Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:34
Static task
static1
Behavioral task
behavioral1
Sample
03c782431893a3df2f6d7133d64b1e34_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
03c782431893a3df2f6d7133d64b1e34_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
03c782431893a3df2f6d7133d64b1e34_JaffaCakes118.html
-
Size
54KB
-
MD5
03c782431893a3df2f6d7133d64b1e34
-
SHA1
8b3aa2c43c0857c26a873c9f89d49ba5fe8fd063
-
SHA256
d6c80ffecc4b47eaf818dcdc2ccdfef1412a49843126070ee73192bde8f0bfe9
-
SHA512
fb96dc3dd8193a4921d22aad2e02531d79e5f551020e93fc0e6922d2f248c9f5efd8be4278b1a21c776efb73a7e5802e56714285c948fd08253260cb303396df
-
SSDEEP
1536:j+RrHv7oDSPX94ydgPQroomgJXY9nctPn:jgrHT7t4ydXroomgJXY9nctPn
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4512 msedge.exe 4512 msedge.exe 4504 msedge.exe 4504 msedge.exe 3556 identity_helper.exe 3556 identity_helper.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4504 wrote to memory of 2040 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2040 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 5112 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 4512 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 4512 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe PID 4504 wrote to memory of 2508 4504 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03c782431893a3df2f6d7133d64b1e34_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb462f46f8,0x7ffb462f4708,0x7ffb462f47182⤵PID:2040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:22⤵PID:5112
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:2508
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:2336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:552
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:12⤵PID:488
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:82⤵PID:1160
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3556 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:12⤵PID:3704
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:2284
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:12⤵PID:4356
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:12⤵PID:4016
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,5261095603578594203,11743291346782223787,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3020 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4844
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:772
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
144B
MD53d9d3dd53c855fdf975f2bf310454ad7
SHA1a5a8f0fbfce3313f9878b6e394411c15948442e8
SHA25612ffd015a195b42cdcfa16c4ad94f898b473bba831b5618b4ac98ec7205c7808
SHA51299aeb7bfaf9d0494c5e82cc6bdd6d5aacd259d0891794d2e56388e9d032aef28067bf52c4c56c842a50da880f5f29fcd4e4bcc9645c586d89cdc28e90f721b43
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD5450887208b7a2448aa2f3e5958c8895b
SHA11bdef705a519762f8ff6422ddc310f1e404ed9c7
SHA256ea4960e8cd2fdf35ee2fbea7f7dda6faa34e9d45a1717cae870d4887f002ab70
SHA512e46c2528d10018203e7653ed51e753694231d582c9d7e375bf78b0d13171e66d2ed6fbd6f26368ef240c60b8086035d78305457c7d8dacc76d3d0824d58d8627
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5bf68512901564a9c2e597e104ef2eb9d
SHA137a60396163f6a3d8fe4260565272f9c15f3ec31
SHA256c7b71c188989ef14f0bac09ba4aa22ad3bdedec21f52ab22db73e73154d5f193
SHA5125e27abf98d7b8d145db944706f7192c57cbb947f77c222f624fc3f1da37e854257860161ba7af89519b9adca48131fbf0faf31099eec80d06c6b8bbc26584dc4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5bcac88e5e6bccec7fe20e175eab8fa1b
SHA1e1ab71a2ef6cda9a661df4c6fce7b4fd6ea0e449
SHA25657808cca2cabce1fb221682540bf3417bf01024b1f84449814209ed7c214a138
SHA512832309ffba948549b3139ea404994a185dda84631d2eca95371e358b72ad258d109e2f2a4c43d1a4e5382a2e02c7e45276598cda6e01aed3e4abb04cfebe20fd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5add793c3de1212d0b2e13f6e86ef1020
SHA129ff120c07d186dce6f8d7ef878b46c4c7c5177d
SHA256f22a47251ee189c41b73563350b0e8c51ea2c85ee128f74a9d86e5af85e5c65a
SHA5120167f68b140e6b4c479b39629a5e3b3872ae053b0de95912e1d0eb626347f0a83e865422da4b6932b9dab43ed69e341a7d17b20caec63e9f570963dd2a7d1b1f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5831afd02e61b64af41ed128addb6a8bd
SHA160a7162164c0cd78d1eb08e121d731fd5e343007
SHA25673145ef46b90da0bed83ed218839acb614fb343c84ad00a91c047b9197e8e123
SHA512a9a8445b945159647814cd2d373e16dbddfc4bd195372990f959063bfb159354f3dbebc8ba6ef7c44475145d939a6edcf636d26fd949aa991daad8bcf4adb745
-
\??\pipe\LOCAL\crashpad_4504_YEOHXFMOWJYMZZVRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e