Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
15/01/2024, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
5bcd710625b5f95b2d1f16a52b61dccd.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5bcd710625b5f95b2d1f16a52b61dccd.html
Resource
win10v2004-20231222-en
General
-
Target
5bcd710625b5f95b2d1f16a52b61dccd.html
-
Size
6KB
-
MD5
5bcd710625b5f95b2d1f16a52b61dccd
-
SHA1
025edf6d70404281eafbfd5d422d94807e132d3c
-
SHA256
e82fbc328a019610816a23dee2b2996b271327603dc79db2195c1444fd264899
-
SHA512
619b2ac8013ddd99af9a68522ec1b12e668d1454617ad7db20580a331a6b76c8bf99db6145b5f4fe69f428600e1b669f2d0964d743262c9d43a58968c5025add
-
SSDEEP
96:uzVs+ux7C/LLY1k9o84d12ef7CSTUzm/6/NcEZ7ru7f:csz7C/AYS/T4Nb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000415ea5954eb693c3234ff69b2c6b0acdd66e30fa501ded338d45edd38071fa5e000000000e8000000002000020000000304cc7a351e367db2f3dd0767ae53d2b7d8861e8a99da934066450690830c63520000000b66a3a279f63a3f3c3eb7bbd3cda6673ef17c2043b325ea8e4b51011e35bb9804000000015d2606299600a5158457666b40e6084e9e4fec0b90701405d3d4ecb75250faf8c44bfd29f40f3ea7b7d54f20ee92c91a7f890e737a278bb8a57fa1a10dd0c11 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000064ddf296a4a9b3f7b2b49aa4abf48b52a33a19fb6978b9f6abe4c52bb8bcd270000000000e80000000020000200000001b1895041bc001e29bfc7e6efa2445ee99071358d358375daec834f3750559eb90000000f8f8314123cff0fc356704ec410678573d8eaf2d9b58c443054861f4b600f40269669d02dcb4ef8c754f557ceb116a5231b4979e21909808e9dfa6ce73547d94c0e003579d82b0f583bdcc9661883434e01ed3be49e05b3bbd3a37d91b0209fa01baa7c9c727b2cf07fd5b6019086d631abbc7f61acbfdb8320960eaaac853e21e3a1c6ac2ea5fad383c9cca22e251de4000000004c05f62e4213d9cd931522f292ae49e7c13ec0ead865ba70b5544505b27cfd1d7b3c4e43c431922b76a9583472a5335e720adb4fecbf657e5bd0349c1ad1fa5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB7D46B1-B346-11EE-BF8F-CE253106968E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bed9e95347da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411444664" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1664 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1664 iexplore.exe 1664 iexplore.exe 2608 IEXPLORE.EXE 2608 IEXPLORE.EXE 2608 IEXPLORE.EXE 2608 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2608 1664 iexplore.exe 28 PID 1664 wrote to memory of 2608 1664 iexplore.exe 28 PID 1664 wrote to memory of 2608 1664 iexplore.exe 28 PID 1664 wrote to memory of 2608 1664 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5bcd710625b5f95b2d1f16a52b61dccd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5794769c7133e5971e9d5916de846028b
SHA128f7f223c67f6fd074f142d58d229d3ef4ff82fd
SHA2568e01d24121dcc93ad81e76ff7c15b7e1d116c3468504daa7795bdf25b4995cd7
SHA512da95b31fc074cff8eadf9688224d7b5b23fb50c4feacb2a679109ea3972092830126eb478848062a27c84b519f9eaa4b398a674f93a82cf3900f659d2dc77483
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598208736785fabc9c67abd1166d121d2
SHA1a60fb09c29c2a26fad02e5ced91b1469c72e4821
