Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 09:05

General

  • Target

    http://steamdb.info

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://steamdb.info
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e7e846f8,0x7ff8e7e84708,0x7ff8e7e84718
      2⤵
        PID:3956
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
        2⤵
          PID:3432
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3684
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
          2⤵
            PID:396
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
            2⤵
              PID:3472
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
              2⤵
                PID:1508
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
                2⤵
                  PID:2960
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                  2⤵
                    PID:5048
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
                    2⤵
                      PID:3180
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
                      2⤵
                        PID:4368
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4784
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
                        2⤵
                          PID:464
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5984 /prefetch:8
                          2⤵
                            PID:3796
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
                            2⤵
                              PID:3824
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
                              2⤵
                                PID:3392
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
                                2⤵
                                  PID:3952
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
                                  2⤵
                                    PID:516
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,4372993817016550606,661895011784151909,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3908
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1064
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4800

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            f61fa5143fe872d1d8f1e9f8dc6544f9

                                            SHA1

                                            df44bab94d7388fb38c63085ec4db80cfc5eb009

                                            SHA256

                                            284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

                                            SHA512

                                            971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            87f7abeb82600e1e640b843ad50fe0a1

                                            SHA1

                                            045bbada3f23fc59941bf7d0210fb160cb78ae87

                                            SHA256

                                            b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

                                            SHA512

                                            ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                            Filesize

                                            1024KB

                                            MD5

                                            d7e0414bd0a43fcf4df3d46381611ec0

                                            SHA1

                                            fc1636af37943354dcbf0cebc5894a8f192db33f

                                            SHA256

                                            02fb19d86ddf054d054ea9c616a1d851c8741bc97fdaa43de01bea084f184942

                                            SHA512

                                            907f3d0bfd9bd12930c0d5ab16ae64d90592efe66a2d634f3b34133d3f54baa48f5d3d1431971c54d8738bbcbeec7ff47f69bb85162acaff2d2c700fdd930c79

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                            Filesize

                                            369KB

                                            MD5

                                            cd2fdf585bb97fe43f89b6a0605e9385

                                            SHA1

                                            c045fd090a54ca0290be436d0b60ea2288a51de2

                                            SHA256

                                            e28aa736703d99958986df594b13f2158dc8026d52b7611494f5fe9259728e86

                                            SHA512

                                            a48f62d1cb85c67d8b577a8351cba442004be148b3f252c8f64221091ac2f983b398586e34e22b2058495c1512da92110c8def5f04ea03ebc715f97388903e30

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                            Filesize

                                            1024KB

                                            MD5

                                            53ca21d8101837a46f8c7b9fe4ff38c8

                                            SHA1

                                            83ea2adb705567d0da398627365bd3510e40c996

                                            SHA256

                                            ddacb7b6f8008e68bfdd4fe77890db21f93c02fc56373c4fa2f0f444762e2923

                                            SHA512

                                            93cab7d6ebf8642a4024f3662458768f178df4ca1533a00f32fbbe3e16e1c8c806250b45e8d6c3a189b26cfcce85c8ecce82e4df41ec37a37014d0ffedf79073

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                            Filesize

                                            616KB

                                            MD5

                                            bda0d55de8f3f15a7b2e59a9f40dade9

                                            SHA1

                                            2b1c8bf24b2719d0eb5ae9f436aab24bef5edde3

                                            SHA256

                                            6da74908e3a435307e16aad2db1ef6c4436b72a543ca5074576f39c1622eb417

                                            SHA512

                                            3fbb5ee4fdd2742f3eea1356990eb3923d370541a49338371bba2d35a8502f97254b96516e5cbbb8e3bc242349d526cae771073fe740279354e098231443e606

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                            Filesize

                                            312B

                                            MD5

                                            d18eb417ff923b62465f91057b247f81

                                            SHA1

                                            4264669ae1d7e72dbf90c94c806698248164dcbc

                                            SHA256

                                            7aa25ee83baea4e25a14f8f6f1eecd67e4ec3be50e756e6ddf8eca764251528f

                                            SHA512

                                            fd1ceb9801f7cedd035d74a5602efc1006d5e006dae177594d83fba628431268d9857aac9d522bdf75ad1773a96b8a0d7aa131b584d797bc80e4b8dae3fda620

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                            Filesize

                                            441B

                                            MD5

                                            e72bb9775ecd6ba85e800265e20d5d77

                                            SHA1

                                            70a0533fa2faa718f9d7c3f99f9dce6ffc5a64ce

                                            SHA256

                                            8b1500ea94499853790804e34dbcf3f9bf1a134c65a098abc748212b28e87c52

                                            SHA512

                                            a6eaa9678affec75fac49f5753207775146dd03fd2877b28c996fb6bc6436228a014d391cefdb294eae7677563d2e6ab747f9cda09a7cd9ab1b85949eaff59b9

