Analysis
-
max time kernel
164s -
max time network
196s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 15:39
Static task
static1
Behavioral task
behavioral1
Sample
dc5b8e9fae2cc285022a48e91a79b096.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
dc5b8e9fae2cc285022a48e91a79b096.html
Resource
win10v2004-20231215-en
General
-
Target
dc5b8e9fae2cc285022a48e91a79b096.html
-
Size
601B
-
MD5
dc5b8e9fae2cc285022a48e91a79b096
-
SHA1
9c55123825576475f4d78f45c679a494e29aed04
-
SHA256
f0bf76144a36e68788f78b67fbc18a3d19f4dfa3a12363f8ee0c4d27dd47c39e
-
SHA512
6200c861bedb5ca0ec3bfa20d8b33bd27b1a3c45b7b399a6bdf89b350eac4c243606db10574bea9cb9d8867baeeed39e42028b86607b66ca727ca3e18d00acd4
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A769F40-A108-11EE-9F40-4A7F2EE8F0A9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7024b2f21435da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000007673e669a2db8450c5d50b7d6ab0e9bfc3670993b9d922cb7740dda2785f96c4000000000e8000000002000020000000b1d3bc815537af79a1687b90086f976f97c6c9fb1545a5af8c38fa6c0de21a37900000005bf78ddfeab7767b5c5e5c9ed253a7823e48d0a939334a95e02fc9a5dd17556a02c2f81e135c5a1c70447cb41bd8d4592a7add1288a233e9a56deeb7f6d6cbd11bce563679b13cace2593e4c3b4c1a56f691bd50b78d86dee748d2c7cb7b005701a990d863ae5041589b0a3b70775e2300a0873b148c0d78ba6f66adf5bf697fa9801bc0e102abdd9ac9ba075e22093340000000005d586371120244bfb82d4260d1e655a9756874cf47aaf35b49ae7ff1a2acff68bf3bcb6834cc72066167ae0b46982ca2dfdd20c8d0d5a1b74013e83c790259 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409438560" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000975bae64e7dfeae2e08af51c36a49cb00e765a221493ce53a7db2e1db44674e6000000000e800000000200002000000010fd3c8d9dc654838ac3f62a8787ba7ecab2bf299f637cf32aa154076d13ecdb20000000747af7f245a7b3558ea53c0d6170acf62f848dd61550face5316293bccc910f240000000aa6e21a53e1c3c8efd8c9a2055d4e432175ab83ec4db0d5143744790c947e4fbd584257b2302b9d9ffb67ce08d40e9134f84e7bb9628031998191d3337c7469b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2564 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2564 iexplore.exe 2564 iexplore.exe 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2564 wrote to memory of 1092 2564 iexplore.exe 29 PID 2564 wrote to memory of 1092 2564 iexplore.exe 29 PID 2564 wrote to memory of 1092 2564 iexplore.exe 29 PID 2564 wrote to memory of 1092 2564 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dc5b8e9fae2cc285022a48e91a79b096.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2564 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59aa37149c0033d638407bc51cacc3580
SHA1ea22894f81e517676011879447d4b0a1647bc372
SHA2569fc05d1ce167501b26db01a597dae7f531a3ad598a4c736a92cf1b6018338367
SHA512498d65d49e2d118038998a011c6b59f7f3a97d680fc04ca765a917ab492e0a2e9236ce01532ca62c465f43aaa81e986ee047c5319e5ec57967b8529294a6c9de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546031edb6c178b03c9805ae19e6b22a9
SHA1f40c9ffd6dee13625ad9d812900b963e3cd7249a
SHA25679c7250e856098e268427c76a27a1272244e6ab97c606f64e2599551e6f0313f
