Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 14:25
Static task
static1
Behavioral task
behavioral1
Sample
639b129c51df523e39758e6ea7cd5bf2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
639b129c51df523e39758e6ea7cd5bf2_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
639b129c51df523e39758e6ea7cd5bf2_JaffaCakes118.html
-
Size
57KB
-
MD5
639b129c51df523e39758e6ea7cd5bf2
-
SHA1
912c1dbb02c1437f365c1c23a71e5ebe915565c1
-
SHA256
6b4eb1c1cb2d17440f92b71bf27a76a6a8153269521bf0ba067d41adfce8a0d7
-
SHA512
7b5cc46c84d2734361f95b450b5be56ad6f3f5bc296315d677b5aefc4ac5193409cd762fe0274d2a380a0d8dd4a008dad43c7abd4188a9530061a4d95f886931
-
SSDEEP
768:JnrXwVIZXOwO+MXrovGbgBzPRJ3itL6vrJMyqpQpFHmTjNBfybUSg0E:Z0IXO8CovugpPRJSt+j6QKTjNB6wX0E
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4004 msedge.exe 4004 msedge.exe 216 msedge.exe 216 msedge.exe 4280 identity_helper.exe 4280 identity_helper.exe 5460 msedge.exe 5460 msedge.exe 5460 msedge.exe 5460 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 216 wrote to memory of 1836 216 msedge.exe msedge.exe PID 216 wrote to memory of 1836 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 2544 216 msedge.exe msedge.exe PID 216 wrote to memory of 4004 216 msedge.exe msedge.exe PID 216 wrote to memory of 4004 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe PID 216 wrote to memory of 2744 216 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\639b129c51df523e39758e6ea7cd5bf2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff16cc46f8,0x7fff16cc4708,0x7fff16cc47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15298383722312896841,12381680666843832751,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
120B
MD57da1de607b5d8ad19fd6b561ce880704
SHA1e0c56e4a87ee4eb49def0d6cba813dc55c0dc7b1
SHA2563d974fd6863bbb624dba8fd9ed8c7e3bcd2e83efc1851b300ac530a880633cb6
SHA5122510361aaac37ed539e662cdf7c85d2216816e69c75665d91b2468385f6aa7e0a5413e527b43e2165292d04d00bd4096d019d3811942150ae5868d8b12928190
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
889B
MD555c0ac1a994c92fe691ed394f51711f4
SHA19d5d80778ad8ec9c9b3c47eae91139493e868e59
SHA2561df041dbd74c94eab136537aef6f7c2fc81afa412b38247e9530aedad708ab80
SHA51230af7d83922f1270637e121b2e160bac604e2fd3855fd756fffa7ee71ce09d6281a97b31d3546693ea3d1dd3406bee73b4bebc94de54451b3bc3feb4eceb3b6a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56babe16a6c3f1fb1772114fee95e9d71
SHA1dd8e53fdaface4cf2fec45009ab233d08ce67470
SHA2562444594d4fa8eb4c48cde37f478f49eb02e3de8fc2ea6301b168bf18e56b4059
SHA5123f9ab4b832c2234c0e13a5fe887c625b80ec297a1cb730cde789e34b23e9a90fef66274970812a12c2dc3713add93a734ab7eb9ba3e4626c8bc6adfcc057c742
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5258c2ae662d4c2408cfa37151d11a044
SHA1df4b32cd98712ec74894325695e6021396ebbcf4
SHA25692cbfbbb2ce0372948d8dfa5d3983d429fe11b4c0a1d30c7e451c1d3b2845231
SHA512e505c4017c21c7317065e9c2bbf7d02bd257ad8126449b620477b62d136a21ada37f5e27f9ad0224cea4c981b8942b16ee5e49c06a398aa311bc35898fe32e7d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5f156835f4b33a3e8da23b92e33de0a12
SHA1e4bf6ec992a999829c274bd1e39c42b139bf8616
SHA25665156421b398cd859d6e9a501bf9230a1a7d21b0f1b9e6ee79651ea1327f3aa6
SHA5126221d0b667855e2aa9436ea9e3588ae7181918f75addd4ba088870a93205dfe393ce6decec5c5623cced3d537e026db23ed59d95290e9a338741add8f26a5312
-
\??\pipe\LOCAL\crashpad_216_EOFVWGHCRNTCTFKZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e