Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 06:16
Static task
static1
Behavioral task
behavioral1
Sample
7c5cfcceaea59d2ef8d393dc811c9805.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7c5cfcceaea59d2ef8d393dc811c9805.html
Resource
win10v2004-20231215-en
General
-
Target
7c5cfcceaea59d2ef8d393dc811c9805.html
-
Size
12KB
-
MD5
7c5cfcceaea59d2ef8d393dc811c9805
-
SHA1
871dba0cf18ed667a2c55a3252ef9ff44b74f998
-
SHA256
6bdd54b59d9568eb2d4d6070047a44ba14b0f4e82d2c9349e6ab09856bc0c5ac
-
SHA512
aba3655df3689c345e2dd062e712bb03cd0838097ca18bc4dbfdfdaf9a532086fb40e4d3af537277b099e7d9549f3b41c0f7f1ba61fea4e747afd645232570bf
-
SSDEEP
384:cl5yW4Ytld6rTyv6Rb+nQKrlibQmYMH/pMF1E:KO6gyvCAdhi8yfpe1E
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000f5cc13bcf8f619a84da35ca7a2403e53ee761230525c1abeaa57f401706fcdcb000000000e80000000020000200000004af96ce901c9ec459ccf2ec07cc51c2c73d363d32d687aef0a97063e5bf1b8d990000000840c9dc4f28f122d01d06cd7e1d9ba1fc6bcd10e3835e9cb84e85f056b18b71afe603afd4e3b910456db26d88038d895371d04d818f05820db34df47eb3fbdcdf5be5422158e64eb83d5c27d526502b1b6596a7eeedbba947b28b9ba45dbf1ef6240fcb50a94eef20cef59ef8adc02588357d2e3246d4c52e4bdee85ada503961bb2f4a72648dd8aa78da3a97523913940000000afd5f7a3417bff905bfbcf34acf1805546bad4b80124e9f985885e4b58e256cb12a236912de986238cbe7f1c9afef7c0ab26fcfc952b121ecb68679c50df4542 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8028c1a2b151da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000db3958698979accc178a36887dcfaa9374471a49ff8ff072468bb9284e6e5887000000000e800000000200002000000010573b05ce966cd28fe520fadcec9005e4a333a7616645c84520cbdfad82303920000000d78e683a8db6ba39bf427d49a7444f6904af2df7394cf9bd2d7d9a9e7d3e674f40000000660f64beb283e6dd6e86858f0cb01e7cab61171d912f670c706bb29b9b768538c42ab2479a2431252311e298ba4d928158cbd23e6ad3d710b8a59d2e951add4e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412584469" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CDCAD3A1-BDA4-11EE-9735-D2016227024C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1536 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1536 iexplore.exe 1536 iexplore.exe 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1536 wrote to memory of 2472 1536 iexplore.exe 28 PID 1536 wrote to memory of 2472 1536 iexplore.exe 28 PID 1536 wrote to memory of 2472 1536 iexplore.exe 28 PID 1536 wrote to memory of 2472 1536 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c5cfcceaea59d2ef8d393dc811c9805.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5221ea8fe305f7456da805ea33bd64644
SHA18fd746ab5391272e198f506b3de45f81981c332d
SHA256b212f8276d6d7df27c5458ffe1689ad36d3be59b6e93af2291cea5652dda96a4
SHA5129b781c393827484a591fcb83d506f6490436781eca6d420f36504f734eae41d1da85175c640d6a1ca8cf0efa148915001387a2aa83b3a3bc3732f5843b77d652
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e316e7642e92f7cd7b234209aaeaaf34
SHA1fa885cb5ea0c01a4c0ff5bc1e65a92ae884ec92c
