Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 17:32
Static task
static1
Behavioral task
behavioral1
Sample
a2585d4f7d5710adab1752c07b55747d.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a2585d4f7d5710adab1752c07b55747d.html
Resource
win10v2004-20240221-en
General
-
Target
a2585d4f7d5710adab1752c07b55747d.html
-
Size
11KB
-
MD5
a2585d4f7d5710adab1752c07b55747d
-
SHA1
89d421401e1dc1077b787d09c1656dd0a9c18ab7
-
SHA256
e094bf12ada67c8da01f9a80a6d68abb8fe2a03d7302bff0dc95868c321d9277
-
SHA512
42f831b129295b437042db6904e9076b94698ad2b236c303a7bce0cdeb49e9f70b702eb6329dc97fb4a88863495ce3c92b592534859ec2de4f3dfc5d55209ede
-
SSDEEP
96:uzVs+ux7vcLLY1k9o84d12ef7CSTUqGT/k2zplXXp8As7J8xR/lVHcEZ7ru7f:csz7vcAYS/bSlXXpm7J8/PHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000093c9c44c090fe651c96d8f33dbb52fb6284cb848f7c2b6ffad40cf66bfa289df000000000e8000000002000020000000399d8ac09c911118e7a4c73e3f502e26c827cd717725482271a5c0422afd715f90000000980c79d5de6389a965d2692fb00b578940a5be0c19d4dc741edacca86f1ac970a785dbc980faa2b6633fef87ea34f10bce751114de982551d20ca1e9435aa11df20b1f0c42062cf195dc1eb9a9bc5d83b91c696ea4f8a6391d695d1c5a9ba35d8cb0a5a1a5d481e87a014244c7993a717a6a3ffe7f5ab9f7b93d412dabf4804145e5167812c51bf11280b5aa04a74737400000003da8b07cbee50f3be25ec7262ea766833b6a4549c846db88c06f5747f5719fba3c4cc8fa6bd7afa37ccb8a791ed944f25b29fdc7379cc4b42fef0355a8ab9e7b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000148160339ccd356e9aa7c7cfa6ff7ab5a52aaae1ab549aeb143b5c6a58afa069000000000e8000000002000020000000a032c54ce13f18a5cf170bfd498fc9e24c23cf28e541daa3a573d9c7c0850864200000007e8d302db0038875f1b927e1e22c6a5dddd8eec7d0c48406712aae22baad53a540000000f669e4204c589a4a10ebc7e9bbca676ee8cd1d87bcce650d4ecff081b077f54a20e2b677e820940a40346bc2f9c40e20b672869c1d0bde6f6e3f594510fa43ed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9C02F81-D33A-11EE-B804-569FD5A164C1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414957835" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 907bcb8e4767da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2524 2972 iexplore.exe 28 PID 2972 wrote to memory of 2524 2972 iexplore.exe 28 PID 2972 wrote to memory of 2524 2972 iexplore.exe 28 PID 2972 wrote to memory of 2524 2972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2585d4f7d5710adab1752c07b55747d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8723efdd6877b0feebbbc23c30e8a80
SHA1c06cde2d451da26b9b36b0400d0bedc50f76c7ea
SHA256c08d92ccea2acb31bc23cc1fa864d216232ebe4d57c03e101d429498669444d7
SHA512b093a8da51e2a59f8d5e82ae9a845e951919ac7f1dc2559019634f5ddd8733cae3115971c091b8a939844e41527c4763655509a8893f3e10480a6d7dc185b710
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d255c6efb1d19e4af28229dc08496c0
SHA199649f71391fb4a559a03b58c90a8b7da29e1bcf
SHA2560d473c3cc586600fa43ca63de825c92f7ccee2cdd0b8d5cd960fd47b8582649d
