Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 03:30
Static task
static1
Behavioral task
behavioral1
Sample
0db5cd2ae774234c56f2b7d3d29d00ef_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0db5cd2ae774234c56f2b7d3d29d00ef_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
0db5cd2ae774234c56f2b7d3d29d00ef_JaffaCakes118.html
-
Size
14KB
-
MD5
0db5cd2ae774234c56f2b7d3d29d00ef
-
SHA1
3bb06c416cd0b7fb10ca34dc945faa18c7e8eb90
-
SHA256
6f725db358e38183392d716357f286e90b4f50f3c9d62a3aa6e475eb93a361b9
-
SHA512
cc3914569ce4bd6d88ec6f2b0fdaa1337926c5e9d8210ad3397f4c8a9d27f747a2361ee6fb174a082be7727168fe911c9a65c4c2cf723229085c877c9995334c
-
SSDEEP
192:clMwht5jcZ9h001oK204h10pCTR4YzJcjo3iEDf1hQkNxFHBYtgy/Y/mlmP3KTA5:c3BcxlaLvTPzJIo3XzQETHPa2V
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1648 msedge.exe 1648 msedge.exe 3768 msedge.exe 3768 msedge.exe 4500 identity_helper.exe 4500 identity_helper.exe 3444 msedge.exe 3444 msedge.exe 3444 msedge.exe 3444 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3768 wrote to memory of 4452 3768 msedge.exe 82 PID 3768 wrote to memory of 4452 3768 msedge.exe 82 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 3604 3768 msedge.exe 83 PID 3768 wrote to memory of 1648 3768 msedge.exe 84 PID 3768 wrote to memory of 1648 3768 msedge.exe 84 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85 PID 3768 wrote to memory of 1096 3768 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0db5cd2ae774234c56f2b7d3d29d00ef_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff904ef46f8,0x7ff904ef4708,0x7ff904ef47182⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:1096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:12⤵PID:2316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:12⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:12⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:12⤵PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:12⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:12⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7108410215718721874,7013592559060958130,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3444
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1428
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
213KB
MD5f942900ff0a10f251d338c612c456948
SHA14a283d3c8f3dc491e43c430d97c3489ee7a3d320
SHA25638b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6
SHA5129b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5e91772e896c9cee729618a13ff21290d
SHA1f08c4aeff0976c30b555d9da5fd806c84550cf90
SHA256f9585b1eff2ddc61f9dd75eb1a03371759832e94cd1e5a51f2553ff37a97a2a5
SHA51237249719c457d44b2b9ec285885e3dbd98c8262755a9df48eb2bec7110bef14b004a784a226b734d536f785c90b5d229bc358e75c0188defdc549251f14d1233
-
Filesize
1KB
MD5f7ef4c3018319636d6d373ab28aa3e3c
SHA1216e222ec235cddb2e05c2df37af45e07ee4822e
SHA2562e45640b6b157499ca1b1618a551f9a4a64ae9257cfd77e16554c0c3593e232e
SHA5127f06d42507265b8c5ed39cc1bd1ecf4a3b99bd413414d32c079a855137ebdcb62f450e8ae2f62bc309ffc581ba590419a302d4744196ed154b14ba9accf4a2a0
-
Filesize
5KB
MD5de66d41d651d9fff2fe59fd2d662414f
SHA1c46a7b205ce8b3cf707d465c59a690034a31427d
SHA256997d625093eb49c5f18faede26f79e4ce531782777c808d05e664895b2bf364c
SHA512f47a10f4f462dcb28fb5212de673998da419e4c57cfc1982475fbac070809b6e1c03f87de3bfc2df4636ab562259c743be236badcdce432f42985c0d0bf0d6b5
-
Filesize
6KB
MD5eec707cdef2a1c332629bc6e19cbed31
SHA158316f466ed963ee7d7750b34b46c4f4e40f4a19
SHA256d84d5eb08acd67d667092c239fd042cc29d440a5fd7effc85578944135957a5c
SHA5124c744df6bc9bc72bfb9f91aecab690d81a5aadac897daca1a16435b9d43a439bc533dda167b317dc418790d18190fc17d4594fb60fb3a4233f9dca12f31490d5
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD541433158130de6effad760b5d4425cec
SHA17dd530eca5a7a621aad27408a32f47fd8f9fe267
SHA25682d92e88365900abe0c8ba841e9ef690c8dcf14b478c388efd0b7a8bdaa2210f
SHA512640bc512d1a712b8f1fcbe83b8cc9acdfe74034d30b483ecb6a6617c7b89992d99a8d6f04cac8fb35c064106875ad1f0163d7d843d2229f8d3ae4f6c528e92d6