Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
86s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/09/2024, 13:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://robloxhackers.lol
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
http://robloxhackers.lol
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
http://robloxhackers.lol
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
http://robloxhackers.lol
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
http://robloxhackers.lol
Resource
macos-20240711.1-en
General
-
Target
http://robloxhackers.lol
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3944 msedge.exe 3944 msedge.exe 2948 msedge.exe 2948 msedge.exe 4412 msedge.exe 4412 msedge.exe 2764 identity_helper.exe 2764 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2368 2948 msedge.exe 81 PID 2948 wrote to memory of 2368 2948 msedge.exe 81 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 572 2948 msedge.exe 82 PID 2948 wrote to memory of 3944 2948 msedge.exe 83 PID 2948 wrote to memory of 3944 2948 msedge.exe 83 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84 PID 2948 wrote to memory of 4520 2948 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://robloxhackers.lol1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa645c3cb8,0x7ffa645c3cc8,0x7ffa645c3cd82⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:22⤵PID:572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:12⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:2764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:3012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:12⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:12⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:12⤵PID:656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:12⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2979170534238579644,15054795036123129379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:12⤵PID:4964
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1676
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50487ced0fdfd8d7a8e717211fcd7d709
SHA1598605311b8ef24b0a2ba2ccfedeecabe7fec901
SHA25676693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571
SHA51216e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993
-
Filesize
152B
MD55578283903c07cc737a43625e2cbb093
SHA1f438ad2bef7125e928fcde43082a20457f5df159
SHA2567268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2
SHA5123b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize456B
MD5fe188d386a2b82e5bdfe95332b57e538
SHA117c841ed7bea8b9eef6399aa1cae69b8909d4c21
SHA2564b2adc9511146a8a42942b1d168b7a0988ab34566a97ca5e7843846fe1b2f745
SHA512e66389961bcaa92b50f8e73345c2ecbd2db97684d43ca5148e833989ce04a8b90a3c646078f97e2ab5df98add0bf630c8a1bea06ad51109029615003e4819287
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize624B
MD5403ac658fb0ccee820e1520e020daa52
SHA120ea34dae78df60cba5017049e2ab9e3182903f3
SHA2562549d87a14c3dc55636501514bae5e954b31f237935029691844ec6b12f3ba32
SHA512b6926b84dd3bc44177f16f2b8c65a898fefa3d77ced2fe864091239aae6f07a8fca338632cd81f40b6eb391280c1bca8cfaf7563cf237b9067b3e73ae424800c
-
Filesize
3KB
MD5bafdb058c0625ca86c358a34672b895b
SHA1db36fdeabd4b2e5a9a148f4abaf9f26f7635c586
SHA2567e2eff938590d38e2317b12018ddcbeb15de4a409cd3419829569a26ff2b9b4e
SHA512ff7c20cf4007ce202522cf75ff55902b21643dc6b70786119dde686d401a50363a812ec91a6de37525835081632cdfd8c996387f1db265f73d27af7d80b1cad5
-
Filesize
5KB
MD5f246df6b2d6e4becb78c48aec6edde90
SHA18cd33e980ccb4e70971f333623499e3d1644f061
SHA25689cd734502c28aba5d5a0b18d645aebbdaae6c21dd0ec0d879da4ea21dbb03d4
SHA512c65bef24eb36ce7283e898d8ae5f771a8ad3888b92feb3a16e5bec8479eab5fe5dcfa1a515ae1440c75f32d70d77e5059f5c8ff0cdf3ffe8fc1a71ebc8752952
-
Filesize
6KB
MD55558964dcb4df57a109a11df1bfcba03
SHA139a3a0db44f4aabfbac9cf601ac2b6ae211a0e99
SHA25677fbaae4ad5dd129a1f23d2e7990ecdd86405d3f4615fd25fe9c49c763430b0c
SHA512cabbaa1e0fb4926d23183e517ebaf3b5d323791c06aae56b838c97fd92b38743a27f1a1f1abf42adc7745552e8bceebd18a4d290447162081c31563b2109d285
-
Filesize
368B
MD51127b4d104e8c44a3ed7fb462e7fe02f
SHA1e75b13ba0b1ae49b3a264379c08c05f3b38bb472
SHA25624ddedcbe6367e104668d311fb0742822816409b78dd45d5e04cf3974daaa686
SHA512aebcf68d5647e709f4f9a00cb9fc6244a98a1a3c2fc8c8a2904f9f851c68cf6af4cbf1e8b3b516c5256f4ca89bbcde7da51cca1d30b208b90e814038229fbafd
-
Filesize
864B
MD50c34a17670bf63d86b8a80748e045c10
SHA1c8d13062d34f166b2ee10b4c2f9c56e9666c7ddc
SHA2567e28a0d5a8994547db50222fef15e1e081be0e932acd1ca963fe75a92bad99ff
SHA5126a3ce0e7e73aaebebf13694515465a3ca22242dac7118b0da3dce5971df1840f3700fa95fadccd54b3fa23b5def838e7ab4d69ddd5fac27e80e43a6507156599
-
Filesize
370B
MD516862ae21d2fde42e48d04565086f96f
SHA12d0567d41a5b2afb338209163ef42c207002cac3
SHA2568370868635da1e56236d5b32c0936d133546ac9b6d8f72021edc392295e76dfb
SHA512fdb58a442bee321404925f0f1d0d4841bfe6b6c4a7c9968fec7544c795f0b17d3659f2494d4a9723b4631cdb297d2d0e7ef7873f132adaddb33d1e8e4c919c29
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD5d05aa9d70aae65462369d123c43c1d8b
SHA1949b7ffc40c12f5d88354f18e29864783276422b
SHA2564d2010000bb745bf117148e0a9ce08872f8808f6725936edfd287860a8267b7c
SHA512bd601775b442628ec708ac0e0f0aa26bd09267bdeb51dfa29389916f7334784d45adb4c862540f113cd1aa23d7b87d175090b8f3bafd03da9ef092417d805a60