Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 14:40
Static task
static1
Behavioral task
behavioral1
Sample
6edc9ddb01cd17a29078bdd32a550120_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6edc9ddb01cd17a29078bdd32a550120_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6edc9ddb01cd17a29078bdd32a550120_JaffaCakes118.html
-
Size
120KB
-
MD5
6edc9ddb01cd17a29078bdd32a550120
-
SHA1
1c4953b23025d7f5d3fa28b11f56db2fc47f345b
-
SHA256
4e07305a8b0d931854751c0b1fadf9c06f8346e7e753289703fcdaee788171f8
-
SHA512
c3fd57f832a624d1d681eecbb230ad27b1145251e7715305f8892e5f29c936e8a5947c7fbffe1c0da813e7fd4f6290066d90e2fc9344cbc0c78c5ea7c1714377
-
SSDEEP
1536:BciUF6/zizyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:B8yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3952 msedge.exe 3952 msedge.exe 4992 msedge.exe 4992 msedge.exe 1604 identity_helper.exe 1604 identity_helper.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4992 wrote to memory of 2608 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 2608 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3996 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3952 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 3952 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 1664 4992 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6edc9ddb01cd17a29078bdd32a550120_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc314346f8,0x7ffc31434708,0x7ffc314347182⤵PID:2608
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7828845593411885192,16717315720693913361,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:3996
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,7828845593411885192,16717315720693913361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,7828845593411885192,16717315720693913361,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:1664
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7828845593411885192,16717315720693913361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7828845593411885192,16717315720693913361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4852
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7828845593411885192,16717315720693913361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:82⤵PID:4472
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7828845593411885192,16717315720693913361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7828845593411885192,16717315720693913361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:884
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7828845593411885192,16717315720693913361,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:2068
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7828845593411885192,16717315720693913361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:3832
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7828845593411885192,16717315720693913361,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:12⤵PID:3188
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7828845593411885192,16717315720693913361,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4896
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4276
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD558e50f4e92c97c151419d03346af9e92
SHA1562090dc1f2eec7ea2d8da96cd16ea20252dca47
SHA256e9522310bacaa24088fd102df3ee2ccdf266ecb3cbd4ed653065c14aff0042f5
SHA512ee820c4f17112387ce2c6105517a92c673cda8567ec763d7d7a920441c841d963e400ca71af5e6691aaae4e8d2f1b3e6593be9bf584a6c023b4c0532064b6fd7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD585fd2db721c530bc505d3d579d08650a
SHA120c75ee8cd370e37b1dc42a2192c6b2fd8ae9316
SHA25668f2b2708cfd7823cae9a9b43eb4785627bdf59d6dadbf8562e4a67b046833f1
SHA51242dddfeed5c54f93634a555070a10075dbb691eca8b8e5980dc64a03006174033b441ad1a354d830352ba8e503c7147de8733a7464b1aebf83534c9c57d306e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5b6fe66baaf550ff76debaa46775d52e8
SHA162297937de484eaa417e4aed5f452f512b3ea344
SHA256ad079ace8259bdfad4bd9774dd918cf5829d91b07ecd4424745a402cfada2532
SHA51261daadf88de3b8c6f8c0b075379d996c345019af3ea9982bce2d55393e36d208bcda033f04b75cf92680ed4a7a45b72e33afb9475ce67364dbdbb46f3c0001ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5cd57cf8fdedb0460db005581c7d6d65a
SHA1a06579ca1eda1e19f0b7b2135e3c55442ff37802
SHA2563fa4bfb03848476c0448113bc47c9659e5056cd97012eb6a2abc4deb1782262c
SHA512d54a33ef299ae6ac9f68f3996e29014c246abd54b5797daea2eda2c622a1cf07d821d0922b25ffd2658c6bbe053e2fdbba65d5d7951e35314ac9e5fe6d744a4a
-
\??\pipe\LOCAL\crashpad_4992_ZEFLIHEHWJOQKHDBMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e