Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-08-2024 00:14

General

  • Target

    c40dde6b77e846c60428b0a88b35bf52_JaffaCakes118.html

  • Size

    283KB

  • MD5

    c40dde6b77e846c60428b0a88b35bf52

  • SHA1

    0c6532a8aec4f0de4f77a0261d8423e4db336603

  • SHA256

    ddfccb0e679baff356493263fcfc6954dd7f85a43a8226dfe1f5092bd1ab7456

  • SHA512

    5aa414adcb7b6f03932994e8035d561f2a86186baa2b99f592a8a7afd1564bb1ed8e92142dffe6538d6968751705c4eda28363a9a04c829a67981c34fcd24328

  • SSDEEP

    3072:PW6WCiqYxDNvG8rmgcXmNRSz7pLer71BMn3/lemG6NMqcv4c7RJHfy3Sy:+DAXmNRckmJ

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c40dde6b77e846c60428b0a88b35bf52_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4060
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffacb846f8,0x7fffacb84708,0x7fffacb84718
      2⤵
        PID:3564
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
        2⤵
          PID:972
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4832
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
          2⤵
            PID:4716
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
            2⤵
              PID:888
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
              2⤵
                PID:2676
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
                2⤵
                  PID:3724
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
                  2⤵
                    PID:724
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                    2⤵
                      PID:2908
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5576 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1912
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 /prefetch:8
                      2⤵
                        PID:2664
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1440
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
                        2⤵
                          PID:820
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
                          2⤵
                            PID:3496
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
                            2⤵
                              PID:5080
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14697206770761186178,1087021887163577936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
                              2⤵
                                PID:4744
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2800
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3524
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4376

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    9b008261dda31857d68792b46af6dd6d

                                    SHA1

                                    e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

                                    SHA256

                                    9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

                                    SHA512

                                    78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    0446fcdd21b016db1f468971fb82a488

                                    SHA1

                                    726b91562bb75f80981f381e3c69d7d832c87c9d

                                    SHA256

                                    62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

                                    SHA512

                                    1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

                                    Filesize

                                    23KB

                                    MD5

                                    a0423f1305547bb6b8f5a4fb1a9fc2d8

                                    SHA1

                                    092dcf1fe57e6bb53821eb754e04188ee70602d5

                                    SHA256

                                    6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

                                    SHA512

                                    b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    168B

                                    MD5

                                    dcbf482fb762e817576aacd5dc8aa630

                                    SHA1

                                    9c946d75346675ccd790c361fdbd7667fd3cc41a

                                    SHA256

                                    da72d3274a47fb6a6ab827c4bf116dda504e63dd017119b4936b16c337326a33

                                    SHA512

                                    bd436b904dca77f85ca3dfe1c3289f0d97e94e791b966e0bb84c23f23158e847da77af1ef2b42901f5dd643e5a74a5cf97a5a0f95ec597842a104acdd32601ae

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    240B

                                    MD5

                                    262718732af6f31351549e08fba2e840

                                    SHA1

                                    119b92086751f1cba3e225b4203d4f2547866142

                                    SHA256

                                    320098810f5bdeecf4a889d2d39020b7e26fd576f1fc08a8d67cd5229afc6b74

                                    SHA512

                                    7d8ff6789b2423566f9ddbf7457844342f4dc45077b3e96097fef7efcb34886ed1346a841852432524d24b8ea71fb6096a17d522129d809e0ce1c5b2320b3a5a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    78b6f66836a4910a63efbd5f381d76de

                                    SHA1

                                    26272aba9a7a73b13a1abc6e0bc58625c19818bf

                                    SHA256

                                    bf2770d4942115cb6d48d996e51de3bf5f72aa3301cf6ce58370359343b54cb6

                                    SHA512

                                    17dcb64571926f2db6e14c1e1cb19d0e99bae6c05134091617aea6a5a23a014bbc6994ecc3c81af0545c9b0b0e4ae4df069a07fc1a542988e198df6ad7d6079f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    58c5ec34295cf517fd19a0e0f07dcec8

                                    SHA1

                                    880e2946e6c4682852bf32d8d7290d05de291629

                                    SHA256

                                    f67a8dc9a56830e544656c316073ba6e55a66aa18ce6590df4732f5665fa8083

                                    SHA512

                                    f65612df749f51ed3ce98225dd2a41178cb76385fa8fb8ee3ce7a4e28b5028d4669c821a8c53a639bba637461d1ac8cbc6e3c6a2319c7f2c7b598f78a2b64123

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    959ec26d8b20615caeabd527742b665a

