Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 05:06
Static task
static1
Behavioral task
behavioral1
Sample
8d6e8c03a1c2b6b7ce4828289e6be624_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8d6e8c03a1c2b6b7ce4828289e6be624_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
8d6e8c03a1c2b6b7ce4828289e6be624_JaffaCakes118.html
-
Size
15KB
-
MD5
8d6e8c03a1c2b6b7ce4828289e6be624
-
SHA1
5a1d7d80607d13eae0c7828d5f97f69c45ffad96
-
SHA256
4108ba1c3a3d2e6cc64ecbc48bbd5734055b40d3a066ef938518e3b0eb1a9020
-
SHA512
1d70e85dd2ebf265a899bfb4455ea0b5bbe7a4b52a8e34a2e66d916584fedb96e4ab46f36fdbfdb7003bc1cfde67c3411a2c16ba0897c630b534b329d3ba11af
-
SSDEEP
384:7p9cOAowIrTXHwubyYeYACLrBaOJgMNxZuD3Xkkgqf2V:rcOpNrPyYeAbTokok
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5116 msedge.exe 5116 msedge.exe 1768 msedge.exe 1768 msedge.exe 4244 identity_helper.exe 4244 identity_helper.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1768 wrote to memory of 4740 1768 msedge.exe 84 PID 1768 wrote to memory of 4740 1768 msedge.exe 84 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 2236 1768 msedge.exe 85 PID 1768 wrote to memory of 5116 1768 msedge.exe 86 PID 1768 wrote to memory of 5116 1768 msedge.exe 86 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87 PID 1768 wrote to memory of 1692 1768 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8d6e8c03a1c2b6b7ce4828289e6be624_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b8ed46f8,0x7ff9b8ed4708,0x7ff9b8ed47182⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:22⤵PID:2236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:82⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:12⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:12⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:12⤵PID:2204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:12⤵PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:82⤵PID:796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:12⤵PID:3012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:12⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,3871399567108816079,11341943348138973402,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5240 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:396
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4468
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
210KB
MD548d2860dd3168b6f06a4f27c6791bcaa
SHA1f5f803efed91cd45a36c3d6acdffaaf0e863bf8c
SHA25604d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77
SHA512172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD509ba6cfc93a1c20039c810796c0efa30
SHA1c1c76d11ff81742fa2006dd2b9b8b5ebac553a6b
SHA256cf045abe3b1acc27f7834835ed35f3c55b751b197a117a17d3606468e825112a
SHA5128e3bbb36a1d52bd23f2fb2ea4270fc28e1ffda774185034ee14cc8ae54dcd989ef2ddcbafcdc3bb13e1b84921b67bc95a17394097a32059de59e0b0eb4151f22
-
Filesize
1KB
MD55e1cfa657fc1bb1eebefa88233c7517f
SHA1966c28a5fce1c26094d7c0cb50e4bbe69cd5ba89
SHA2568e3112413f1e1dcb41b21353dac58d3f1570ba49fce6cae6306a49c7b8fe3dd2
SHA5122a65c6a2e1395862ffa41eb7280c55ca241fe3fab8458e3f605611c3d1a4523cab7e356da8ff5bb9ce4b8ce3b43f643d15d0f02a019c5ab8ce1a73f483e048ee
-
Filesize
6KB
MD56f2138a91acfd9813738eaa0b393abd9
SHA1b32136a93299d3c7a09e12970c9355c8cb08f2d3
SHA2565c5f1bc656b901197e58a3aaca1f83b407253300be307c753abe7fde40651000
SHA512ac72f1ee1f4efbcaa47639b9c7b9b1a2de85ca90afaeaf82bdb5ccc4f8ffd4385c48d29fd7fdbf6d990e1cc1ae0d1227edc3aaea220c6615c90de52fd640fa16
-
Filesize
6KB
MD584eed6a029c1ad194a7b0cd51d626c4b
SHA154e8286b4319e9af197aeb314862b547a48e2272
SHA256d89d65b84adb548daf65a14787daf17ba05d3a2ac61d52871925bc9b4665235c
SHA51263388c9b2084a8b489ef50c145b613844c9d6cd2c2c21152a7e7d30662ccad426b98c876927f1d34bd5c4248b4beea7b8e42e4dbae65f7ab8d876e3c4035f228
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d30594a289fe4ca70c57fda6ceffce51
SHA1fcd856197a2154166fb86e5f80a880eb40ceaa83
SHA256ccfaac7b150d7be9bb09ef7b07bad1ae11446a2e3972b476895df8582c5d0653
SHA51263175935cd41d89fc6a637caaf6fdbb4c6160169f79758f748d9cad12ff222eb9280a9cb14a3e3e92f751a1eaa1465123fb87c27247018900d6f1264d4661a0c