Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
5ef7504b2b640e7c3e84db3468b588a3_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5ef7504b2b640e7c3e84db3468b588a3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5ef7504b2b640e7c3e84db3468b588a3_JaffaCakes118.html
-
Size
175KB
-
MD5
5ef7504b2b640e7c3e84db3468b588a3
-
SHA1
bd52a5a24de46e28785c37b4fba79b97294540a0
-
SHA256
b5b6f0f6f09208dede4d92ee62a60fd9013df527189c53e3d62477f2b9ef3e70
-
SHA512
1f03873e45540edb20d4344e8b32f692f732e770f1b5b740a0f0eb07b7911319b6f1e1a4fca5388a7d9d66cbf5c2d4d418a2c043d8824c550b8d3336c895da73
-
SSDEEP
1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS39GNkFGYfBCJiZL+aeTH+WK/Lf1/hpnVSV:S9CT39/FPBCJiiB
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3600 msedge.exe 3600 msedge.exe 652 msedge.exe 652 msedge.exe 740 identity_helper.exe 740 identity_helper.exe 5260 msedge.exe 5260 msedge.exe 5260 msedge.exe 5260 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe 652 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 652 wrote to memory of 3752 652 msedge.exe 83 PID 652 wrote to memory of 3752 652 msedge.exe 83 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 1560 652 msedge.exe 84 PID 652 wrote to memory of 3600 652 msedge.exe 85 PID 652 wrote to memory of 3600 652 msedge.exe 85 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86 PID 652 wrote to memory of 636 652 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5ef7504b2b640e7c3e84db3468b588a3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdb8546f8,0x7ffcdb854708,0x7ffcdb8547182⤵PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵PID:4408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:82⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:12⤵PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:12⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:12⤵PID:5172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:5180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13165938227568304724,14662073618598658950,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5260
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2300
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3260
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
Filesize
243B
MD5f3d106ee361feeb81c07ce7aa12d3470
SHA184abc03049292a2ec5594464d1010713b9f72f28
SHA25660f45bbe9de3195b370a41e0e0dc5712a432677ad8e89e2626c804169e91206d
SHA512dbf40acf323fcb91fb19cb725ffa1916c1ee1f486a0d8bfa6ea6fd20d4fd06cceb8ed97f558d4d6cbd86cea7dd735dfa9427c93f6cd2c040d1940c0747a85267
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize360B
MD5b4b6c430989fe4bbdd4e061c34ae41cd
SHA179db5a72272bb103fdb92eee7e8969706134dabd
SHA25686dfeb9a4de7339581e409dff1667cc8ae0c38bed78fb70ba6729e15b9bb75d2
SHA512554fc7f7879d284076989d27bb400367d9ee30645f9ef0ac96ff1544b5f77575291dec44d598fdf3b40328a0c0b09ae6ba6f350cd07185c1117c47435f13f191
-
Filesize
2KB
MD526727e34992f7d1dd7f92fcdabf71f4a
SHA102412ed0f76e71714b827786feacf47df334fbe4
SHA256059ea4e7fc8aba97f607ae8909938c0c1602d185f93331e1b17338d415a20434
SHA512cc4c1c93d3190b5537480ea3bb27fb556a30c53626be21ef9598e678ce5292aeb07ae306e24d5dfe8967fa34e0ae86c8fe8b7dd30617d9ad89dd74798f9517aa
-
Filesize
2KB
MD5cd41fa4f68474a458343218f88664f4f
SHA13b08b6bcd8a8d96121f678a834c72079d5f0900c
SHA2565c3a90afbc096e41e796003959d29beba7a96949172c5be2916db09002547e06
SHA512bcf4625be20ac91b71c2e6b42ecbed9ee782aca7b8a9efa1f94a22e3622aa625fbaaba1889c037f7df5c16fcf416b660b549a000e10e668bf2784e75bef9e82c
-
Filesize
5KB
MD50d4ffb0a6d7346b8ea95159c471b00ad
SHA104987dbe12b74bed1bc0d8c7d35cdc75fba21261
SHA256c121bd47f2dbac038a93e06b5d39fa44919f651a61c859d3ba67f0d417e42232
SHA512698454d8e6e487539c7446cc2e8d1dad25e51da6e9cad1f9b72d85dc3c169681f78c13f2bf372aac082dc1163a25d94fdc3f21120ce0d06ff3a2392dedc012c6
-
Filesize
7KB
MD59385e1a6765239936fe12915b81dc82e
SHA1fa065da83366c9ee3ea9773d8c6b0c3420c37e05
SHA2564bbf51f94d6b8600ce6ad70fce661944cfc35e5ef3bea595c56746fa233c34a1
SHA512c60e6d6a5249b1ae64b41c4046fbf71b6a6fb5696cc99b621a600018df7508b6f2b38eb6a1485e9d210ffdd772072ddff74dff75eb047c9a3098138968231f8a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5fa4dbdc3365221ca75976fdf757a8611
SHA11b1e18b9627aed26fadf8fa1e9cac9602924ff42
SHA256c4ee4f17ac8d15ed457f83885f653b18268433a395e6e7c545c874878d91ba08
SHA5122ecd6e6535fa5cf3c589598933699c15a81bf7062f732c17810efe9422a19c726f580686e3c0d7c3f00628d627bb8e564bfd366255ce073a9282b88f2253d711