                                    SHA1

                                    8044b8e6083d0c4f9dac10fc15434569f5d0ef81

                                    SHA256

                                    e711448dab8ae2348f9e6c95ed7dce1ff3f89945427940e46d2488febfccf47f

                                    SHA512

                                    7c14f5fdb89d556aaeb25a3d77eba5b10134f53831cc55406f0c43a526a2b0524262df0df1227f86d46d2181400c4c45bb45647deb6096c647c17781d92ec4c2

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    8KB

                                    MD5

                                    23210b990805c4a868642e14a86c73c3

                                    SHA1

                                    139936174c315ac322f6dd5fd243ceefe69476e6

                                    SHA256

                                    4498326a8eceff12f4638c3a8062f3edbe634e9ca020492d122dacdc5c91450d

                                    SHA512

                                    1409388373a46885e4380875c62497276fa13fbd88d2c181f1e7799b176d2d64b51bf700dba9051e3e44c66b41eb936f0d29de8036b8a0735b3808ad60853906

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    8KB

                                    MD5

                                    9aad65df7fff0c022bcdc27f589db89a

                                    SHA1

                                    55f8ce13c48001b6ceace10d9e66179fa7217e61

                                    SHA256

                                    f4f9da9b31f310b848d90fafe1e80b59d282ed2225afd19590be997dd67801c8

                                    SHA512

                                    c590de2f25d9089284f29fb18d6d4cd8cecda2298a9f81ca6f455dcf70771fed945c31414c60d23f7662548f3b792a6054394fdd90db1f2fa216c16b1b4797df

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    1e212233c1102e31e44b4af490f412f2

                                    SHA1

                                    4dff67866bc9d25d0beaccd437ffddfb2b7452d8

                                    SHA256

                                    f7b8745fdeec0fea55b1bcf219fc9f8dbc4078dbaa93628fd54ce636fceec67d

                                    SHA512

                                    bbc80d490de00315425c34012c42031b0c5d52e4079affe959816122fca75840e52fe6450e6f47e5b5a7419ea2d120818e8ba0817a29b9bc035058db5ae6173f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    704B

                                    MD5

                                    d0a5cfd77cc3a473e049164120fdf70d

                                    SHA1

                                    1ab7f1cc9ddff97d0340df25213fd5e88ee0d5eb

                                    SHA256

                                    c5206eae827195e3801e3c87bf6039979d37972af8deaf209cd55a60988e2176

                                    SHA512

                                    ca28dc0b671c8817b112bcfa085f61f43fbbf3a0fb82fbfe420ffeff79beb640e47fa7b82a3e199ab694def6a7858f37f5b5f70b54c371e64336beacd95426c2

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    871B

                                    MD5

                                    31d26cac3261cdc60c5f167223190d2c

                                    SHA1

                                    2138b8b12bf799a7cd98836e7419ddbfb4944553

                                    SHA256

                                    0556e9cfe2c7f437ff6386b678f3ff37fba0551036c4d22de77302f343a4501f

                                    SHA512

                                    777a8fa696bbc4fbe1ec41d84400a072af8a065301dc02d7b87587af16a1dc757d3589c0b62b2868d0ec076043c3ad06df28bc630db32a5f4d7477e6d879e84a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59649c.TMP

                                    Filesize

                                    702B

                                    MD5

                                    341910bec01b23f97a7bef3a06ceff71

                                    SHA1

                                    de0b6872de456391bd1b193a8fc5456df5e49114

                                    SHA256

                                    a496834da1f0180ac1eda273a0872eaee2db0ead4fb59ec01c8ea40e0b12f61d

                                    SHA512

                                    08203273cb1903f3d1e99efbaf9f1bc22f222f7f03356fa9853688845080cf55b2735ebb29dab82aad928603cf1aa8edbff407c24858b418d09a43980d67fc92

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    10KB

                                    MD5

                                    a63e61ab94584a1a69262ad21e79d4bf

                                    SHA1

                                    41cd08a6849426c9535e9326fc68f9e6ddf19950

                                    SHA256

                                    65c1c5e9505538efcaf0fdafe7646b5ea38e4961f740096f6901d8b1c8f35fa7

                                    SHA512

                                    b67f9e0f52fc5f0b92ec17f17d4975dd336651e2438bb2f1f620310e97ed14935cafbb140989aecde2cd6b117b156fddcf616c28183fc9f521967ba7ec3e25a9

                                  • \??\pipe\LOCAL\crashpad_4060_QQFSQQWLQOZKCLMZ

                                    MD5

                                    d41d8cd98f00b204e9800998ecf8427e

                                    SHA1

                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                    SHA256

                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                    SHA512

                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e