Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
419c8d747f0f2ccd379f715fc3b82515_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
419c8d747f0f2ccd379f715fc3b82515_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
419c8d747f0f2ccd379f715fc3b82515_JaffaCakes118.html
-
Size
175KB
-
MD5
419c8d747f0f2ccd379f715fc3b82515
-
SHA1
29c7d820ed2b610fb495b7851ffc3fad0b3a9e62
-
SHA256
cdacb6c4e0e6b2c07f6b82a986e6f687d28a6226129829540b8ed130959b23d7
-
SHA512
9d6e911810232d36a05139fe0a6d3c0e02fe498c5bc7bf6d8163faca57b845978cf226df5d1effb9bd47df76eea6ac1ed689808caceb3bf11866fc6a32df6298
-
SSDEEP
1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3sGNkFYYfBCJisE+aeTH+WK/Lf1/hmnVSV:SOoT3s/F9BCJiim
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1664 msedge.exe 1664 msedge.exe 4740 msedge.exe 4740 msedge.exe 548 identity_helper.exe 548 identity_helper.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4740 wrote to memory of 3880 4740 msedge.exe 82 PID 4740 wrote to memory of 3880 4740 msedge.exe 82 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 4332 4740 msedge.exe 83 PID 4740 wrote to memory of 1664 4740 msedge.exe 84 PID 4740 wrote to memory of 1664 4740 msedge.exe 84 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85 PID 4740 wrote to memory of 4312 4740 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\419c8d747f0f2ccd379f715fc3b82515_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe69fb46f8,0x7ffe69fb4708,0x7ffe69fb47182⤵PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:22⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:12⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:82⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:12⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:3692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:12⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:12⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12993393202431824139,1102674639404298062,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5192 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5056
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4692
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3224
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize432B
MD51bddb80642eb9562fc05ee6971a91f58
SHA1164790bb34ed96e968b312b46003de488c645770
SHA256a869fb375630182b4a6e95fcd1020e992030e1b58516f46ffcc4419a82ebf019
SHA51248c6d107a8e20f3ba437b94106890a9177467c41a6db5231f8a0efa6ff956c98c2816f13235d6724a463068df2d33c93c71bc60e37da8cf2789e58264f1f64cc
-
Filesize
2KB
MD5aa91c041ebf54ee78d638903897fc45e
SHA14427bd403af0f72639e3a5d646b4670f47c10f63
SHA256a41405349856e08d4baac67a5c62593adcf2df80e9c58ace93c79eaaa8183652
SHA512da6356431664e68242ba89d79796d2f2783a248a702e9534a71076af60ce9e94355553d0cc868bc4663451c81316097b33d83f2a67b79dd109c4ea0277e10900
-
Filesize
2KB
MD5c5858b98d5be3eeefcf20bdaa994fbf3
SHA17ea173b527c08e50a1d7d2b872a48a309e51f4d8
SHA256e38e86ceb3f8039a3ff05b965ce3cd91734bc79a96959ad9bbfb8bc353bb8a8b
SHA5123bd8a7695db00d4d36b08da7301982987ddaaceb5250177b3f5b6f74a8b63443dbf9854b1229588d702a7cbaee43e798fc62588a81f3fbd9c4510b6bf51eaed8
-
Filesize
7KB
MD55901c3b86c352302a64358112ac1668a
SHA12b4bf62cfc34af3c7269f667a2ddaccd26efb898
SHA25637a11cc7b9e56dd5be882dd9eb2ecaf70da61c469ea22129f55e3fbd160ee9bc
SHA51224bfa5e61f51807354e2b1dd13d4bd344ec2cfce72ea413157ee3976f673511eed7338fd52826b4217934d1af625cc4855cd182cc42cabbdb6dba807e2476cb9
-
Filesize
6KB
MD563c1985f824de2c623686833b6da55a8
SHA167fc2c62b1a3b85e52ba9035e50e2c82a0ca2825
SHA256bc9f639aa54549841bc68b3c4251036d95dde53d56c5a072f44487222d37586a
SHA512070bb55acf9cbc51e1714662d05e5055cf9cb810a22068a8eca5ed72e346833ecc1ed59e1828fc832657575707551aa03ca6827f7981c3a80fa34681de4771ad
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD59057cc32e9003441778c9a682b5123a3
SHA1d88536df5fbe17e10b4125b3a4db0856b878e8a3
SHA2569dede9ad366e3ad49e8b7248643fc95433d67eea747941c7af1acf1025f4a577
SHA512358d930a89dda59b728b502883c7b183c1a3a5630615e0cbdf60c1442c5a048cc96d07a0f15f537f608251496026c7f0de1731425d83fe94de2268552941eaf0