Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20230824-en -
resource tags
arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system -
submitted
26/08/2023, 11:26
Static task
static1
Behavioral task
behavioral1
Sample
8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665.exe
Resource
win10v2004-20230703-en
General
-
Target
8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665.exe
-
Size
363KB
-
MD5
f8ff4c3e58467c6cf508406d8e310d4d
-
SHA1
0f184a551ed3fee20debb2e62e22cf2aeb6c9712
-
SHA256
8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665
-
SHA512
a3db0bd51604f347c00bc151e11d573cbef1f3e1b256108900a536ed88467f93115c630b26331a8f3ee1692664828cabe071c906b9ae3591c1d075d3eba78c33
-
SSDEEP
6144:5NgF4DxNuJc06j4YBa77xMQxA5i5knmv1SL/mQXhmFDW:5u4lNAtYytvS5Aku1YLgF
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007527a1bfe6a818429fcd5676e9b72b2700000000020000000000106600000001000020000000fc7d685b1ebeb7415585852977e86a8640024c3f88ba6ea29a56391c4633cb98000000000e80000000020000200000005a6b4b5f832f0fecaa5e97f9598e6a86207050486797e494ca80ff51f350d8fd9000000089c84852ad45afc29a52279d26120d8512de875a797800bf5751d270531d51c03334e3f6252e894c24de8384968a6104b35a4fc8e5486b5a1179bd27167694028831a5c7b64b97286507632fa38a9a3d04166335b23c55204fa2a0d0cf46296ff50deefe0c99b0fffe97050f7dbf123777b84727775ac203691eaaac99aded5bac1ce3c698bd3a5a5ccbd1b93c8ec0264000000068fac47d8d6a16254457ec12226e85fac24fb2906583f7290151f0143be1622c2157b205990567610ec457f20a6afcb9ef4fab69d12584e9af49bd7c56ef51dc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0beb13f10d8d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399211045" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007527a1bfe6a818429fcd5676e9b72b2700000000020000000000106600000001000020000000bfdbf5a64b190e8dfafe28a22a843e0dc28f06af688e705477ecd3c0ac508fe0000000000e800000000200002000000024788be93ce0bd23f2ba438d5bf50c2af3cccc356ef0e90532bf7352ca65c87420000000dd9f66c38400b014089f58925a6ed88e248026b1bf790ecdb99a2e1a6a4232294000000030ee88246b6618272ed82a8cd6f62bf2bed6a3a6777c1b3bc94bf156c0fe357f11785fa44f73a8b5bf2fae8767ad9fb7328c67589b236eb265ad0bd310ff32fe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F5A8AC1-4403-11EE-A6C7-C6EEF923EACC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 932 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 932 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 932 iexplore.exe 932 iexplore.exe 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1580 wrote to memory of 932 1580 8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665.exe 28 PID 1580 wrote to memory of 932 1580 8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665.exe 28 PID 1580 wrote to memory of 932 1580 8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665.exe 28 PID 1580 wrote to memory of 932 1580 8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665.exe 28 PID 932 wrote to memory of 2944 932 iexplore.exe 29 PID 932 wrote to memory of 2944 932 iexplore.exe 29 PID 932 wrote to memory of 2944 932 iexplore.exe 29 PID 932 wrote to memory of 2944 932 iexplore.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665.exe"C:\Users\Admin\AppData\Local\Temp\8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://skjp.zcjczj.cn/bang5tao.html?s=140&v=141&c=148&a=163&m=&t=16136402192⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:932 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2944
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57a4b4f974bb203cd0621e664036d1586
SHA192a0773a0a4cf5524e7787cf3b3ae8325cf51c8b
SHA256daa6bab46beee3196fb2ca066f8563d7700379551b4cd94a6e6da37e3b1392a9
SHA5120e6e79f19aca87879e9d8228e2dcaa01462c689e8c5335e78a18291eb457a487dc711424da06d178d6091a04167c7e207b264a22d260d381a3b787b5d99d3a25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c4987d2a17708b0cace966f22204b1ac
SHA1221c3347f29b9934bc014539e87bb5425615f159
SHA256fd5d4f18f83efbb0f33e7f3f21bbc08000604c6ed1340f35bef885d2b0337988
SHA512fe6b2b7a9b9aa6c86f601dd6e160ddaec868c1e1b5f522d1ff5c5ec6983704c5a4104ce413751a5d337e1b5e4b568cc9b0df272cbecd0a41c92ae1bf3998eae4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5775f63132f1f2470869f814afd784fe0
SHA1fad4dd03d868c6f7d022564fc6453947d073b530
SHA2568bf8648c0a9760964445d87e03b74ac251384eb878a70812bdc40482b5a3414e
SHA5123b7edf989fb841256d7ca290b44543dd93a11e55615c8c3a601f247cfef87cff409ef1b5b92a8a2a2d3c2b9f5b7df6701334715dc600f036dcb4072251468f86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD559e906fc74a3d1075dc4fc52d3d80075