SHA2568c12d8620d45e8d09d4453e78b22b094c7f1c03dec495f8273df668d40392235
SHA5121092a774afb1a1c9b1f9a7f3d458c40d6983d3e432001bb41e1fda798bc8b91b69a55202c8977781535ea8696625529a9b1f320e2579bbb1b6f4cf117e89fb11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c51f18ba25932b081f0ce1b327ca4a99
SHA102e03ad2ae6112284adb2cc5fe816abbd5b1221f
SHA256836847cfa3aec55a32c65052827c23cab0e05758f8653538a8544b2977ff30cd
SHA5128c92d2cc393c699db217432cbc9c49ee751b81f84af9375adcbacc1409cfe4a418a1e70ce7404f5469b1b0e973eec786d81b064c2936226b60744d1aeb15102f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5816e7ab62ba3987b65da7b8f2ce68b87
SHA13eb61eb0db9758346e0fe95bf859b92fd3032b6d
SHA2561be35356242675a9e1e7ab96e73bdb597df3b1d71d349c836117defe85ed1c7f
SHA51273291c116542f8b5293eeb15160d48b8412afe038b64ae73d5c3c5547d73ea26e8dff6b7fdefddcdf4e851d0dd9640630d1594da5cb039e4727049c46e643e3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ac2bedc23133b360864a590cdf91c2a
SHA17988ce3605466cb7535164c71cb71ac2ae9be22d
SHA256280335dab8a6103e9e375a18059768f3f8cc2e641f5ed8d6783528924682864b
SHA5123626a771c29bae6d7d1643c7a8927ee174264232ee6eb44f94092f663ee19209f73984aeac7407485da80209dd24c7e2dcfe2c3dbd16705e0879625ac73bbddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4f6d868b1bb1e74cdf79db87c10e4b9
SHA19ec25397db35bff257bdb51cafca8c2cbc904a17
SHA256a9c3dd964983637473c392583566e9377cc72796f4e1639cc825a655ebc753be
SHA5121d248087af4379e5abbee366895fd76cf8a61293f991b96f8e72dae0f5ca5114e72fa65f21f8abe23232542b3784fa87fe4a0fded989a949b3e91fc8e480beb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a196ecc8c313b871e7c6bc75ff80bdd3
SHA1a9ddd30944556a3bbf1b2ac2462e408f07ff9687
SHA256f54838022244e396cf36388bbe899cf37d73c31859fd07b6dd6f0020cc4484c8
SHA512efbd05da87f03e02c5997140298a6a560ecbb06b95e33499a473c7810d27df152a42049498dd55f590f6c2098168e6f61e091fbadb74120b9911c671ba244556
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548b5f3f37f397447ad3dadefbc03f0b4
SHA1ee6fea1cef56d1f158848c9a6b4afe7c6c357ffa
SHA256d6c97cc7ad585c64fa6c6e1c0d93d6f91f3d27978f882832591b0094b36dccf6
SHA5128a61f1ee9287cf19dc2e9d06289e13e76cef148fea4b42baef70c094b19b0d8fc388acc996e11e577caabe278dac71dc94d02a12eb1399b99542c9906319828c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e034ea485c2eeb8553dad22bb616591e
SHA1b781d9b0c936e739c819208ec13ed0f830126954
SHA2568f66a9fc58e719f236f3acad6b247f294f4a22da1c46f30e8d81acf1894afe87
SHA512e149e4245e2c6b140e3387b9bc2712183649c2782c3b60cf6413954a411dfa28a6d39bb56d8c29b20a42ee1e1d309012a9bf1bc93a1972a6a3cceadbb5067ff1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517289c9b922e69e49c8800fd34b9961a
SHA1fb04fb79463cb7a52a2dd81115ffc5016c1b5464
SHA256a8b767ac4f3c1febdb81ea48564bdb5eb33c06bb3978c23eb2fdee5ec14fec82
SHA51278bc36ab91e6d1a84379d47781ead08d75fb17e840f3d3bfacc8ccd440d00783f3df1ee4246c4a74becfbb3e7310f2a21ae4eb81cca870a64ff5427eca70b1e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50220ede972cfa404a07392f03ec45134
