcd1252084542c982ddb7b5e3d9ebc55c6d41e1784c
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
968B
MD5a030590e2e798eeaa118a2f250e76a20
SHA1bc148da22d08ec723de5da393b9f633cfc97d778
SHA256253fba2ac41d8512061cde4784a7ade6e4b41610005fb5fdf0880ec2f84007e5
SHA512155f731edaf6a19048ce5be6ddd10c4ca23311264a0e1ec554a9447258b48dba279c55a16b255594fdbeb0adfb58734315cd3324d3dac71d8c6c461c0c94603d
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD546e3d17d7afaf0e88f1b6921be1b50b7
SHA1d170e3871ac5ce7e3f6d858355df8d5faef9857d
SHA25694c20b9db820e6f95dae6418570c2376639378cbd12e0e694715152330980bf3
SHA5125eabff035da179022dea671ce1480097e35b96511ec05e27c8e31a9d4aba9b5d85008bc5c1ea0b5290b13b38f35df66d15024582770127c16afb547aff2abb35
-
Filesize
6KB
MD5d6cbe0cbd88eb1efd72b3435a0327834
SHA19594579f430f95c35e8e25e2ee61f5b628c84dbe
SHA2568b44eb3616512b4797cac06be0ef39fc8f3d3c24c168902b95fc26e5fc26c3ef
SHA5125e394360882545743307371511540ea3c9034e804040de2fc1e01de531943982df25730c8dc7092890bb733207c74f588b3f14a76ef9c1de4e4f0ab006c05baa
-
Filesize
6KB
MD578c4b10e9175552e74859ebb14b7d051
SHA1adcf5a605b7c9e603d7dee58026d76746186ac11
SHA25685c98ca698ddf7b3c1f3ed69ecc19b325527ca2a01c90d134fad31dc94552084
SHA51203b535eb8d0c906e0feccad14f2aa4b238fc07389a261fba33b2e086f702c615ac3cb6f7b0c934620a72125ab7bbcd159992b373c3d62fd70d4c708ad9dbe9e9
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5159ba6485bbf2738786ac4ab09d4bff5
SHA180e00c7cfde376aabe37d6bc7cb7bb6653c7dd42
SHA256ae64bb1a3a00e1f0ee27cecb5f2dda371c95af450745d0ece5e9690dcd775cb8
SHA512886e8e7ceb9e03920f7707591ce2031744fb83c8e38319af653cc6067718a4d4e6840daecbf583d2f676b44773ae25d07ab416d7def0b200e3141949a79ca28b