SHA25666030a8159014a9f2f7ca8c14e61f9163fec0903dafb3160fb5562d200909f15
SHA512d04778da9ded6a8c1358633e8f2f01c9fadeb3d7e7a5047c700b1c469d95a1eb281d6a48f6fd7fecc0d063d50a62ba91685d964b514ec656fa40ecf6dc7efbb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c772ba0ae2c23f6e967e559d91dde787
SHA1b100d5094cbb4b1f186773d9b472fcb1c4cff4ab
SHA256677a148687c88064f4b1b5f995c5547f885c9b0220454809c3712355b0358fe2
SHA512ba6a8ccfdd4a0a4080d04b5e905423d130ed579c9293220ac54ce3baf7116bc7d2ba68e40035bab4ec65460cf19f99b6e94b106e0f5cdc36e7521193af619ea3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561a8683bbc895b8b09ae18e815490a8f
SHA113da1c82803ab1ac7d3fdab73b98f5388d571fa9
SHA256807d530e325c1f8109d73b9962b4209ea8ce4dbe5907d1a78e84d6aa5b897489
SHA5129e0626fa30599916249640d7011e228a7faa18f5ce9f3e6af254c6ec3f0fa2779337495d7c1cdae3799dca82c18efb90331f95290ab2fd2c544b59a61c1a73c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549c211bc3aa648389ce71bf90e478a51
SHA101b50f386fddd76d5d8f72564b9883bf2a1c72df
SHA256cd46d5fc894de30fd421129e4765f6c0dcfc9937b6741d5bc35238cc5fbe4726
SHA512307b6579d2ed273646632013d88d9f2407b7ef8a89c580a263547018d366ac5fd08d163b0d6387f6b9f007093f53bdd653c7a99e4ece5b16c38de44e5b8314e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591af5325b7e5e14830ca18b9feac3c72
SHA1cd4a6f2341fb7c4cd8f4a7f9288c9dce6f6a0e01
SHA2569664a3a453cb486f4dba00efce5028453a489429eec09be88dc84ff9a826dd25
SHA512b2411d5bf2442c3d2c8c7ed0b602a28154cb0160578a1a621854b96ed8399d6fb58a3b25e2be4de666607cbf6ba6cc0445bd78cbeda3291e055300075dc76ed2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d556e4634fad23dc7bcd31d5dc86606
SHA105cd698b4987ba25f57442c2bb3bbd06058485a2
SHA25641c272d5fa11ed5263966c7e9cbcd2cc99c7b4bade9734c6aeb2ba9b2d0b918f
SHA5124bf42631ae5d97f3865b550d2d0924d8299d1464ea5c85afc511f81539a6af56662f8f4b31ef336629455aff0c26d21376f0cfdca49d7f96e1f7e8db26ca0a1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543f3655627fa6aa3629af8d226fd74b4
SHA1be3f0197d392ba5334a775716719ca360c03bd4e
SHA2566cd5c3c44ab24503f942f54307f0e98d87aed407a9151e514d80ac39919e3c56
SHA5129399e77cdd9a5dea82e1d234036caa54774f735ecba710225793f56db88b1a2c956848c99f564d22b8c59e8344579b7b4b1f6122d11fc4c41658a994bbf1b810
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c5ed65c375315ca7633084804d0f298
SHA118231ed703ef59ecca320782c842f2d0af0c857a
SHA256b5812752d0d19092f527b7aec5b2572294640058cefb6ed450740753179f5bef
SHA512aef82835d22f879e5e390187b3a6e0f55d6d2e406ef0f8e16558612ad98c06e9eb4e003bf3ae9cde10e3b5bf6fe7114aadc8a52fe2458d007a7bd6aa0fe75b0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e7be492af47d0f4b80ca1ed0589b4eb
SHA1d752ffa3c211ab499352d619be15a2b42192574d
SHA256b79d298fdc026d528cb7cbf528fe911c56a62d8f02faa13b7afd95aeb08dee95
SHA5122c44fb21108eefa5af05fad43f4cec1c7344e911c792fb57139623bfaf275079a518aafe182cb8cee0b37e316eaaa7821e16f1af06be85e209a73d22947c6036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed63b94b2b13c45004fd53291b8492da
