Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2024 11:53
Static task
static1
Behavioral task
behavioral1
Sample
a26d3972e6463b8afcaffac5323821eb_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a26d3972e6463b8afcaffac5323821eb_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a26d3972e6463b8afcaffac5323821eb_JaffaCakes118.html
-
Size
57KB
-
MD5
a26d3972e6463b8afcaffac5323821eb
-
SHA1
ace815ae4788dd36e020482e54b56d6006777d27
-
SHA256
44ca408df96ffff15ed99e49a0d4e32b0bfffdd510130f91bbffa7f9f9b091bb
-
SHA512
987adba14e0f1b41118bc32a83a9e1e5b190d27113726ca0a92c67b06c6cbeccb71f665f8bce5d1b2e849e717ce6f8775c4df8bf39dc747f67acb650f7277a40
-
SSDEEP
1536:ijEQvK8OPHdsAKo2vgyHJv0owbd6zKD6CDK2RVroxawpDK2RVy:ijnOPHds+2vgyHJutDK2RVroxawpDK2m
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4132 msedge.exe 4132 msedge.exe 912 msedge.exe 912 msedge.exe 1920 identity_helper.exe 1920 identity_helper.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 912 wrote to memory of 4928 912 msedge.exe 84 PID 912 wrote to memory of 4928 912 msedge.exe 84 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 2544 912 msedge.exe 85 PID 912 wrote to memory of 4132 912 msedge.exe 86 PID 912 wrote to memory of 4132 912 msedge.exe 86 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87 PID 912 wrote to memory of 4296 912 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a26d3972e6463b8afcaffac5323821eb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe59d46f8,0x7fffe59d4708,0x7fffe59d47182⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:2544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:12⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:3196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:12⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:12⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:82⤵PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:12⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:12⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:12⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,307579843001950308,13781484928429895608,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3020
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2368
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize792B
MD5e64b3ce7e09144fe774de18e06dbdc7c
SHA143f325de5952021b366b571e40078ceb1bbb500d
SHA256d0137d7ef54605ff6214d85e36374d8e52339299fdaed38d9fbfe0e141b9901b
SHA512cfd1c43547c2ebccc2d722fdbd7c0b61442e207eb364ceab2b7a002857cbbc31be8ccbf5b84618e94f6e379414e86f59781153e21f20bfe4eed4a4adc9a0518f
-
Filesize
2KB
MD5d23de6b21be479ea597162e5f4520b49
SHA185d25e6830d093ae094996b0db330e6b3442da75
SHA256f301efbc1299778d3a0a69b5c7509d8d99517f442d06726bd561c9d3f77936e4
SHA512bd4eb5f46da95530f03de62c9fac5fde2432955a8bd218f8b01edbf3bd7505f048a1e098b9d937a9d181c53d2e9b948bb3c78e044ccc914056ddc34a184fcc0a
-
Filesize
5KB
MD5123c89a44ae4a5b0fc0c12c7993ab8bf
SHA108f80b80284f04bad198ac53c3d404e2d160f681
SHA256b78e83e3d728c7175cddd6fbc94808f3e01f63b0843a76ca2dc4ffe6f9344e52
SHA512f3548a95fc627d7d83a8109ac5c6e7be777a242e9a4f8b6eb902c807483a3314426e8ad7b5719bc4ad60a0dfa438efb2434050764d8f98e5696872ccb5b053a5
-
Filesize
7KB
MD5546bb97baca28ac85ae8f58a7687ab78
SHA170b849f0e0f1656879e41d2f361c514cb0bba94f
SHA256d10982e527adcab4d4b79ae11ffce9b1bfd39605c2cfc481c8e56c3e1b1ffda3
SHA512495215d5842c6222141f981f979d6091403c0385a38de2efe009b1bc6315c3785a490cfd699c28b1106c3fe24171a9a76c764df396e653a11e1848116fb24951
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD55a227b79eecc4d93655adf36d0b46530
SHA104651d53acf65a3f14488de441d78c65055b6972
SHA256c4474b75c0b5447bd3bdbefcc26bae14f8a53f310b5ea8bb611bf82f6c06ce65
SHA5128d2cc08e05b648f67cc985687eb62e694c3e080a009da94f4c42abad530ecbca8e69e04d4fe588c957865efadf9f354191a98b32602a237ad6eb2a8fc4a3ccc8