Malware Analysis Report

2025-08-05 10:12

Sample ID 241017-bfemmaxblp
Target 50066ec70c0fceac4ce35db59af9fd3b_JaffaCakes118
SHA256 5c2e5d7ea9655ce93316bdfa2825e1e800a5219ba23cec04fd590a4b115d1f36
Tags
collection discovery evasion impact persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

5c2e5d7ea9655ce93316bdfa2825e1e800a5219ba23cec04fd590a4b115d1f36

Threat Level: Shows suspicious behavior

The file 50066ec70c0fceac4ce35db59af9fd3b_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

collection discovery evasion impact persistence

Queries information about the current nearby Wi-Fi networks

Requests cell location

Loads dropped Dex/Jar

Queries information about running processes on the device

Reads the content of SMS inbox messages.

Reads the contacts stored on the device.

Queries the phone number (MSISDN for GSM devices)

Requests dangerous framework permissions

Reads information about phone network operator.

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries information about active data network

Queries information about the current Wi-Fi connection

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-17 01:04

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to write and read the user's call log data. android.permission.WRITE_CALL_LOG N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-17 01:04

Reported

2024-10-17 01:07

Platform

android-x86-arm-20240624-en

Max time kernel

136s

Max time network

157s

Command Line

com.chinamobile.contacts.im

Signatures

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/data/com.chinamobile.contacts.im/com.cmcc.sso.SsoService/test.jar N/A N/A
N/A /data/data/com.chinamobile.contacts.im/com.cmcc.sso.SsoService/test.jar N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the contacts stored on the device.

collection
Description Indicator Process Target
URI accessed for read content://com.android.contacts/contacts N/A N/A
URI accessed for read content://com.android.contacts/contacts N/A N/A

Reads the content of SMS inbox messages.

collection
Description Indicator Process Target
URI accessed for read content://sms/inbox N/A N/A

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

com.chinamobile.contacts.im

com.chinamobile.contacts.im:remote

com.cmcc.aoe.AOEService

ps

/system/bin/sh -c kill -9 >/dev/null 2>&1

/system/bin/chmod 755 /data/user/0/com.chinamobile.contacts.im/files/com.cmcc.aoe.keepalive

/system/bin/ndk_translation_program_runner_binfmt_misc /data/user/0/com.chinamobile.contacts.im/files/com.cmcc.aoe.keepalive /data/user/0/com.chinamobile.contacts.im/files/com.cmcc.aoe.keepalive com.chinamobile.contacts.im 0

ps

/system/bin/sh -c kill -9 >/dev/null 2>&1

/system/bin/chmod 755 /data/user/0/com.chinamobile.contacts.im/files/com.cmcc.aoe.keepalive.pie

/system/bin/ndk_translation_program_runner_binfmt_misc /data/user/0/com.chinamobile.contacts.im/files/com.cmcc.aoe.keepalive.pie /data/user/0/com.chinamobile.contacts.im/files/com.cmcc.aoe.keepalive.pie com.chinamobile.contacts.im 0

