Resubmissions
06/09/2024, 08:22
240906-j9n26awcnm 806/09/2024, 08:08
240906-j1snzswarf 806/09/2024, 08:05
240906-jy7ecsvfpr 806/09/2024, 08:04
240906-jyjy3awajd 306/09/2024, 08:04
240906-jyez4svfln 106/09/2024, 08:02
240906-jw61tavhmc 806/09/2024, 08:00
240906-jwf5dsvhkb 8Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 08:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/JaredWestley/HWIDSpoofer/releases/download/1.0/HWIDSpoofer.exe
Resource
win10v2004-20240802-en
General
-
Target
https://github.com/JaredWestley/HWIDSpoofer/releases/download/1.0/HWIDSpoofer.exe
Malware Config
Signatures
-
Downloads MZ/PE file
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 2778.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3316 msedge.exe 3316 msedge.exe 4112 msedge.exe 4112 msedge.exe 4368 identity_helper.exe 4368 identity_helper.exe 2372 msedge.exe 2372 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe 4024 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4112 wrote to memory of 5108 4112 msedge.exe 83 PID 4112 wrote to memory of 5108 4112 msedge.exe 83 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 1548 4112 msedge.exe 84 PID 4112 wrote to memory of 3316 4112 msedge.exe 85 PID 4112 wrote to memory of 3316 4112 msedge.exe 85 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86 PID 4112 wrote to memory of 1292 4112 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/JaredWestley/HWIDSpoofer/releases/download/1.0/HWIDSpoofer.exe1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf51a46f8,0x7ffbf51a4708,0x7ffbf51a47182⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:22⤵PID:1548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:1292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:12⤵PID:772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:82⤵PID:628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:2560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:12⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5972 /prefetch:82⤵PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:12⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6416 /prefetch:82⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2288,17052171604670136129,519601664825910371,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4024
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4996
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
Filesize
265B
MD5ee77ee0ddce6df6a4cf39b6d19ea6b4c
SHA1d5407a3c365266b7a794e647bc17ed9e06b4389f
SHA25679a078c39145a1dc1c27c15f05bb7a39bdaf7aec14fd85a2dcfd36b95a3f5b36
SHA5121841689b05aab9ba73ac48bb390c148e92d218b07da6b89bbec900bcb84055fe2080115545933d495f6e8f2506497af930fbab1c68cf65ff080f2d5a61b30eeb
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD52a8cc515d1eb178929abfe8856aee973
SHA10594cf37c9aafef427ab6985fd12eff071576d4d
SHA25611efda97e9a25862c716a97b93f17a8ddc3728adb4cc1ce050ff465833596e89
SHA5120dbca965f5565a92849065758f021894297f828374066776d8ec94c9eca73e4bcea6250fabb4f80e65d4d00a955b6ea5c4714e8f5c944ed50b58a67304ac6c28
-
Filesize
6KB
MD586a16757045de44039379d360c85fa64
SHA150c9d6be960fff6e1fb9169f4ac80dd1a63c5671
SHA256387a2e01c8e9bec3576eb532ba7ca96fac0ec8516206579731376610d62b3bd4
SHA512e6753660bd2c640af3874e0b167c65d854f10962e9257949586554cb7793785efd495da06a21179949819a255876d3eed3f68b988ffc35c5b3ce531110d6126e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5ae0335809318a6c51d3a0bf4df4a206d
SHA10a3509e364c16700f1404c0a46da2751a1556f7f
SHA25607bef8ea33c1f1df35d685ecec6f9595f2f6bc1aa632a8153cacdcdb62cc6ac4
SHA512d9db1d5f956c49fae78df11bd89a4b743fe0f70b1311b16cff24391d49bb63348cba73742e789bd821012f74068c704e8246cbd50daeb38b27d17200b2a07e36
-
Filesize
10KB
MD5b3f9d702db388381eabae7197179b218
SHA1054c517a2d25a6bb59c4b859f083b4c3aafb7dea
SHA256a03475735659b15509dbead54b829c04f36f48121ec2370cddd8feb9bd3a7e46
SHA5129737a253358c9467fc5760b452cbfb1c6259de54e4198c4fc3ba2b5667c84b9117be53046571daef49289bba2502983ef3ea70fb999e7bd320c2757d7bf3dc99
-
Filesize
995KB
MD573598365e7be8f06f79b4bd81ef86341
SHA1354adaea812528d9e5bb3cbf5c5fec7b144cfa45
SHA256127e0c260765a58e3916eea7b5f4a6edd447504d372f24ff4d78b9068d54dece
SHA512456bfc208b6abe9ea45b18492a6d32a9008245412c81dc60c1df18e138099a0a81a2eecc04849300b65f32da515f795471c227eb3346cada5d4d6b68c743f63a