SHA512e3a649d08d91a72112e178d4587478a8e1905d88cde9098ca7f7d96b0f9a3deea77f2ca26fec797a3b86d5d67249288b572d8ae5bbf28e364fbd1ba640e64a5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3bbfbddcce898920035b8c8a6a4c39c
SHA10ba4286f9edfb4dc720fb82b316e404f63ef789f
SHA256fbd1b10ad8e9552fa88737108ca056c4a3160ff3e53950f63bc915faeb4ad168
SHA5128d1806b321522ad63d6f787ba396fd8b41aeb6ae122b5ed7916e238f986c057d4cbb11356371e36cd50fcefea04438c97f9c8a317a61a615ae8a4b0a090d1fa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca0e2e251a3403b8753682cbad9e3f8a
SHA1dfc30215ec38adc57e38f1ccef98499dea5335ff
SHA256a450b6b54afb4f0e5083759368a92e33812349f69f56d0bf5a104cb45f55e7a8
SHA5125574554d1cb008a2f92587cfe2dded3b10745d6153e25dbf159369da92c6f24cd12a596b59dbc2f1e4a4344ced767299acac0fdcd2e76f114aec866a6e9e5283
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58be36cf04f69e2d3b3bf72ffcd4db4aa
SHA19d06c78ca4bcca80113e0805b8accbf1b7d9ee33
SHA2567e43e3b2a17636460865ebf9d2b5572b58521298bbc0fb1d5c0a90672542fbe8
SHA512d4d3f060e9c15a197ff0478f09d08db3514ef6c386fa3db2cab6494bcf4a042128df3f1ba9058ff4750a00f95105c379d22d2f57441547f58462172a06fdf132
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b210ce99e13f4713cb32a30f22fa46b
SHA107e735e27c7fdd1b2eb75d36ef644d5688007b52
SHA256515e18cfa7230f9e32c00b766db09c0f99138ce96482337ca66c2a1d4bab4687
SHA512c0945e3960c4a59a83160dc0bcea087dd42c84e5bc1ef58cfe3037637f65a8991d21eba92e40724317d955d7a2fb66e23403968a1999e35ca8e6b6e3cd1f9be4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f160a9cd2e623836c8c25e4336aaaeed
SHA1e5a4f39d8d965f66aaa9ddc7f765c5281f344636
SHA256525cd0c96d30fe31663f0b7699b0b7b281fab1b577fc4c959f6651fd22046a2b
SHA512263747a450faa3bee54f4802a92ed437be4df4d3367a6f45985492ba31c0578bfe6f76a354fd325d5ee37b7f5a9a8e0cfb6629b31855f394f463df20bd306f5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506de9b4386ba7e63d3619690b10e2e98
SHA1e5f46b2956cb6b649779febe2d0a79958a1d19a0
SHA2563178e1c3f24fb563de7a2a8922969986ec0383b63de7b9a5cb702bcf4fac8c88
SHA51242d7dad48784b1fbf113c7b9e8b6e649760655b4ad5c51e11ad457b9b6bc8ac48fca0288071fb304221c8a3d5bd0628cf28ce2eb1b9496c813545def1352b939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf3f1b98a6671e821ad60b6cdac9d7eb
SHA14f379814fadd9ea79f1a78b9926ee511cc10994b
SHA256068856bc2df0b1c014fbfe83f44fe0f809f79ce911950ba93ae920db67210dd1
SHA512d164b4ec1c124f5750943dc7b88eb7f3a3d7f760d5f7b382b3ba701880ba706ab58032abe0077656d0b6321f2b04023d8e9c56420f1eba7749282e280a214d36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7e798e6927a59a909360c248ac15d0c
SHA1f3a14158e4ac51b81268877c62bfbb0e98e577bd
SHA256f0c970d07cfe603ac9c4a772dc1cf5970eb9c61e64adb6f9af568e812d6b061c
SHA5125bedb58dbe7b4b179e076837c8f14ebee61c4f55cecda6cde051117f3baa575445e58a1af56655dc21c4adf7549775278cc23fd0dbdd7535be8db6ebdfd76aca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5419175b6eb64d180367044288b5db5e9
SHA1e3e1ef68830cca41f5b0024b79df0c0c230732b2
SHA256844a6bc9d3583e941b0fcf0c23c4df8a29f8a24d0a356ca49728ce416a4af68f
SHA512d3e3f88cecfcf5afccc5787cf6b17f06da64400ba640c96d394412009e43ddabec3a6720bd90e01d840fe7df1e1fbde779b703520948884909f706060564c89b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6386eae425459dbb281520d4e6b6e15
