Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 21:36
Static task
static1
Behavioral task
behavioral1
Sample
9657b9734bf223f4977ff6096926e510_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
9657b9734bf223f4977ff6096926e510_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9657b9734bf223f4977ff6096926e510_JaffaCakes118.html
-
Size
175KB
-
MD5
9657b9734bf223f4977ff6096926e510
-
SHA1
9e871442b73ac8626f9596170d84c298a61311f4
-
SHA256
1415f205c916904fa4ec00082ca2123ce08a34cf72d4462c09193bf8e67c7523
-
SHA512
49113936ca1a175af483b5339d74b0a41cfb0c62010901a6114f0cc5fc649a773e1c9a026d9e805ea19fee7213dff9d09cc340b2a3910842502f6acba3ae9f75
-
SSDEEP
1536:Sqt58hd8Wu8pI8Cd8hd8dQg0H//3oS3gGNkFsYfBCJisZ+aeTH+WK/Lf1/hmnVSV:SOoT3g/FJBCJiNm
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3544 msedge.exe 3544 msedge.exe 3224 msedge.exe 3224 msedge.exe 5108 identity_helper.exe 5108 identity_helper.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3224 wrote to memory of 688 3224 msedge.exe 81 PID 3224 wrote to memory of 688 3224 msedge.exe 81 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 5024 3224 msedge.exe 82 PID 3224 wrote to memory of 3544 3224 msedge.exe 83 PID 3224 wrote to memory of 3544 3224 msedge.exe 83 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84 PID 3224 wrote to memory of 2652 3224 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9657b9734bf223f4977ff6096926e510_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd521f46f8,0x7ffd521f4708,0x7ffd521f47182⤵PID:688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:12⤵PID:3368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:3804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 /prefetch:82⤵PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵PID:2932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:12⤵PID:1936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,10695896417902045201,7384119070685513193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2004
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3556
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize480B
MD5f836782d1911fcdff1fe544ce5999764
SHA16d9fbf33587a15ee47bf1aa6310f45726b9e423e
SHA256ecd438af0b1479dd270e39805c423a0c50aaa59bf49e6b7c819315148f75cc12
SHA51240b6dd9516560e7006533bccb6eaff3c1ebd9e96607e80302a8450936ec174e73eb23531d4b4f23554c3f642e6edbe2815dc96047747a9912b5d00e2506625a2
-
Filesize
2KB
MD5586f0854027467cff9e2d81f28100252
SHA120ae3d543d93b7c4e9f5372a0586640a39e4512e
SHA2565fb23d534eba1e76aa794db75f58d448166c00eb37d16bf974ca788447c51a5d
SHA51224396d9f6e84180d8aa3a15606bc7097b5a6de22ea8c29879937f7e415dc1fbc30eb0ca1f88e0a05bdb9d58b3af1399687a8788894ee463d22f262525c62a9dc
-
Filesize
2KB
MD5ccf763932d469132f0507229b605b1b4
SHA10bea9a172ca15f8380fa1fc2a2b5af0d5c7d03b5
SHA256d0d87227609c53a86e5f91acc2521fb0e9330c88693f311e4c9a87e5ab8cdb86
SHA512072e13bcc7ccbc6d5d385d3331fcc75b3092421acab8b46e4183ef43c414f0d7c72318e1c35190a5d72391b181b8b6c19c1e23cc2af605ef2c45ceabc8fde1c2
-
Filesize
5KB
MD541d08ea77d6fe84f4900cf0e83d5bd3b
SHA11c929b32ccbfac4c92fd4555b2c587750ea6354c
SHA2567d6a9b056c77f8dc09d74a4d4727561c0df84841db570cf3095749c8c823d695
SHA512815a18b496424f3a8cd9f3606465970847b379733c19568f5afa622c58b6426cbe2f783a5044034cba9969b17010fdd017e319e94618278dde2c63c0a9575b5d
-
Filesize
7KB
MD53568ae55a76d538e87c85f4da0f1a205
SHA1f3e10389586af1b20251eeea2cc5af50228c20fa
SHA2560214892f57e3fded2bef2141d739a8a542b41a5cd0015575f8c706b76b6463ef
SHA512b04e53fd0c5caa02bbc05a24f9cbf09820767ba5402576b1d4a36ac4c8c6f6995817afe1de642e3a8b2e9cc10045c55bfd1b9879d0da4a2e8fb93a7b4c93a53f
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5221e9f9c5ba6eff533f4e8f7338c7aa4
SHA1e4dc4ef23eaf9595f1218e101a5c67f62e965f6b
SHA25690a3e7b421fc89f8351e5bda14f0c0dfd9ac466ca13a5f5a2ddc2ff2ee192c26
SHA512abe4e8928e85fb760108144e4e021ca96686434dfcd77b26511276fa0169bc84d384fc6e23e86d4eb708e12ba07b30719e00f29632a2100bb435b23f5e08104d