Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 18:00
Static task
static1
Behavioral task
behavioral1
Sample
681f03b862763b48bb3a3578f603a244_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
681f03b862763b48bb3a3578f603a244_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
681f03b862763b48bb3a3578f603a244_JaffaCakes118.html
-
Size
175KB
-
MD5
681f03b862763b48bb3a3578f603a244
-
SHA1
861f89894c095ee4418f36c8c80550b9f075feb3
-
SHA256
90e72efc3ff0b6382e4013140fc926a531b2a3f009be44206e7810a058420af0
-
SHA512
05e85b95df3e28425c8b2426779ce45155da396dd565eaad65c2de371d2241817019f45f0869c5ef798214cec31fbb47045b18692f706a118b007a955fd6e355
-
SSDEEP
1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS37GNkFfBYfBCJiZR+aeTH+WK/Lf1/hpnV+:SHCT37/FcBCJiwB
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2120 msedge.exe 2120 msedge.exe 1184 msedge.exe 1184 msedge.exe 1572 identity_helper.exe 1572 identity_helper.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1184 wrote to memory of 3728 1184 msedge.exe 85 PID 1184 wrote to memory of 3728 1184 msedge.exe 85 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2988 1184 msedge.exe 86 PID 1184 wrote to memory of 2120 1184 msedge.exe 87 PID 1184 wrote to memory of 2120 1184 msedge.exe 87 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88 PID 1184 wrote to memory of 4000 1184 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\681f03b862763b48bb3a3578f603a244_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd7e046f8,0x7fffd7e04708,0x7fffd7e047182⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:2988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:4000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:1980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:12⤵PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:12⤵PID:3388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:12⤵PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:12⤵PID:2292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:12⤵PID:1160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5399015162441076838,16434016497986082774,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5436 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1400
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4956
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4496
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize432B
MD515697e82d95a22a96616ee7cd797d4eb
SHA1b059bebaf6e55e486b6c506e5fcd475360b9c87b
SHA2561fdbdb3b2ad26cba682567c9117b7876a94718df9cf0bdc28bdaf33b3c7d84db
SHA512b1da4fc1b283ca0b0a3e643ab987168deb9e51560b212ca2c36c768022f9d67241433c5575f404ce38a167f6046df4c0f1437f080c20eacfc8e2b9b552611d1d
-
Filesize
2KB
MD53557382b49207dc2029f9d41382bfa62
SHA17c480203053c385973bb78a797baac28ae52c6c9
SHA256b954e718b3bd184f28eeb8302bc3e979ccfb7aa4a53f913ba0c2a74ebffa2ec4
SHA512dc90b2ad90adb6186c00d8fc54ad6053774bea2a1c1118e0d62fa8433f9291ab40ad667292ba8c0622eae9dd242f0cb9c702711e3d6d854716162a30b806f444
-
Filesize
2KB
MD5395183a7364c0e5e98848bcb3b72a75d
SHA132e31b14798f7c2642d12e302b60da59d69bf464
SHA256903e3e8eb181d5aac412a85406a67c4cd5c804da00ea518e6d5d9f314bc3b8ac
SHA512d873ed3535b96f55ef372f0ca71e3a1bc346152ed30bd5fb2100cacf478b6bedcdf621058d3a66a894974294f05fee74e96268890e6bf868ff71e1d465b8d42a
-
Filesize
5KB
MD549eada742a7e7940ac7f0a4d5be314b0
SHA1b1c89a12ba0b7eb12e74574e662ac7f4937f704e
SHA256a5bd160c688c352851d85aa01cad36845b1bd8395107df052c975b257fffa851
SHA51254fbffd5c6b7295ca3c94d35dac7281d98175dd31d79a94f314cb2406060f845294deb6564df5a1a993fdedcb829e0467d1a6006ff29e147eaa95e6e33adef37
-
Filesize
7KB
MD5de3a4450d7dbf889ec71e4d15c4ceadf
SHA1dd766b0497a7b2688d918a830868b73b384f2204
SHA2567c7815f0d4ebc76e7a4e87d4bf87434d0e1fe45a7874ac963c42c615ac74b2df
SHA512724541f1f59164060e764b6ec84f95b0da58c74665cb049630857fc4b75f09e2d09abea389a05c568d752b0e1fd86aacb83a908c346d2fa4bac1b9e9d5802935
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD50324fcab557c3f059944f264d63a4b80
SHA197b5b8ac1d9dd44db83fb14efac24d2dbf3af656
SHA2566293ed1ecceb3c5d57b0b1ef186a38acf1c33d1fd6cd73f9e1254ca360ad2e3b
SHA512a0bd2cc4e7d3a4c3bca0c8d89e152a1971c8b3272febe601d0e814aa6fa0daa1b3058707e2cbb6295e542d68877f3eb13ea6c2f223e2ca1aa81f2265addd6304