SHA1321170c039cc977de73d3173b93c967949893615
SHA256375b57bba78a4a1f9ea16c3f2920abdc557159ff224514473dd1117e48682014
SHA5127342f9927124245f12f8d2efa78c1a9f6e71d3133f0c060e14c010e8d75232dc65c693cb260debe799969f3387544292abffdd887f152d177e072528f9026954
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5395a9919cd50ce47d10857c2165ab84d
SHA170d6fee65d594eb6e5cd1f1677a58b297ff0c3ce
SHA2566a6a68339d7dc5162d8196ef5171e78b201781b70eb2effce32b06aa77e16d86
SHA512cf7444ebdf6f860aba3091917f8630435d78314a00c23267f1d10e69385a81ac41ed5976226951773def242b036018b0ed3638afdbd397557ae2906eb249e375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50b8d265775a669dd5a064e64e2026f91
SHA1d713c750db4637312bf902714b2a82a934853ca9
SHA25640bbcce579d5292aceb7fc07711d30a965661120fd7683bd27e1ab22dd83e9d6
SHA512c68d9f655542b00a499c9031781aead7663673d777521200bc1b676d27ead43c3d3dea999f8b9870a709ab32b74126f373a23aab88bb06a9d5b4f6524e2eb3e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a2b837ab7ce9cafcbd1906b3da29ed33
SHA119af8dbb69c277e4ddc8e431d6138e09c62eae90
SHA256cf8083de7a9d6beaeb960f64c5cedda12504dca8174074e7bd0c756c164ce388
SHA51268a0defdb7f5d6935c307e7d06aae5de850e4b09b435532e04a239754ad6938b804f985d695a858083dbdaaa2c10006d6e54046d2de6465fd3fe00212a9637e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f3706230bb842c9c834a16b8750bf1a5
SHA1c951f76e544d3ba0feb78fa5fef2a29f43e8799a
SHA2564e45d763c1a15361ca27582bea92f09fdcab1faeacb3f027b33387d71b34a9ae
SHA512a569bd474c3da2444cffe99638665a7d85960aca8aa5b4fc3f0e36d3de697e4e4037a86abea36f2f53199d1d15eb8ca48f3a8d24f6bfec24b875e06714f5cf03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5eacbe5d1ccfc23213914c51a3fa5cbae
SHA179c9e2239a15c6b03444a0945ae14211b30f0b3e
SHA256bebe6416cb616fe4daa07de31716a738a8547f4d4bc8364358357644b920fe7e
SHA512aa5461d3a58fd668d2564c517681a35f5a3815c161c613a658234f7e558aab85798f4c6235f708cbcda68f2cec2b7f8d1c75186dedc38ebe9c62f99f72cc62e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b46a277397975e12fe34fee9f7ae7d55
SHA1121f932707218cefbc51f4b8018686e5d1efcb38
SHA25616869cb646c0c06d524e7c1069d149f090c3d41a7eacf93380b817f007a8c481
SHA512feb1b82104119ba5091ec3bec2b5d87692e1b57ccc3fa18c38ed85d323044b916ee98ae141685f8782257ec5f7f6031e50e2758120fae5f81175088bf238322c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51fd3e5d8b0d52ae3bace55fbd977467b
SHA1198a74b6eeac699be459376e32665fc1cefa8d5e
SHA256ef1c0b8990a1533082d0433328dfe933a40774e57e7307b4ad2cdf5e4d018949
SHA51216f2e4ebb3a30adf7e901cfccf76ba522d88a764b1d1ac37243759b09b633ca9d9e670c3c420783047b9eec8215c1b8cc4cd4c837fd393c994a599d75fe7d5f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e104718f551b971e70d0b8ede7622340
SHA175720409432a1eb3476f2bd43d42da07c09dae23
SHA2566f4074384cecb257c585b47b99a602618d67b4091d975d4b97413409ef8ea7a2
SHA51294d9e6e1784f26326db49b2d348840e58aa3b9da7f21dda52d076788e22d52d0239c9c1da576d34517f0930f4e3d073964e0b9de10e5709b0744a8c4c4503acb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55317a3d808a152ee5ecb83ac37744224
SHA14fc9d8663021a54b810f56b9d8ebcaa83638d0cb
SHA256b9ab696111c29d30000d760c078980fad35919a8017b0a2fb0d83e95c425a738
SHA5125b9d2065fd59db4418ea4f7f0ca90444e96342b7f11560b56ae472156494f7600729fe4a2bace4dbae3202435aa87e886cda97f0113e09b4acb8f4c483699b07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51129c86fb73a374dde996340581c53d5
SHA1553946257aaf877c338010ed209ef36f1ae6e183
SHA256aa332905afa0d6f0f128b3aa61276659812870febdbfa28c7710977b5f640f08
SHA512cbf2908d89979ff4e0098387cd3651ab4dec10a2713b26d3d6c32ecc670c30ae3c7dce0c5ab8a715641e3e6fcbcdbcb8befffcb255d8f2e7a57ae5087aeb0ac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD527f54c7e6be41871d901e8009cbd4ec5
SHA1cb900ced8fbd4ccead862203112c85256f1d1ef7
SHA256632740c6f37d0f213b26aa59d844f6abc17ec1dd30cb79ed1884149490aa0805
SHA51270833f4c128fd3265978eb50057693c9aff89dfae81e36ae71f125d286e1b998db3ddb777d2243cd81553383eb2961850f1394fb967c4f8556019d375bec2ebe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51fd3e5d8b0d52ae3bace55fbd977467b
SHA1198a74b6eeac699be459376e32665fc1cefa8d5e
SHA256ef1c0b8990a1533082d0433328dfe933a40774e57e7307b4ad2cdf5e4d018949
SHA51216f2e4ebb3a30adf7e901cfccf76ba522d88a764b1d1ac37243759b09b633ca9d9e670c3c420783047b9eec8215c1b8cc4cd4c837fd393c994a599d75fe7d5f8
-
Filesize
61KB
MD5e56ec378251cd65923ad88c1e14d0b6e
SHA17f5d986e0a34dd81487f6439fb0446ffa52a712e
SHA25632ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0
SHA5122737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf