Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 17:36

General

  • Target

    304160f1e8feebbfc92293296bd726ce_JaffaCakes118.html

  • Size

    366KB

  • MD5

    304160f1e8feebbfc92293296bd726ce

  • SHA1

    4b0031268fe430262e7f5ffa85a55d6889b32240

  • SHA256

    e2c3b883f119b12be3d0780301c8151862118545ff2cc8fbecc56451910a5fdb

  • SHA512

    03dc14bb66faba351a6c0c45bff96bdabbd22dd6dc8632415ddf6200c264ac894327c7e841076763da72c51be7ea92bf79e328a8039f234658f71804ea53ff08

  • SSDEEP

    3072:hexjvG83mbGXmNJUB/gF//AxUbsm6Xcq8rgH0elHs0+ikKtTJAPDxlPDP9kqUbt8:UNXmNJTbsm6DwQtTUigyKq3iL

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\304160f1e8feebbfc92293296bd726ce_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3560
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ff83e1046f8,0x7ff83e104708,0x7ff83e104718
      2⤵
        PID:4044
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
        2⤵
          PID:1192
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4420
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
          2⤵
            PID:3068
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
            2⤵
              PID:2072
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
              2⤵
                PID:4336
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
                2⤵
                  PID:4412
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
                  2⤵
                    PID:4300
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1336 /prefetch:8
                    2⤵
                      PID:3680
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1336 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3176
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
                      2⤵
                        PID:720
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
                        2⤵
                          PID:1544
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                          2⤵
                            PID:944
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
                            2⤵
                              PID:3580
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11842549471585357224,1339211697211368637,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5392 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2836
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:1152
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4520

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                537815e7cc5c694912ac0308147852e4

                                SHA1

                                2ccdd9d9dc637db5462fe8119c0df261146c363c

                                SHA256

                                b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

                                SHA512

                                63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                8b167567021ccb1a9fdf073fa9112ef0

                                SHA1

                                3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

                                SHA256

                                26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

                                SHA512

                                726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                Filesize

                                20KB

                                MD5

                                397383c90a2d930f866f405747e27466

                                SHA1

                                7bb6b5d6cee104c877dc5c3462f61232ffe5b360

                                SHA256

                                a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

                                SHA512

                                4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                Filesize

                                22KB

                                MD5

                                5e74c6d871232d6fe5d88711ece1408b

                                SHA1

                                1a5d3ac31e833df4c091f14c94a2ecd1c6294875

                                SHA256

                                bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

                                SHA512

                                9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                192B

                                MD5

                                6ae12d93a3a224dbdd0b42d117c14369

                                SHA1

                                bc112bc60a4f661b8652e16447919d1d7a6c7dae

                                SHA256

                                128cd88dba3694f02b7a6f6362879218458f32c91e2752a14644e3f788d8b310

                                SHA512

                                d42119853af71bf4a1edd4a35534b2835be0150360334f29c812849614dec17bf09998f8d69d0578e3ed92bb67e7075cff02ff73f4f671ef4258c2cfaf9159c4

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                168B

                                MD5

                                08a8f1981ea62d11a19bd3a059560fce

                                SHA1

                                bb620df5af2f790b838fc98f82439fb838aec80b

                                SHA256

                                b89e209f886d5a3057d6a253b85caa8f240e8268291519076f4fd7178b3450ac

                                SHA512

                                aabd23eb45cef41e55850f34e00b721e35655e25368fc1bbbef27c8ac4efa2750428d033fccd2b3f35167c12af250c1dc11507795bc0f81d41ded1d4cd7715e0

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                2KB

                                MD5

                                b6487be75c5f091908b8b3202c9dd11d

                                SHA1

                                70cf4942a1d94309a08e84c642e12b93d11339cf

                                SHA256

                                ec1a6c4970bc1b8cb6952f7ddabe10534c3ccebc2c6c865469f88c1984476853

                                SHA512

                                7c48e167253e0ee49d69cc17bb01d83d61154ca58ec24cb45b7b6ff691dc8f6cf8cd3af4c4a5b91aea8052eaacf6c5663c4407e0c98a285d1ea71ddd88b3d285

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                3KB

                                MD5

                                f5eec12b97e1b9f02acb1c30af02046e

                                SHA1

                                4b7e0005d3fdcd95d64df0a5ddfefd8e9acb346c

                                SHA256

                                ae2ac2f8beb530dc858486df4aac2dc6dc733e1490e519266451c72c8d710c6f

                                SHA512

                                f4cfe1863462f0cba291a00bf33888c73542b775946d1ad73c5aff1fd0b5d08b6e6fc39cd2a015d82a85b548b5e8c50a58b7f315614a40aaee28738fbd2961dd

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                58949c55ab5ccb9f895dc64b69f01546

                                SHA1

                                ad4d0465726fba6806dd5a32e2065654342f8980

                                SHA256

                                19e0a972d1df8fce66ed90a2db2ba9653f5f055618ae0eec47867c439702095f

                                SHA512

                                93cb7524e198c7b6b29d5a9f66c904e97ef68601c69f45b8a0821e23028a9889243f9e49a27bf6c01254bf8af4e0180cd6683b35ce8e6ab6708956d58d6a5326

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                7KB

                                MD5

                                d3f11ab31f9fecc7c94ff29dccccdad2

                                SHA1

                                e9aa56b848c2d3dc5b04d6aca49f211c4a3fa217

                                SHA256

                                40bf5c8293925a5a45a6111348ea296005ee92c156527889606176385d897b21

                                SHA512

                                2341bddb6deb360c12ce91d386bf2327a9f8a68b06ddaac45a37ec8424c1145f824fd5476244c87df2b89c27a908007cfa6e13eef2ef4ad5f8628f2b35925371

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                7KB

                                MD5

                                e7c2c451ea1b23307f7f8469e31b6f8c

                                SHA1

                                43c0e5f8734add650011b03f66e1d1e87f7725a7

                                SHA256

                                820b6110be7e3c51bd570f44d7f5ec0501fa82675f1a4ee77a4ff76f52dddac7

                                SHA512

                                ab50697b3781c591ba89adc2b33787fe1811ff4be6010f03f91cb33731b39d09dc83cab1f1943e7344f2868451e43d88a8cdb424542034ac6924b52f05425860

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                80cd97202b8a0e457a2fd4b0c68c9e9c

                                SHA1

                                397095ffb1c5b7f5afb0277c1bca26c024c02bf7

                                SHA256

                                b41f9bc102c0155c9c84e7eb1088db7f21bc9018e5ea45dc70a9d43b7e614d8d

                                SHA512

                                d74e2509e1da550387e2398176aa9169e0492443005782ca226f9f0835da5c5778baf88986e0f03f0bd628aaf12e8365fe6e8aa55a2690c53ec515115c661769

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                705B

                                MD5

                                638bcd2cb43deac5862a201e4f29d30a

                                SHA1

                                3bab0ed587c5c707bbdccae9d4cab4d85e33d89d

                                SHA256

                                c35d845fc7f50f666ed9ca280019a494e6553b9af5701ba48d3e66210744184a

                                SHA512

                                ed8cfb10fbb6fc82b5b7dd84d4ed063940c3b4da4341be56eaa1ea294660ce2674b15c10101442c56795cc5bf695a31dfa6faf433f27e0c29aedfffc70f18ea2

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                705B

                                MD5

                                2b98c7a650cc17f56c94efd59b90d6c6

                                SHA1

                                6fb60d5599808cef46b81618ef7b3581f861682a

                                SHA256

                                dff74aa953c72c5c6a83cfb6c015eb76f301ed86b88222072bd1dbd14f99534b

                                SHA512

                                d94c6c28f427afd415d7df55c42de5c11ab6a1c8ff3693a40608d39539cff3e69d4bf0e2a4c350f7b2a6071dd130ac35ad0b3d3aa6e032fbae1a7fa0402e8b62

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                705B

                                MD5

                                8c8a9bfe74e8c150e1a759b583d8ecf3

                                SHA1

                                f0e4975a9776ee2cf44d0cca5964e24b7de82236

                                SHA256

                                2daabf8fce61dd441e55c965885a5cbf93c00bb2d182dd923bb426c4a01993cc

                                SHA512

                                e02f192fe2278347f6c1f4d380b5cc142970b464945f193b8726f9977190de4c13b9466792a759672468b49a263b65cee8154aeaf51d38177e01a89576ac2947

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c2b4.TMP

                                Filesize

                                538B

                                MD5

                                cb87fad41f549b3bed2713363daa00b5

                                SHA1

                                919256fd193466caf552a1433c83bda80eee74ee

                                SHA256

                                a3de37bbbbc33d8061405a8ab2abc2501d82dcba506d688215bca866582ca5c4

                                SHA512

                                672191e57a53dc9e759ac874609a6fb115ec9278fed8f29bb78f9d0b984f88dae5b9733274e24821e27f213bf1ce3c78bcb1221ea8fc142d68eefd2c4a38b44a

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cd00528a-48c9-4beb-9361-340802d5863e.tmp

                                Filesize

                                11KB

                                MD5

                                5e65f7553c614c4f7de73bc712c3d9db

                                SHA1

                                f8b6f12b5da387a9804858eb27e85c3841d23911

                                SHA256

                                7e72f125b827b207a833b4217653f447430c6bf3982df4da57167b3f15b0f57c

                                SHA512

                                22ba7d737456bf6507bf3c0bd24b0c6590cc665dfbd046461edee4e3cff38f4019938c9f99ddf654451fc19a5067d391708dda5adce947ec7dd8988c960639b3

                              • \??\pipe\LOCAL\crashpad_3560_JDXDKXZLKREGJKLD

                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e