Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
fce11667e9d42e8ad84cebc5bab55d31_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fce11667e9d42e8ad84cebc5bab55d31_JaffaCakes118.html
Resource
win10v2004-20240910-en
General
-
Target
fce11667e9d42e8ad84cebc5bab55d31_JaffaCakes118.html
-
Size
19KB
-
MD5
fce11667e9d42e8ad84cebc5bab55d31
-
SHA1
b3b93145dc7a6ced993f26a4f7ed72ba6c066666
-
SHA256
3121af307880eb4c0b0b23de0ba826e1ca2af4f2b2be061073321c19c30e5f0f
-
SHA512
5d88f89640b88644b28e6d5e899facee5e3fbd4a926b699657db0831b337feeb9bbf65a525323c6357637b416685ef45d335560c5732705c6bea99e2e9a0e42e
-
SSDEEP
384:LnFppqz3gY3Uf0i3gyzg7X/RzTjGhGBNfkp1mOfT:LnFppq7WnwRHGhGBOp1m+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4476 msedge.exe 4476 msedge.exe 4664 msedge.exe 4664 msedge.exe 3696 identity_helper.exe 3696 identity_helper.exe 4136 msedge.exe 4136 msedge.exe 4136 msedge.exe 4136 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4664 wrote to memory of 552 4664 msedge.exe 86 PID 4664 wrote to memory of 552 4664 msedge.exe 86 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4048 4664 msedge.exe 87 PID 4664 wrote to memory of 4476 4664 msedge.exe 88 PID 4664 wrote to memory of 4476 4664 msedge.exe 88 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89 PID 4664 wrote to memory of 2032 4664 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fce11667e9d42e8ad84cebc5bab55d31_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90be046f8,0x7ff90be04708,0x7ff90be047182⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:82⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:12⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:12⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:12⤵PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:82⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:12⤵PID:1660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:12⤵PID:928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:12⤵PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:12⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5324 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4136
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1792
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5db1ed3bbcaa8e96c29a0b57e72bf0319
SHA19bc11860837a2bcdd048613ba8dd76d6d77d32d9
SHA2567c7db5dde536599fd7ffd4dee8e03ca0f6680e662022869057b09a4635b9b87c
SHA512eb7375877e9b51ebcf8cfc62cf822fdce3fdce837fbbd00d4d54c52c4f67bd82408e4809e1c92f32e9f3edc9e6726910f752fbeaf14704745688b0239405e6c8
-
Filesize
152B
MD5b4b5eaf7edd9d5391ddfdb694e0cd888
SHA1d1f92fbd238c4d5fb6861a83153893568d514586
SHA2561d5fc1e6da67b60df30ee83dd11359ec3dbe0c4bdddff2f2f862fa9c4619d903
SHA5121b62d5740572b1c17dadcb83d9e0017d6a8ff94cc64bc024cc47fa92a8180f7c2d18bef79ddf5cac8a9a97ecefd8461b06665e522acb0c5857dac1a2838fc048
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5eb0c2fd40598560a5dfe668ceb167a82
SHA1d31a331fceef09599513aa0ac96215072629d5d9
SHA2564028f6de11e831133bef391836fec3b0ee06b8cd1097530c7af742b42a62104b
SHA5128171656cc8e9609be166223f4f6e42322cf346bcd2025b9cce19ab3a59a3ef15fff1e2f16ee0b1b2bac8d9f50dec0b1d06a10aa58420f2242e968c802a302769
-
Filesize
1KB
MD5cba07b405a692a40f8c2368f3b22bc7e
SHA1afc12511b7660a008fc5babe82d5e98dfccd4288
SHA256aa30c8e8f944c5ab80085e087a5b766906c9c961af4150044e17184191a190ea
SHA5120aea7d354966780f3a8aaabfeeda17663aaf4db2cdd942a19c0c70d02aef7f1c05b57195ce365391fcf8973182d0410f35bd27dfcf68b5c7c7391d4f57eb4e48
-
Filesize
6KB
MD5bc08ddc1da9031bd78d134a598b9f0c4
SHA1a1ed83ecdc2787b271b2ca9f204e33b70cbb7aa8
SHA256402022755a2f3b6dbc355d9d722d627265d2ee2951e312640177a826389da6ad
SHA512ee3d648769f4672544fd0ebe70c21cc137f0e1332f9c991b22eed1da6c846d20ea5a82a16c47ca28ebfdb8414e4c7031d002ba5d5b4254c68d77ab8815c70cfc
-
Filesize
5KB
MD5757fb30fbdbfe2931763e9dd48a25bfd
SHA15d97524a7cfad628772d8bdc4e41cebec88c9230
SHA2565404907ef971aa2b7e5e6ba36690d7f00e52966ec21476ef91a11ba622ec0046
SHA512c5e6a031d32aae9cd4c658aaa1e4e46cc808765b535ba4a1a7d3c17aca4da9dbf7b419af4103da09ef0a1a84b7bfef239db3e4a4fb504b3fdaccc1a13be5e302
-
Filesize
24KB
MD5941ea4c983b3cf877ce6e1aab38f2794
SHA1c4fcce581d0660a0c96d0579aedb528a8168233c
SHA2563d4479f291d239eec609801437c1962e41e19c53a3eadd2f95342167fa7ad342
SHA512f47836cc619ea50f24d3804a697bb562781e812a65285959d7dbce53db8945cbbab2f9b8290ba2bd9925f620858918ddc676c082cdadae8444a9751d642a381b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
9KB
MD5833bf60b2c3fd0cd79102b4246da2359
SHA1638ff49db86f9fcf17c4e5402de3a16855bb87c5
SHA2562cdfa8baa7bf50f33c77f3ee1b3f622fa88f72f827f80c64347ab336401234d3
SHA512737fd4925dd21096dd8263605a398ceab13841292800ceff81d3d7dfe7a2a13bd9734017ad89a8e67f3348da2a1bb9aab90249cc11e668839be54536bc313aa0