SHA5120f40c5bdfade4c869492ad8a815b7fe3b97f2d0cbf52ea739c8e7687f66fc6130dab3667a53f26db2d05704243b3bbd39ec55ac62e1d0789ec138db5f21726d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6e07c0d3a49fa56caac446518c3c986
SHA132f84d495e45cf05c0aeea2473264aea43588dde
SHA2562d1ff6122d3422c6df51e10bb773ae1f383104fc7b6cc73c2e6755578b89a80f
SHA51256177b67bd6d7f18a0feb19f5b1345b6e2892baf8e05b0a451b1182e56bad40b8eb13875dd1bbbac9d4b74aae890d1456d8e37faabf5907981b1d8e8abd98b7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0e87050015263e5344ae83e2c9c4ed4
SHA1fa2eb6eb5aca1cd82ebcdc0236371a8b063d66e5
SHA256475821b6ab860828e7306678c55c1ac9c215c1ba2d39293e9f31636a31f32b38
SHA512490711a068672319c1ceeb729e360266a702119145f8297496f08feb14f3ad59599d77a5acb59bda7b11d1be487251a1b8abfef286d2b928306262df5a61e9d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce027fd7bd6d890d59c03640da240915
SHA11b4d0596cb6633085b252289327ce1d9fa9490ce
SHA256b5e8f162be6714712cd66d2bd1e68f2a6055bbf427678f9ee93acef33fb8b29e
SHA5123377afe578d14b9886a5a075e613589cc04f22c2587fa667384c6be2edc46f5038a7d6b3a1910c788eba13e860e2daeb919117643efd813dfef7e23d06a72e00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d77a465030083ff61033957380c08fa9
SHA1a4a132a847982ea73bb4a99f743b2c3f24c29ecb
SHA2561c0c97d1aaabc93a9cfb52635c72b25ed89b583e2b5dd2bd89ae5b650c2f5bd3
SHA512f3628e9711927e53d6f22a84bb55b2ef42108e6052295aaafc5e893a6e0dadfe1467d98fd0a58823aa156a601f93f8381490ae4917f721e998b403ec616c1418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f44725d7e110ff297766849543a4d856
SHA1f456ab7f9c357375ef50b66dfbf7e0e213dfbf2f
SHA2564cc88c2a8b7cbbf06aa9c85b387124376316f01742779c2f0487474eb43596a2
SHA51261fdef1149d38a66464e132ad75b8e33b94d5b610e5a630eb5d6e87a942802a9d44c12a7c08d6b0858a201aea9b140e47161d05463165bf1d627c27f95ebb6f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea3fcdb0b053eafe517ee8609e8bc8f4
SHA18b86cdd0dc33921d14c081599c153d93745759f4
SHA256a57cfa9449d1643f2d6e58d68cee77372321022617c693284b285dd0f75a5f3c
SHA512c2d266b7770eab6bad576d2bc0a0ad787a8d48c99ef2432059abc7aeedda3199e0e2af66dc6757a74d08c5ffbf9e21c4b145e095bc7dd49893a9d65b8abc990c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b119e6df82d0a678e5c0576ce4d09fb
SHA17f727fb5a27be12c441c19fe0d8a3093bf13f51a
SHA25646fbd609705190732afca3f4a887def682e007068e46ab2c74b2f41a44b782ca
SHA5120d766a7265c3f332fae9ea0f89750cfb05ed0111f017cf118097d3cd275efe6a12d79ddcf49f92a2a8d6e71f461092793b50701764bcacdff1647149a78a53a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563397684fac19a480e0c39851f8698b3
SHA1dfdb3173b9dac19678052b66c7a301f500d5b10a
SHA2569061a22c94270aea8264f6da82a73d4f529d7ff8aa3df01374b9251681af9958
SHA5129c57bb8e9079e49ed8262dff56c03499256b6c8a2ff8b4a9ff5ab7021f7d3d95c39a2bdd9be32874fd6a0cb6833e6c6e7100f268e285bd36daf0751b80244499
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522040e08c0a325cf08d1235458781ec2
SHA19343eef2acfacc809fb92335de3ffdf748304fa5
