Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 15:50
Static task
static1
Behavioral task
behavioral1
Sample
e0839bc65887dd6bba5fdfb0b24e7a40_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e0839bc65887dd6bba5fdfb0b24e7a40_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
e0839bc65887dd6bba5fdfb0b24e7a40_JaffaCakes118.html
-
Size
57KB
-
MD5
e0839bc65887dd6bba5fdfb0b24e7a40
-
SHA1
36f646cd8cae888c6139f6f1f82f127f96935474
-
SHA256
91fc7f436d3b28884c614ce767d2ae3002f1dc366b6db322014b25bd817e5406
-
SHA512
e7fbf775f852e173b02eb672a3dc855dd092219aa30c342a8ca88da5844d3b9c921be9c0b837c61e3cc5bcff9172487223c68647f0fb62012fb8441a4980aaf0
-
SSDEEP
1536:ijEQvK8OPHdsA1o2vgyHJv0owbd6zKD6CDK2RVro7/wpDK2RVy:ijnOPHdsR2vgyHJutDK2RVro7/wpDK2m
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1308 msedge.exe 1308 msedge.exe 4560 msedge.exe 4560 msedge.exe 2644 identity_helper.exe 2644 identity_helper.exe 4220 msedge.exe 4220 msedge.exe 4220 msedge.exe 4220 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4560 wrote to memory of 4848 4560 msedge.exe 83 PID 4560 wrote to memory of 4848 4560 msedge.exe 83 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 4932 4560 msedge.exe 84 PID 4560 wrote to memory of 1308 4560 msedge.exe 85 PID 4560 wrote to memory of 1308 4560 msedge.exe 85 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86 PID 4560 wrote to memory of 2432 4560 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e0839bc65887dd6bba5fdfb0b24e7a40_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa0aa46f8,0x7ffaa0aa4708,0x7ffaa0aa47182⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:5428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:12⤵PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:4216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:12⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:5248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵PID:208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:12⤵PID:6136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:12⤵PID:1284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:12⤵PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,11285003047855619727,17718973554915691968,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5104 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4220
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6092
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize328B
MD58ca3f97140ef89e6ef6388aa0ff9c0c8
SHA1a57d493ad63228399dc5b95070a346e002707fe9
SHA2567b258f8fac5819f3285c9131f0502377d97424d212898286e7783f457489944a
SHA51223c6ac250f3183d08623a167f345ca00d38b37442403c84e72184772f421edd7d0a3b88190e2c01abaa45233e07b6a3daee94baf277478bc2d853b63a2cd7ee8
-
Filesize
152B
MD5111c361619c017b5d09a13a56938bd54
SHA1e02b363a8ceb95751623f25025a9299a2c931e07
SHA256d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
SHA512fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
-
Filesize
152B
MD5983cbc1f706a155d63496ebc4d66515e
SHA1223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA256cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
SHA512d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize816B
MD5f883daff94f73939ed38524e088ce5b2
SHA111e367f39a58058eee9e1444c79158ef2ecce679
SHA2566feda6a28a317b8ce867db4d50f726f936e6b7b1528a727f217d72ea6727a1a9
SHA51291b62c9efe65d639cc08df6bf6e99fbc98bf818def56e7d82b72f1585c88bbd3ce0511444597140ad4e5f07c9fc2f8eaeceaf1418e530c8cd87b61048b381a94
-
Filesize
1KB
MD5388279c5ee1b55535c7126c860ec1262
SHA10438cbf68ce153f6c69845f9e2148310ccae572c
SHA256919856b7a3721c4c04f4c58d604caae7e7a2ac2a910eb763c90557f5ed1ad466
SHA512791bfd2358e52d324f96ffc889978731cb151e8fe0b407fe8aa3bdb69db4e33fbdf6371f2c52ae51027c028f4258b012d5da830091ca6b63f29ea5722ed5fe85
-
Filesize
5KB
MD58a5151829500788355c1ee879ee2b5fc
SHA16c0b8cba88144630a551b23ace1bf46af3438290
SHA2568f309dc00e89e89ec76a0f9c4e78a4053428a634c646d626a3509fcd99b3afd2
SHA51264d1efb19eadd0c38ccac5bf9191d6c357cde8c96671b47dae652594ba0aa795c6cd766eb46dcb036367fd33737384da3afa46e42da01344b120d89a21c7a65e
-
Filesize
6KB
MD5c1814a4afc3f4ccc8ba97c816a24b173
SHA1184e7d3828c2e0838e22541daf2cb006f2997263
SHA2569aa058c4c2820bdd7445aa5fda5453391314923a7afc133f4e24918f3c776573
SHA512791b12d07b6fa064c5fd18b9c9e81374114ed4db9f407f4d98ba35a43a9e192048f7557fea6a8e831e9008faf688e2afa5c7ba16084154b9d7f8f9624612220e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d3592028d841b7fde778f5fa6d0e1c34
SHA19a1d012a42b1b410febc533ab68c0e6843a00be7
SHA256bab28d1faf40c8f1e058d28cf3d044c2f3fd7893b556089e4d2559ca80410627
SHA5120f73615cf4dff7242c5e449d1e315fef2711802bdf7dc15084f46a9add13e9c262e37354306c8abca3a1378aefcd1f4677aa8767c5c8057bf91284a3313e1929