sh -c /system/bin/ps

/system/bin/ps

com.cmcc.sso.SsoService

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.chinamobile.contacts.im/com.cmcc.sso.SsoService/test.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/data/com.chinamobile.contacts.im/com.cmcc.sso.SsoService/oat/x86/test.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 a.cytxl.com.cn udp
CN 120.197.235.13:8080 tcp
CN 120.232.169.204:80 a.cytxl.com.cn tcp
CN 120.232.169.204:80 a.cytxl.com.cn tcp
CN 120.197.235.13:8080 tcp
US 1.1.1.1:53 alog.umeng.com udp
US 1.1.1.1:53 da.mmarket.com udp
CN 120.232.188.83:80 da.mmarket.com tcp
CN 223.109.148.177:80 alog.umeng.com tcp
US 1.1.1.1:53 mcontact.lingxicloud.com udp
CN 120.197.234.165:80 tcp
US 1.1.1.1:53 hxqd.openspeech.cn udp
CN 114.118.64.119:80 hxqd.openspeech.cn tcp
CN 120.232.188.83:80 da.mmarket.com tcp
US 1.1.1.1:53 loc.map.baidu.com udp
CN 120.197.234.165:80 tcp
HK 180.76.11.136:80 loc.map.baidu.com tcp
HK 180.76.11.136:80 loc.map.baidu.com tcp
CN 120.232.169.204:80 a.cytxl.com.cn tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
CN 218.241.167.188:6503 tcp
CN 120.232.169.204:80 a.cytxl.com.cn tcp
CN 223.109.148.130:80 alog.umeng.com tcp
CN 120.197.234.165:80 tcp
US 1.1.1.1:53 wap.cmpassport.com udp
CN 112.33.111.233:8080 wap.cmpassport.com tcp
CN 223.109.148.178:80 alog.umeng.com tcp
CN 120.197.234.165:80 tcp
CN 120.197.234.165:80 tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 120.197.234.165:80 tcp
CN 218.241.167.188:6503 tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 120.197.234.165:80 tcp
CN 120.197.234.165:80 tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 120.197.234.165:80 tcp
US 1.1.1.1:53 alog.umeng.co udp
CN 120.232.169.204:80 a.cytxl.com.cn tcp
CN 120.232.169.204:443 a.cytxl.com.cn tcp
CN 120.232.169.204:80 a.cytxl.com.cn tcp
CN 120.197.234.165:80 tcp
CN 120.197.234.165:80 tcp
CN 218.241.167.188:6503 tcp
CN 120.232.169.204:80 a.cytxl.com.cn tcp
CN 120.197.234.165:80 tcp
CN 120.197.234.165:80 tcp
CN 120.197.234.165:80 tcp
CN 120.197.234.165:80 tcp
CN 120.197.234.165:80 tcp
CN 120.197.234.165:80 tcp
CN 120.197.234.165:80 tcp
CN 120.197.234.165:80 tcp
CN 120.197.234.165:80 tcp
CN 120.232.188.83:80 da.mmarket.com tcp
CN 120.197.234.165:80 tcp
CN 120.232.169.204:80 a.cytxl.com.cn tcp

Files

/data/data/com.chinamobile.contacts.im/cache/data.txt

MD5 25dd996c70c5c44ba0e432b24dafe71c
SHA1 544630e433f32bf9fcfd32369bfd746bea1ee033
SHA256 bbfe0838264391a036db7b91916085c8c77829aaad2ad980c734d3a62a9416d3
SHA512 16491e2deb6d258a7a66d2d89937235370ad77572fd5e805d8282332761b49f87ef479e5dfd16cf2a13e6079cb13fc54b2c025b54277314d0be8f0b8c6c4737d

/data/data/com.chinamobile.contacts.im/cache/data1.txt

MD5 c57e629b8b5d88679ead62cc7e3f0cd4
SHA1 e9e5754c639fbb09b4d02271bf1f222abb302aa3
SHA256 9a350bfa59e5b5254d4f16aec570e85e27aa275363b375b825ffd2e31993a740
SHA512 bf54539c3d5b524fcf2c79d18c205c88ec07be0c91bd36a6078e4c7b914833b9efba424a64b84740e4700b4fdfb02a1a6f1cabdcb1f7a7854de075818899d1cd

/data/data/com.chinamobile.contacts.im/cache/data2.txt

MD5 30203c0645b1aa939656bd2cdf723470
SHA1 0fe918455f486873ea5f740171c3dce2118391b1
SHA256 81f75fe46b8211b4eeb4181b3c5240cddaf1be50de9a16e839017ccc846b5c64
SHA512 02b4019130f552d8e48cc12f91ce230d7e88395486897e165c28803eba1431b2ffdc885e6d08b4fabd996ee25f3563f5e5ab24fe89a24e1997ea83c17aac192c

/storage/emulated/0/data/com.chinamobile.SmsParsing/358240051014041

MD5 d30aa29af341c5fae71590b91dccb410
SHA1 c209586fbba27fb58af3127d52f688de5d5a13e3
SHA256 abe5f655743fbfaeebe0c23af8d216f1d5ba2856e197490ba0f1a35d03476483
SHA512 90a1724d23ca647030d8da2ef4fc4488071becf302de3ba24927e8c574a8b8647ec36d1743aef2b687788d86b453db6404e4bef2bba601f954ad454b1c580e4f

/data/data/com.chinamobile.contacts.im/databases/safeCommu.db-journal

MD5 7b92ec5962c8ba29dbde1aaeaa154fd3
SHA1 c05e925d2033227adc1e5c5ab79030c4600b0e3e
SHA256 bc8349d5101fd388a30816d556097a35e0ac0d525c2359aee89a807e3f964cba
SHA512 f1d6d05db1bdabd6325a54508af2ef38828304d9fccb470e896ce6e2d4010c6e375540b008e8329de6bcb1c4f96b681bc0342eb2bcce8dfd1986a460501589be

