Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2024, 17:22
Static task
static1
Behavioral task
behavioral1
Sample
e80103a531fb64de170a5c7692a327d0_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e80103a531fb64de170a5c7692a327d0_JaffaCakes118.html
Resource
win10v2004-20231215-en
General
-
Target
e80103a531fb64de170a5c7692a327d0_JaffaCakes118.html
-
Size
2KB
-
MD5
e80103a531fb64de170a5c7692a327d0
-
SHA1
4c62d0d910fc7e2e584e36706b0b01da9a3f1874
-
SHA256
ce9deadba757bb5fb8a809d751388e96eaaf8b92238ccbe57bdd923bbcc1f046
-
SHA512
f42821e5335183b5d693eea47093b8cbdba6de27e96bd613dd4376a40db6da51ab57d91ca7f93dad93ea3fc7338a1ec168972710e17d7d9cb8b8bdc145a66a4b
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3752 msedge.exe 3752 msedge.exe 3180 msedge.exe 3180 msedge.exe 372 identity_helper.exe 372 identity_helper.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3180 wrote to memory of 1540 3180 msedge.exe 85 PID 3180 wrote to memory of 1540 3180 msedge.exe 85 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3004 3180 msedge.exe 86 PID 3180 wrote to memory of 3752 3180 msedge.exe 87 PID 3180 wrote to memory of 3752 3180 msedge.exe 87 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88 PID 3180 wrote to memory of 376 3180 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e80103a531fb64de170a5c7692a327d0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc96ae46f8,0x7ffc96ae4708,0x7ffc96ae47182⤵PID:1540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:82⤵PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:12⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵PID:3256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:12⤵PID:1016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:12⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4027823066130958149,10481436711192856210,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5256 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3772
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3524
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54d6e17218d9a99976d1a14c6f6944c96
SHA19e54a19d6c61d99ac8759c5f07b2f0d5faab447f
SHA25632e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
SHA5123fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47
-
Filesize
198KB
MD5319e0c36436ee0bf24476acbcc83565c
SHA1fb2658d5791fe5b37424119557ab8cee30acdc54
SHA256f6562ea52e056b979d6f52932ae57b7afb04486b10b0ebde22c5b51f502c69d1
SHA512ad902b9a010cf99bdedba405cad0387890a9ff90a9c91f6a3220cdceec1b08ecb97a326aef01b28d8d0aacb5f2a16f02f673e196bdb69fc68b3f636139059902
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD5427b98671ac200c0938fccc7544057fd
SHA1fc1d4fe3c41c8168256178d1b105bbf8a2870991
SHA2563f0e41c1be2b9ddb9ccc252ab74f1b09bb8392aeee67cedce232fc31abaca733
SHA512daad1058370c6d333ea8b061e747d7218c427e75495234b615d672e8d2f05026fd598a28442c1b84cfe34eda6634cf997042d1581c11b73a7fd1b3b72591bcee
-
Filesize
1KB
MD5f973a5133630dd6667f3191f46ce9125
SHA122e326bf705472a8b5aa7da39c9c8c64e4a8ec38
SHA2561c444ff5d31f1d6700b83706313ce48462b3c8e00351142a2ee82abdd6ba55d1
SHA512a7acbcb39b409b209645414857ccf6e4216d64b5399734a69d8189b0474d7c5ef9a0cba1304d210a701e6f2e1b936fa01678110e91d71b39916086b5f0d42394
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD5a5d201115d709faa7a629a9d0893af6e
SHA16b8340661d464e5458d47cf1022cad8479130c8f
SHA256c570ef9ed7727c1e30508ee2dd7e2ff21fbc908749280688e24685a608d541c2
SHA512abfc15aa62564dc10e52d967fa888504a602dbfab7c7fb84aa7f9e2630917d4334f5200774c349b4e68c30a9fdd93c823bced01ce4ef14004c96012ec1291f59
-
Filesize
5KB
MD573f999d10b947ce87d5fccd6e10c20e9
SHA1f3bfbbf443fb3a4f4dc72c3787ab3da3601a96a2
SHA256c09bd92c3678c72f8cb79c3664af3b06a05c757ceeaa8398d2f2aa5bd44b620d
SHA512ca98095760c24fabcd5c8b1b9eaa9ff83943e1f87549287e2b213acd62dee1f6ffbc725620ad8896a675ca464dfb444ce7a3a0306ffc36978c9403215acf12bf
-
Filesize
5KB
MD569c4a054526a74427792780f2180e145
SHA1c8b0377d273c285bcb37bf7b0c9aa7400a07ae94
SHA256c865ff18f0fdec761cfc217243cbb6f6c8ae0dd9f8b51aac33eeba7ded8398b6
SHA512d301f70e337b4983b6a92bc7f7fd04c286ca3fbdf5560bae9709394c02c2b9aac9520cf42e140b08a981b21d8dd93f7385251ec13f9a87d86b9b82379fbd58e3
-
Filesize
24KB
MD5c2ef1d773c3f6f230cedf469f7e34059
SHA1e410764405adcfead3338c8d0b29371fd1a3f292
SHA256185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521
SHA5122ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD530ee9d864feb228c4db42315524dd0be
SHA1b427ad2b882ffc3e7f3bf725a05b619dd51c0d65
SHA25644d143c9717d42b69ec0a7273bb435921c6a89ae9eabcf605cfd0f51541c6dda
SHA512dff155659119e9788e14575ef1377320a48ef7d9a7c460877482ec2c3b19d9ad9b5e5461686d7b021c9ace636c63c7d6349d4fa912eb45cec36ae70ac10199d9