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            5KB

                                            MD5

                                            1e6cb7b65e61620189c639e29c521d89

                                            SHA1

                                            68c95d742adf33684c7d2226a8fa59641866929e

                                            SHA256

                                            d46ff040c37de910fdf313d1869b52eed2ac9959bf22bfd55595e9b71c928fd5

                                            SHA512

                                            170a454d24628fc95fc7ee2257912c066a8e72748bfaf8e86ec46c3efd338093fee7bf3a8196feeb7f9e0dca727b478067a1dbba581526ae5ef2068db0e750ae

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            a85a2d65b22138e28e1c60db50b73bd0

                                            SHA1

                                            600544b527a73c209df63a437ac8b05a9203b031

                                            SHA256

                                            cd1603d706996ec1b690b776a947b450fbdc6e530374bd446df6d4fc149c5939

                                            SHA512

                                            087e7ee79b4e07fb80d897d805d11463fbd4934344dee1860a4456f42c6e30f752897eadfbcca0a3329b6cf50d2d3279344598f13bd5937f2600fc20b62253e9

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            fcf0a460a64e25d71bb9114bc9c661cd

                                            SHA1

                                            a046f437e04a780bec608379058f9d2cf30d2b10

                                            SHA256

                                            a686ea165acb5f981795103ce1cd55b2f21ea408b14e0d0128e5d5c21323e6fa

                                            SHA512

                                            73ebfc0e384bac6d7316d0058fc03cb8799d776a19c67acf58cd1d2f4d5b2f309af7a912124c69c7bd2d5d0b7bfabe8a5e6c9140836503d15af2de68848db7a9

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                            Filesize

                                            72B

                                            MD5

                                            560c7b8a27919922f85dfb0d6eba3d12

                                            SHA1

                                            e92c7319a0761b81cca952db5a59d3eede7ae3f9

                                            SHA256

                                            ecab0d0620b1b16a1fa7fb0e91ba2299df056d9145b81b30a3d5f05d675365be

                                            SHA512

                                            39b4f2cdcda7f014245883ece6464ee1337a1125a3cc2f8ebd1b1c49d167a3ca717a1fa79a7792be475c909b9887abe4be54e7830fdb244182fbe9a4f6bb1e4f

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a23b.TMP

                                            Filesize

                                            48B

                                            MD5

                                            1ba0d46ca7e3eca761424eec202d1ff3

                                            SHA1

                                            ec373a2de0cf7b3ae1ad5a700d717fc9cb8ff9f6

                                            SHA256

                                            43e2131eb90a5b0f024961a523923dbcb82100aa6bc0db215025c3cf2bed0572

                                            SHA512

                                            84df1b3669bcccbb3e3f54605b1b017c11903838c30a6628a2bf4c74bc1dca9592d3e1e903aa25ef89d93e6dfc7ca605e8fc997b3bee794ab7949f2f451c7837

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            203B

                                            MD5

                                            10d0dee4b70b90239ec47b4ffa848858

                                            SHA1

                                            ac41fce84afa8c1d772e6acaebf33f7f89e66247

                                            SHA256

                                            b7fbdcd45fa81603849d2b0b509fcbc639e5fd08b9dcba3f60c95be264c3b4e8

                                            SHA512

                                            b8b3f6f2c7a3d811856b9acc8f010327d89554f28ec7f6c92f6da444efa6e18efe17b59fe771a6f2a2b5935a7dd3a90a8172fcb365bc042cd1c682a39a5b7f06

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579c11.TMP

                                            Filesize

                                            203B

                                            MD5

                                            67485c88f6342add5ac9a04ea0ad01e4

                                            SHA1

                                            1cb584896297469f9020001102e2b19b309fa6a5

                                            SHA256

                                            d369faf3482f297d480e87a70b8ca378dd3968dc027e59e8e8c6b87ddf297405

                                            SHA512

                                            74f540bd45c51300497fa4dcdf98b72a269798fda1d7b4d3c6b2386c9da3c466749d476cc1d6419b57517b96d2cf8a678a352cc9e7c91329033b920033639f83

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                            Filesize

                                            16B

                                            MD5

                                            6752a1d65b201c13b62ea44016eb221f

                                            SHA1

                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                            SHA256

                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                            SHA512

                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                            Filesize

                                            11KB

                                            MD5

                                            f03e85cee7b7e478fa2a3b09b48c8f95

                                            SHA1

                                            3b52283e430c2424fd6384c16870a1c988af5e96

                                            SHA256

                                            21fc9e84c66bc7351573f864c4dd36fb032483ef3d8039aae5da5626df662655

                                            SHA512

                                            f9e87cd303dd772e2cc2e65e700739ae58ee3f5e09d9cf297f0bbb509975bce9fcd202a5be8c94463bd1ec82e96b1dd9c5b361c4c3c4304f438a56013b3727c5