/data/data/com.chinamobile.contacts.im/databases/safeCommu.db

MD5 d2984c107ff98d271a3cdc0e7318a6a0
SHA1 571b4351b0af24c3bbd83289e51371b1b51285d8
SHA256 ea76d91b49d5fe5110633870fdd14dec38c3b98d536b2336f76bab1b6f05e46a
SHA512 691829283deec442c0bcb32aa21600b8f1ef8eb625d39f7662c6be45e3dc4d9a37a5a2c80bb51749a193fe2fd74a1125bdc262d869471ee91f2f4df60888d62d

/data/data/com.chinamobile.contacts.im/databases/safeCommu.db-shm

MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

/data/data/com.chinamobile.contacts.im/databases/safeCommu.db-wal

MD5 ba7dbce27575f1db495fb1f79b981183
SHA1 0492657dbecca4177bd67ff9749d47b1776ad045
SHA256 ee331436aae8470d15e1cf87580b57e416d545aadd4c7bf832d9d2463e380a16
SHA512 021f733ab6b419f36128d3aa8b2b72a9581d4d3138d4a65b1efc7af63d45298774e507bb37f2db0013ede373d9407d94b327929d89de288c79a7b8cae587c97f

/data/data/com.chinamobile.contacts.im/files/StrangeCalls.db

MD5 2f22a79d16210a6b1b32eb837ce6529c
SHA1 ea99083b7a8a6ccd0d8aca9a527a5b6ab187b67a
SHA256 6f9fe9f968d814544e2cc851b7f85cd7f02d5b26b2e9db1496aba8d43c3042ee
SHA512 64c488b4a3d89d00cb926e495b01fc9cb19d2307e58797c9bec32b1718faf1577b1cf5be3c84e0043580ad535a6788d11352df8765d7e75ecbe88563c3cc8610

/storage/emulated/0/baidu/tempdata/con.dat

MD5 71eb4f1d9d79d32fcfd592d3ab4c5c78
SHA1 2f8f63a8c0ef2e497d514d0622a3f623c818320d
SHA256 3c86f566c1373ed6f607261771df16b9450e59e51c77d2c3df8976629508fe85
SHA512 32efcf39afa1db84b95e4c0d0d3354145afcee649addc1e33a94c59d78c67c92d3bc31440407594ea1357caa60d6e95ef38a0567389701a121993789c4ed5c75

/storage/emulated/0/baidu/tempdata/yoh.dat

MD5 0eaeb299a02ed6674ea081eb086fc815
SHA1 8d7c79f0746721ceca1ce3f4059da0c62e7dc119
SHA256 954afb55a8313bc0f40dd4060f60facebc821a8b8bb25c17cb9420d4fe162513
SHA512 5212550f9f9b83f85b355914faf26181fc7beb03a2fc5ee6c2ea8db7b1c4527564f1ae9c12de16aaf15541b5842f7ff4008e5888aa8dea57dfbd68b258581638

/storage/emulated/0/baidu/tempdata/yom.dat

MD5 96fe21cb931cd442070fdf88e35402ed
SHA1 a7ae3ef43ac12cb3263ab0321c73a78cefc69adf
SHA256 881634cebf4629d1ad83b58cb89ea4892ae679b11742358bcc10365698a72ba5
SHA512 22744ba8aae11e5dc6227ce87a5f8a258672748cc8d89f1791afe4504c61f6639553bf9261594267a3a284a25de8827a4651429bad3df14ed0629f50c19a124d

/storage/emulated/0/baidu/tempdata/yom.dat

MD5 1ad27fe36b770c681a61f4a9a3aa7a66
SHA1 b91e0a4bb4a9570f9b2b0712081ee51f63d2879f
SHA256 6fb86b95b2040972d7bf2ea3987d3b6c166bd0207d43b2e93024a1b44f172a18
SHA512 595508354c8038ebb3dd9ba3cab54c271a9486d8bbd327e2e752299d37e2ebbd885118465e7750499b2e8be8e3c305388722faff4607a8e602e68808189f1802

/storage/emulated/0/baidu/tempdata/yol.dat

MD5 a936690571e9104e1922dda4a0ba5bd1
SHA1 65f49c57edde2f96be2a1dbdfc3f7351f1e66554
SHA256 f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412
SHA512 3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394

/storage/emulated/0/baidu/tempdata/yol.dat

MD5 401ad25928d3260da089ac8788d25653
SHA1 c06ed96118749893e1088bee977763e9ad02a8a6
SHA256 d3c09079eec2cc14163ac742ea801d85cd4d0e818e92735affb822caeb886f0b
SHA512 7c1970296553c3e0aaf26e5503297075116c6ba59bbd39e22bc8c6b33441c8218b35640cc484604ad2dd9d091970b3d06c2514f6731bd43b201fb93aa4c6a45e

