Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 19:35
Static task
static1
Behavioral task
behavioral1
Sample
db14ddfe05f6a53143c3d93b1d4632a0_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db14ddfe05f6a53143c3d93b1d4632a0_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
db14ddfe05f6a53143c3d93b1d4632a0_JaffaCakes118.html
-
Size
175KB
-
MD5
db14ddfe05f6a53143c3d93b1d4632a0
-
SHA1
b9d6a94777ab6a50ab8c2507a21f6adc4b730a18
-
SHA256
5fd62cc9232ff5e50f015fe07b4d6943e5731a9530ed31c8daec5613aa7346a5
-
SHA512
a7698eab4352cd4c0c4d37b186b7a7f62df85c07c97699d48705db2b468bd1264ed47af1495d4c366a40367f04a52769d521396a6cb83a3de1821301811b1cc6
-
SSDEEP
1536:Sqtd8hd8Wu8pI8Cd8hd8dQg0H//3oS3gGNkF+2YfBCJis6+aeTH+WK/Lf1/hmnV+:S4oT3g/F8BCJi8m
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2572 msedge.exe 2572 msedge.exe 4340 msedge.exe 4340 msedge.exe 2540 identity_helper.exe 2540 identity_helper.exe 5264 msedge.exe 5264 msedge.exe 5264 msedge.exe 5264 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4340 wrote to memory of 184 4340 msedge.exe 83 PID 4340 wrote to memory of 184 4340 msedge.exe 83 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 1956 4340 msedge.exe 84 PID 4340 wrote to memory of 2572 4340 msedge.exe 85 PID 4340 wrote to memory of 2572 4340 msedge.exe 85 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86 PID 4340 wrote to memory of 2836 4340 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\db14ddfe05f6a53143c3d93b1d4632a0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffae1746f8,0x7fffae174708,0x7fffae1747182⤵PID:184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:2836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:12⤵PID:2132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:82⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:12⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:12⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:12⤵PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:12⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13715373504316570412,16395121680373937689,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5188 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5264
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4124
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4144
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize384B
MD516df72ef98c9f05f186d289a3c4d04dc
SHA1d3cd47787e55e07ff353c351097d558e06206336
SHA256b876989453a70f1077f44e9e43bec3ba49dad1492d887cb04e6d276da1ef77e7
SHA512d826384b99d32dc489809ef29b6c3b0f08105f0344e1f86ecd42231aa5f1143c6d37697e27f956635a32d33f4c6f502de93dc0ea71a2d9b9d4810d5a3cf990a2
-
Filesize
2KB
MD583044e2d0c97c45cd4dec49a01984759
SHA1464ed0bb5194f8bf47cbfd7adbba8ca2cc104f76
SHA2565add9ff9f8fd29297c3555816ead4b092c4954f74aaa99f50d9332b99a42e8db
SHA512b99958eac18bcd38dcb17482e15de58266a1781b38bada00f02dc43429caa54ebba45084778b4868491a185ea90809daa9489288d427e14f1bb954fde25df024
-
Filesize
2KB
MD59f587d0b0be99b731a54e43af54b5fb3
SHA11c8318c1e1a4a433a929333f1db943df62392350
SHA256c7dbb99b4df27cd962badf5b3047868eb879cab56a4d00f3539da68bcf971bc7
SHA512af06531d0612fc64bd761795c02ee4a34141875dd28675c6167a6946ef84034431b67b177f6f2abbfa4c6fbed874b39861655fd85d7c180ee860870b9cb9ce18
-
Filesize
5KB
MD54513e1025c10897ca80cbf2ce40c60ae
SHA1f47e9cbd28e0d88068054bc36eeecdb223dc6b4c
SHA256f623a805e254d562269231f6349a57d34391ba6ad42a55d82ebe6439efa2ae99
SHA5121f9b8d7d1f2e2c5fb8b4795af55597618d26577cf307c826cdd781fb912a5051e49ab13a9e06429d33083681a05bd91f178b1485a4e6a9856c954872cae24b5f
-
Filesize
7KB
MD53aa138459334a741a7030533f2f6ca98
SHA1cca13872729f457974feccd11585f5b88fca954d
SHA256ceb7525a610c5ffa1c5a6d866c32d243f4396527ea40b0f0d6298da7d656b381
SHA512a9f8957a300fe30587f78292711b96dabf611b2bbe586cf8e313b111097de027e5f4000ca4abb4088a22091954542c70fc9638a7700f96b0d6aba11a2702172b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD583d13f1c693624c42f1648ffa99c646a
SHA1ed2544ef11cc836f6084f2b7df1df584ed4fd169
SHA25639fcfd042aafb108c1f9f2a961f930af98622a1a50969534aa51a71036713320
SHA512cbe3a5fdaec2132e5d1024c08242a57478af2f57d6272190a7969fcdf3ffccfa63568747a8aaefb7d1d4f57c37e7656fc4415c57ebd949126643610886fb45e1