Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
a3b485a261e192a324dfde4372ae0678_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a3b485a261e192a324dfde4372ae0678_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a3b485a261e192a324dfde4372ae0678_JaffaCakes118.html
-
Size
12KB
-
MD5
a3b485a261e192a324dfde4372ae0678
-
SHA1
dd276cb33526aacfe2e8b1058e29b65f7a6cb422
-
SHA256
d3596f85c2a73609702dbdc66aa0d6528caddbd0a4b35e52f749ddf62aeb134a
-
SHA512
6fe8a6ee1a4e26b23f181dd3866ca39246ac7fcbfadc789d9b8829e8f59aafb059a1674b14bcc05ce3d8340661dcf4dc6374fcee409dab496c35522dbc6a048c
-
SSDEEP
192:Q1hY5jcpNwVAOpUzRgUxhoePe+ltlv/s4ZXc1eGlmP3KTAL3E2:UIc0VAOezRR/F3lXPZXcdJ2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4856 msedge.exe 4856 msedge.exe 3408 msedge.exe 3408 msedge.exe 3208 identity_helper.exe 3208 identity_helper.exe 1292 msedge.exe 1292 msedge.exe 1292 msedge.exe 1292 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3408 wrote to memory of 5104 3408 msedge.exe 86 PID 3408 wrote to memory of 5104 3408 msedge.exe 86 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4020 3408 msedge.exe 87 PID 3408 wrote to memory of 4856 3408 msedge.exe 88 PID 3408 wrote to memory of 4856 3408 msedge.exe 88 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89 PID 3408 wrote to memory of 3800 3408 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b485a261e192a324dfde4372ae0678_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9addf46f8,0x7ff9addf4708,0x7ff9addf47182⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:12⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:2332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:12⤵PID:5196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:5204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5827940359517250939,1623900494338532913,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3952 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1292
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4776
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
Filesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD51fec0167ee29a68a57fa422d835b629d
SHA1c998cd3cedb70af5b6f054570072de8dd60e1349
SHA256b8f7a77dd984552f3e7a6772bd77ebbfad4b7ee81f087cae414667ffe3e7b833
SHA512248024a5e8516222ce68d30b781e8e621a951f38a98768ea33f35ecf80d9430609806b7fc2a10cf4f6a4acf3fc2ec52acfa21172aac7bab934ed507416ec69fb
-
Filesize
1KB
MD552d5a0ddbd73c0b07abde44335690c63
SHA1041efb36f15c5442522d6e6805c551de0c5eac7e
SHA25619e56e26c643de3b086ed1c295f9d326424a3e5369100493eb852e11524fbf1b
SHA512b4afcc4b7e01aa6277476eff8d229259893b01247c9d486909e05410aff3afb88745ee1c4404d1c24acc6d513766bf4aae80748808dd0600e5610b975089e548
-
Filesize
5KB
MD57ddb8bcda4e2535fac8157672382ca35
SHA1918ed4c266b82f6f328f21aa2f363d20c914fb38
SHA2566828cedb9d3f9254fcdcc3393173651a6bbed1d86cf428b23e06dd3d3ca58d3f
SHA512ed16931962b920ad15c03844c051f51e903e9a848f5525364dff16c5a1fc5467e1feccac744c79414cf89f80e26cdfbee230175e59e343412c470907525ecd2f
-
Filesize
6KB
MD59e8b0c37e8a932bc429cd06c7ad01de5
SHA1ffc885ffe3d4ef51425fbfbfe4c6f17ad7716654
SHA2562bbd71f8db155a195e1287f48e898e7e725cbca5c3dbc15351dc5c27f418a123
SHA51226125e22b79c5a4d1bcc06c9d6f1c8ee50dbb591cee62a4b5c41dee965fee00ec204f099dc56ac3fcd7134b4d8e1cd29c323c91dc130a351cd02778c8e02a314
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f156524c8bb9a585bafdc3c542d41b85
SHA1b80afb9e0af50f5ddb4efc37c6776942c902eb51
SHA256b120dcfaefc84f4c6e89f36df2f9069eb02f20e6d0c52c8e1bec65ffb652451b
SHA5123c42894a5f322e39131fde01a74fab24d16eb3c76467d11e3bf5f5241732f357b9a9a2eb8b592ddce8cb14404539d28cecda7ca4f32a634cee6c9807f001c948