Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 07:05
Static task
static1
Behavioral task
behavioral1
Sample
f576522a60d0befe584e7e73a6ca82ed_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f576522a60d0befe584e7e73a6ca82ed_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f576522a60d0befe584e7e73a6ca82ed_JaffaCakes118.html
-
Size
175KB
-
MD5
f576522a60d0befe584e7e73a6ca82ed
-
SHA1
50e345ebd91286614979f62d4001f9ca2287cb0d
-
SHA256
5a99f7050717505176d32c63fc3aac377650ae21f2033a341c92c60f7e40f3c5
-
SHA512
bcfac2bfaecc41c9b504bb5c9d281a39000b55295ab02bdcfc4f3316578ad853795beb69084b86434279f97be5b8718448f40a8536bd82580ea93b338fe1e2fc
-
SSDEEP
1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS3/GNkFCYfBCJiZu+aeTH+WK/Lf1/hpnVSV:SHCT3//FTBCJiJB
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4696 msedge.exe 4696 msedge.exe 4636 msedge.exe 4636 msedge.exe 5084 identity_helper.exe 5084 identity_helper.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4636 wrote to memory of 3080 4636 msedge.exe 82 PID 4636 wrote to memory of 3080 4636 msedge.exe 82 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 1724 4636 msedge.exe 83 PID 4636 wrote to memory of 4696 4636 msedge.exe 84 PID 4636 wrote to memory of 4696 4636 msedge.exe 84 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85 PID 4636 wrote to memory of 1768 4636 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f576522a60d0befe584e7e73a6ca82ed_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade5446f8,0x7ffade544708,0x7ffade5447182⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:82⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:12⤵PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:12⤵PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:82⤵PID:3348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:12⤵PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:12⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12970398823575679851,6464291301272574139,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5888 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3884
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3124
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1496
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize432B
MD528ea65c82470a761f7028cec95198378
SHA16ece32f1391ba6a677ca2980500d34975b2e5909
SHA25687a7a8a1f5a97bf3a870ec3169ff2c1c6a22561255184113dc37d2a17a3a4d12
SHA5120a594e82aa8db573cda3b516f0afe5b4321271b6fa7009ef43f82d060e5f100a3d34faac8a2ad3f73b972acad89eb538c3e37eba8133d28a98ae1fe65940d644
-
Filesize
2KB
MD5df70eb54350eb981eba4b13f4976cd64
SHA154eb46d27c2149ea839652094489d03d3c561a7e
SHA256ac69f4fb7e8062c054b30572cb0bfccbfad0bcd1fbbdcea290820146991023c7
SHA5125e7e01217278da5671f045977b0b12748590b32bd56b829c93cdb15b92c1965cf74f1b6ad074b97285b98185696404a079576f86418d81af3cbe33ccc2b10f84
-
Filesize
2KB
MD5dd84c07c002ccc107b9be64d9530830d
SHA11f81e4cb140da8c355cb813580f45064b46c0ad8
SHA256764d3b393d2cc475c87483240b076a3d63d514316c96fcf7a27758eecb234f77
SHA51286e13a2e753b3d16064c89ff9121403ee9db8fe1e8f00226b09f426473e34b25490656407f06627fe6a1aaee01bb1626dc455af09849c48b513f9f1bbc49f626
-
Filesize
5KB
MD5c30f3bd72d0c872f60dcc85f448b2412
SHA1eb2918e6b56856cecb494a7cac4b17197721223b
SHA256afa219986fdc074d3a3df09bdb386edd9e55f9a8e55cc02eda2ddf31dc67af8b
SHA512d503c097dbc56db7e47e5e3be0bb3397092f32b21bc3f5c5340ebe0fe69eb22637ac422ed7411f07b700ef0b0da0323378c81366142037ecde7397025e986669
-
Filesize
7KB
MD5499007765371178908284ad29a154465
SHA199dc3bbf7ca509c381e3578de35b995eaa073a77
SHA256a72b6f8166d487d6f874356e2d71167ca8402702e7d9aa7d03646fb530b91003
SHA512f0e555e1977ddd7774b3aa08f0ca50388a3c21dfbb2dccca74e9e07f056bed18a5b711e1c275b0ba86690d052a34966dc7021dd61db71aa751df25fc7fb823df
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD519f3c30e5adfa97070fd09167d256d16
SHA14d2b2bb02ee791c9eaf735f1082ef779ac008ec2
SHA2562c0039c85ac7c740cfd60804f57953a1df6be3f081d8e265cceec71b7f25144e
SHA512f8eb50300e18d193fab3d35d25b1ab32554bc93f72cba1e3279cc37ba344a88295a56cd005803706c80e82f75db03215117bafc3fbfce88a7d0c2cba65cdd123