SHA13b6d24fbe8bc89b538d55e60a4fff103dc7fb7d6
SHA256fbdac872809ef163b16fe7eba297b90a349a86c3d249c6f30fc34088f27d6d52
SHA51286a2da63764a6834e2f342eb91a818dec08a2c812583ad15a5fb80d41a391d4f7eda6f0603301b9cb154fad6a2356f9b56c1a0303b3f8ca8ee2dc13e4bdc580f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5863482b9ac11ca7b24435d9f7e32d374
SHA1f0303c5b7bd92790d6a27c3588d0538064256208
SHA256df4e067908d5da13ec3abad162eee4df27ea84bd2be01a3855f485004c8c517f
SHA5129e7795fba4b5b4bf7e3239c9420bed9a31ca17fd62c173b1ea9a0b7bf7c73ed4e7b2c329164a2e8257cd5cc3ab3ba76d16818ff12d0a68a2387e46b822f34ca8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5742c762803cfa9f600fe2563c49a238e
SHA1c895c19a304a26be0b8c8b27dd90b442276c2144
SHA256fc4524ad524b7e3fb1d46e541e3e32447dc83f6a14748a55b54dd2eb52147323
SHA512fb03f45ed9f8ac9796ace9c9465a372f4adeb7455bff7dad6015f52208e45426afdb57abefbfb7c32255f97d7e0b51914cb235dfd6844fcba6cb34607b5c8383
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d03067465e88af81b7504f519084a32
SHA13d482a3e6ecbbd1c0aa9755498b911ec44c84a31
SHA25632b77f0a36cdca95a2ea03317f0d02aa24f6d58dd9599856e93c6044cc84ad88
SHA512869bba339185e260664566f74df747e3b9135ad3c2ca8427c90023071662ffa4e3efcd893d8a9a7a8df75eea13da4e7aa88a3500062a1c5dfe6833c1363684bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be3073666e777e385f988f303ca32fc8
SHA12b51244dd9b5ed7129dac263f297404b92d5adea
SHA256fe164684a2d118196a75fc8c88a7ad52df44ddc6dcf0b92aed9f55a4b2298555
SHA512300a3bfb8482e6ffbd98c5e08798e3af92bc92fe18443274bb02dd1b4a90d3f3de56b4c772bcf4f7fbcfe339d5da8b69f6de933d6dd797082f8e2ee7bdad5ce8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1790c77e9f407e9d863306802c086d7
SHA1051b0a364298aadf5014ad24b5031d615a105f24
SHA2566546b2cc93d80670e6f64fdce84e63f0f7fc18539f5cdbfcb8507505334293c7
SHA512a1c4f2002274c9a859cf687f73b20f29d9d881da0d20a89605d6a0b7383f72a7409ce70348dc6db0ff73b3c7d7ae47725a5250a9e90cbe58a51e69030ba69b63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cb18607e676c5c64b20e5992700685f
SHA1f192ed219538f3b8db930d31eca2d2690d354692
SHA256f9417c8e216e3408abd61bc63a8b5d83cd9f017dc423c781b99b26060a94ce43
SHA512a8cba4e5fca7d4c0be8feed2656c809fb0a88930de406d4cfcb6700e163bbeddd466a155b5203788e5e0a3e1457f67b7475d2d04885796ccdd5578f0dfa3e51b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8b229846e9c650b2d1188eba174c493
SHA1148e5bc265b0c6fe811ee591123a2c15ea5d5ce7
SHA2566f2ee085599aee2b3282923816e87ac6e3115927ed0288e56c7bd021cc724058
SHA51271cdac77ddcb6380615bc8bc0367087f42ab8dbf0fc5811dbced144fcb6c3b7e6c04a10f63974b6861641d778439b7f4a202d7c4b2ee6664af8db3410fafecce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5770e1bc5296d265e5898940aed85d11a
SHA10f8412a4c95863c53135adb2f60171f3cbb652d7
SHA256e92221f883f396397ee531eb276d19f8e9957588e51a1e9238c615a34b9366d4
SHA5120f3f0bf5844e93ef5b3032fc8372c2646e6c7a7697a7c9612e3016145864afb97649b316d058e568ee3e88e7cfd44d63bdd9950161f7d764dcc40425bb8e09a7
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06