SHA256378b8995f9ad3a7dc048cadfc6696f25958f2cf31abe58d2db29026761ff393e
SHA512568b690b925eeab5ca57b9d7ab4abe5a586eb4b0a9cb8ec89c3937a98740c57713143452128eec60139c7a49336ef42e3e60ccea2cbda20c19bf1520cc4bfeba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513c1a66ee02fa34f3707a7e9f7386b05
SHA16224dca196d12f244da0a5d23a9b1a6042518c50
SHA25679b7e4264fd8ff11e9bdd524c681cccc446732286440fcd933adcd766665f28b
SHA512b918e0b1bbfd69551109ff8aca7bb836bb8be052a4a10ee4a9250dc1066131ae64a1eff6fc5b8061ce4a572f66d66115be2469b7c13b790a4d22661c77f3b805
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e7d09f15436a763cc88a1eb769c81b2
SHA10d9d9573683a87ba53f5cda1ab4a487a50168b61
SHA2562a5377ff232c4e972d8139f9946ee6a3810b2c05c377009eb4f5504b9064c688
SHA512655179ab49bf7b4dacf0c181e644e3508e80867d67f1e5309f06c88b873432e6e7cb4ebf166163b1e298facfd9134d2cf8ebf023dac4bb05cfedc967156c48bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50922e45062a5daa6a63445c5de3ec894
SHA17676eda269bb037e19ab8b09d7645ca8ee5d8465
SHA2560325277694285564391a4f83519bfd3a404c2448ef07f9851d8aa5892d4db3fc
SHA512470abcf9c355253f598cb6ba0f660bf731677a9a3182d1e2e726f598ee7a09f6f6327adfd6e42e882a2a6b3a6a2aef410b456cd7879d592baf067079bea775e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c78a442e67cef24720a1353713aa43f7
SHA1c09a4095a4a9dfa5321a2d25adf0a1f4e8eb4962
SHA256f8d49e0457d67aa6bac5a263348961063c2b28b36b3a9676100f7eef127ebee4
SHA51294d079c0c20ce04babcf257b476bedde8adc954f644730b2036ccad2904608d36f26903f1004f87f200698c034dae536e97822b40f3c14237b375a186d9fe284
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e97205f65a4462c12fd2b37a12fc741c
SHA11466c1dfd76f8676ebe3b223e0f67b216bbadfdb
SHA256c27b97203ec5c6760c842ecfaf98ed15d43c89ff5502dc433cfdd8df11d629e7
SHA5123f5e3d9a63285fd1b7f62fe1f0c62690142190676caf47f4bba6010f962f4834ffaa158342bde2899f3d7e8b0a4bba41f2e0e1c1ee2a45aa21a181cfc8a0a9ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2ae6f1d7551345dc5955a25bc72bf46
SHA1a830a0e303d62c877f454e76db194939f9be4a65
SHA256f6ada2d240b270adc4784a8a7ca76e49a708a8acfb00c8ee2a2941c63aa79ab1
SHA5124e0a65e104861325bb5017dd4b52e0acaa8b03de96dc52858640b22f6a09e30bca3e9ae9e49379249d0ee16874f659ffe17966879ae5e41f66dd25ef25444b64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e989e8df109987453d0b892fa9a7aad0
SHA1da16ca95c8b821b5ea56d3937b571abea7890ba0
SHA2566ed8dc3becf776a89021cb68f970d24c957799421d3afbc13f37ca8fcea254d5
SHA512e1e6623104beec5423de1dd1d83da1cf0c5b21538f8e403b61289ab5fb9ee18642d6c50c94122c5d443c9cd6417b94a7ac825487e8aabbaad9fdfcbba1b1dd7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551b283076b0beb615787ec2ffe327002
SHA1f33725b586f0ffe302f1aa7783621ad731ba427e
SHA2567eaba5a95493847fe5a1adac7fb0f032c27f7c4aff90caa6165fb99bb7ae153b
SHA5127f17151eb92f09cfdd2e2d6b74e9cab739afc19d3e887c0773019b932c9db8a9b8b2895836e4a96e1f62a497bae987eb893880cd3779bf94a5b848b3370fda9f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06