/data/data/com.chinamobile.contacts.im/files/com.cmcc.aoe.keepalive.pie

MD5 473b337bca6ba765a28435407d312c94
SHA1 c5b4c63be30d41e564e2ee4fb49b3d948c1210d4
SHA256 fc145b4d09aa68ff77199731fae514adc3499063f4dc4d06c206dc05fb6fcdd2
SHA512 5fe7652c0773a5fc9674b4ef845863d6d07496f2d8e6536789b9bb387e045df01b1035c85400ae389165df11cc1e2678a7e6cae1656b76b00055461e3d580924

/data/data/com.chinamobile.contacts.im/databases/aoi.db

MD5 40e10b72e6cd15a2e81f667745395bb9
SHA1 43d89ce268153523d372b67751a3c98be3d72156
SHA256 1877553a2ca289d41066b1e03e58a374391e0435b283741fb4f2df7b91e41537
SHA512 b27d3a5621205637f52b6fbbe6bbaf1abd5765ca3ff548710bcc9eec7f3b414b9ce51e2dd0b5d37fecfbbe1f85e0dc1350c05045cc55386e31a4d130a20b885a

/data/data/com.chinamobile.contacts.im/cache/data2.txt

MD5 640f67e0b70a4a56e504a7b1513c4987
SHA1 48b6c60f35bdb5b5c826ce09e234c38b23931670
SHA256 2429342a6c7bb095c14a26affe05bd3c5f810e7135f7f282ed9e0981c1d47db7
SHA512 58c286e1829b593bb72212301a8224db70ccefce18970abd56315d5cdb2e170d67af505402e4fa66e5836e3b7c44dd426fdf5dd44d285568d4e62aba456dc0c4

/data/data/com.chinamobile.contacts.im/databases/aoi.db

MD5 e0e1e6b09efd4c928c13fe88f0d6c82d
SHA1 e341fe31cc0347cd8be5ccdcf93b37970026d076
SHA256 d4abed1d405f4c6d2971c1f4fe1263f7a6e5f746fc2ae1b47988031cf43d5d06
SHA512 9aa10cbdd2e6a4a6ea3842ed4505f82f4cc1e319fc89a1bc5fa0374ea2b1d828377649c4264f0b9b9e7f8748a1b299e956618240d9a0931abda617d835a79b2f

/data/data/com.chinamobile.contacts.im/databases/aoi.db-wal

MD5 fbfd45ba7279dad4d4bcaa36611d3dec
SHA1 bdf0a1459fa9f31e0711f3b6d7c465fa1110c459
SHA256 5d6ba82ae693ed072094e4f34b3dbed693b7575aadd78948d9dc6b15478dcf32
SHA512 2218cb4bf3879cea4f7cb550c0d538c9a2cb6d4c02fe857cba77dc84d3b93e1e580b0d0136d57efa4fa6b05041677a247fcfdad4dc4675a14f5e0d3910eb3962

/data/data/com.chinamobile.contacts.im/databases/aoi.db

MD5 d72a6dd9004fb80b4c00b6bb709f1785
SHA1 e7e52d79784e3fd28d2a9306a458190f5e742b33
SHA256 40bd8648d0e181d6705ef53e5cfa3097e3240ebc19a905cbc928e2f494530310
SHA512 8da010135f1f3c576772bf9c9e5f4a55e7a56a2b1e0bcfe282a678eb67117d7d9f0ca63474482776a4e16e342988f3be39996e0e49d150c8339ae39a9e880f83

/data/data/com.chinamobile.contacts.im/com.cmcc.sso.SsoService/test.jar

MD5 81db8fa13b8cd632b5de67ff35fdbacc
SHA1 c7ce60ef2310489bb9f2ab4fa9b11cd01ab161e2
SHA256 0437d2c2103ce311fa1fa50cc1cf71fe14a6456550e248444893cf84f4388748
SHA512 13a0c2a6a8f54b3d5b689fe1f4079750e187df946c63f2b550f2b57eba3d5c4e7ed39f7e47cdd833813a40fe01a21f50a75f726ba1231099e67113e28f1194ab

/data/data/com.chinamobile.contacts.im/com.cmcc.sso.SsoService/test.jar

MD5 e66d92f3a7be4ff6efe5d25f7c2509a7
SHA1 7bf5519e89f82e70a3b04d89c6526549b88684f9
SHA256 5ccd36568a847d57bf7e488144c44e22882c95cbe87b00ce4ddf1eee12ceb699
SHA512 c3e37b3ecd4d63be18a0d8348bf83381705a395fe6ebbe93929ae8ea9b5ef5a15e6237e80e8fcbc3719898838ec27c868425f3c044200190cc93728f3f0f28cd