SHA17dbb96c0d8db5302fafdc1435d20d48b405591a1
SHA25685b614b5b6841a5d84bc8f194dfd12a521a380fc2ebbc6c8fad31c7ee79863e3
SHA5123a16c7f7c4fd93061f0135e8c8cad87d58cce18cad85767a9f56ab19318f008d6e50e06e3c4d956c0acf627582e777b74f0925618bfa73a833b3e0be5f6b01a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac26dbddec01168afe67b4570f96239a
SHA1f9bd9ddc42c572aef352dbbcde706e48f9cc27d7
SHA256de2dfcea3e537a34cb4b1ff62d723b70e04070867b1cb582b42e03fe68fd02fc
SHA512cefc3e687563a301fbef387e64306d1d5988e86e7864639b32381ac959e6f4e6f688ad1a78db7e276ed90d913f96364e5a86f4d96c50ee6e0d1b1f7c7a8d4d04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec0f35bfd1038ad8186c65554319428f
SHA15b63aacdd583e5a8bbd520a92569dfb0a0977d1a
SHA25610dcbf686bf90ff71f98db15bc808c22d3f1f9b94c88e4343f7904c644f8ece6
SHA51263766c7dbb8e2b4a6487585ce055df791632639ba87e7404d5303bb429f40f97ed12503ec2ebfd97cb41491276fe85530a165f0d910b2a1aca9950551e5c61b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4e108782b546ee6fc89620404890330
SHA15bf620543b92d190ffada2d366dc0ca752a84da5
SHA256c32fe0e0ff1418c68a4f5ca51477cefe31ed254698893c14c9fc71585e59ecd0
SHA512b0b339c3f49d2920dc7961ea90ca1f543c2325b11efa934815ef8a6bf2543b5233c5c000a42d8578d7f23885c525b2372db85c0e3f60b7df042023cdf106f533
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511f2fea525417432cf9be4dd1c14de3f
SHA1c0e02271d51448ab6e3d98fa467186a711438131
SHA256546ac40fe2fbfa1a2a0665401113586080dc12af3f0efd9370d6db3db476eb6c
SHA512e7dea97c0789c30d0001e2ea085a7485943a54d9982b5504e33fc5b767a8281237093490b959f4ef55c3ff13a32102cf6dbb97971242ab011350af72607a33c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd4979abd9bc6b9afcd04974f304091e
SHA10e09d91a618ed6b80e1ae35ac7af1c09f7d27ce3
SHA256ed861847d42fd7a09001714df0b7d46a3026e3c67b543bfe75a4150a8ab93684
SHA512636df0ead7f243ca9f164c202d35d60010abb2544ef4cca3600f8b12624266b0ad053a771edbe38458c571bae30c99e6a4103cdb502bbeeb1a4cb9f6985137bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a38b3621cf81d256657f1653270c0d5e
SHA138fee6291c0cf5baf4e83e833a8c20afffedf710
SHA25680f9a13e7b5b435878c1d04bef0710ce278d79a6444abf81f9a0b9a71b0732e2
SHA512a55ee4c915423f88bdeeb7b26a607edd96ce36ea54bd091f38e751a2e56e7cfc61f4faee587a27485ee0e109591f0303703379348b830893304820a31f461096
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb2f1c3cde0fa38a36ebfa8ed52160e8
SHA1b0af249bd825709c1a03c2eab4f137adf0471fbe
SHA2567170995ac9c47418826bc8bac800c24ab9eed6e5181075643d1f74e30b927832
SHA512b08c40a19fb0e2d5af1859e066e0039e538b6b4b09da921c95c4360cae6ddd8fc41192faf7f8a00595da2813eb9134e72cf30274d29bbaa8804384bbf303fba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531a52de27b3d5190f74f8b1251bf5639
SHA18340924e0a1e1e6450599e221db97daedb2ccc1b
SHA2568edefa758d0437f45715bc087414b9ea77df8969d21f7487b4c44306e7964b2e
SHA512c99a53ec3ea2eddd1214b626c32d5c4ddb7eb7bfa16c75ec80b8a136921b4f6ab94fcf7f69deea589a0c57a391398260bffac6d3a66a00abe60895427c915a92
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06