SHA1a273ff9e754888a20a859d43b383bfefe240cc0b
SHA2560089a3d6e9e5f825b6a53d16f3030608a9c72f0f442ffc9875cc8d0d197a994c
SHA51252af5a3721328bb3c7e336f305540ffd94a24815da051b3f767711be74c8219f3ab7c2c5b1a9d877cde2f96d5cb45a48c420098003d61aac4ae464daa0b6dc17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e5a072b271a07caa929ce9b2c8cf019
SHA166279aefb680eb9498ecefbf6e6b37e143952cd0
SHA2568c33012e31ab01058517e4afe742a22c1723ba77740c354774d7bf0bc6dc1051
SHA5125504f76a039f0ac1f2536f846631e380019ae81652d128a5d4117038cf03f669b6cf6c7d1e08d26ce8cccbe7d3b0702043d8ff4ceeea1a897f5ff8bb39f96301
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b23ebbbd79ad0f2d8a5c67cec55c8676
SHA1cbdfd70abd133fb8f3325e56ca03900f67b58957
SHA25665304a679654818090554627235aea776bd68d81f22f22546130cfb51c2e15bb
SHA512f8926cb0d5733eca50fbcaa0f61a4f30cf3dc74e4a9afc104a1d0b9aeaa9811d3b5672526e2cf110000445a3f5dda2895ca7ef04c2d440b97b3e61152c0931e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a379aecbf1d4a6683d80abbbba12b95
SHA1b721ec7659ca8d1a2120c62c22b41e131688cd5e
SHA256836eac70c6e3ac55c5df0877e89e559cb509332f6df65c8be40a2d75a464eaf7
SHA51243077ec542aac5fd5686acfd5db8900fdc7450cf08ce3d85c0e03e6b8c0ce84f855dde561fc5d099beca6a5a9f0f4f0de660919df6410bcc637ff7be85367617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6f54bdf2e27713adfc79e0404a97aa0
SHA11f2c8937df7df159586170caf6efd5c21266176c
SHA2565bed3de6fe7aee43b3b3db7e40c3758f659ab43d017359c22e6ebaba902e3791
SHA51221fe60366e153196fd2366ec9e3324f44aa70e670613e9fda9090e4dd9c6e98bec5dadddf61356909c2b43d46ee94c11a34b77fc3c5b9c6a91892e1545cf5b00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a9d269662ce6b2603b4a1fc3a34c3c8
SHA1261b7a7234f568e0f591ac03fa180fa6faa99a6b
SHA2560cf1b919084933c155deaa9d38ad08101e8f07b56ce6cf51e652919033edc284
SHA51202f6ea593d47d9d83661c20b81098e9547465732900d4e1e979a73f390b066474288df3bb83b953f4d1faaafb9c5db1362292bc526c862901e0c25f2eb35cb1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57354562b09673e62f45314607fe28860
SHA1be4c1ed7bfcf72166717cd3603560ecdbb6ee8fa
SHA2567b4c3b004ec0683a28664efe2942500639676889de3e0defe23ada835e814450
SHA5122e7ebaa0fcd4ed116fcf386353caf3387a3b8fe9018390b38a9e4bfb61488d606e2f899ff20c59a62afb8b27ea0bdd549e2f658d666387b54d33e2c381a59755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d36ae18b3b00e6a791fc5db6319175ce
SHA1f00ed3560cb0813c7e84870c68ef8d8263d9d4b8
SHA2566f04d878af298c5ab98cd9a79e5b056c37acec3dba80d4631910172e8565e009
SHA51259116d8ddc92e76735501614298389797ee8c96578eb4e3ae2347e34d4101c2f2e6af5077f81b8e9bb78c9f50504abc563dbfea90935ea3129ac88bdf9752b7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1dcbf7e6d95b993a785e41978770b68
SHA184f36d8b29471b59b3ac4f847bf48f0a4869a01a
SHA256401c179bf3f8d01d96e42fd823cbcfd0e02afdf50d3b9a4a80f44eb2f2b52212
SHA5127c23bf558784456928fecd3353e50edc1343ec86448e6c7782a48b52dbb325f3d1140f150ae8bf837ad5214992a8fd34149dfb9c803e916742438d9211672281
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06