Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
0d218a6dc938021091fb18f236c2683e_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0d218a6dc938021091fb18f236c2683e_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0d218a6dc938021091fb18f236c2683e_JaffaCakes118.html
-
Size
18KB
-
MD5
0d218a6dc938021091fb18f236c2683e
-
SHA1
62a196e80033051ec179aa82f1035a1b321b2b0d
-
SHA256
4ab4a6798c4cd5c60d93e89262be5b4fa1acf8e631872c5f0c720a8c0c59054c
-
SHA512
353ddad484bb9ecc54a7a7939cd2b3057a0649cf7444bb534c362a21ea3cd731864c81d223db79a3793cf3a0ed5b8a5b431adb244a5e0c54b4350037dedb622f
-
SSDEEP
384:jSB6+ESMfL1q0Y0zGo/gpaQfAdx2xLcgpbhQlIoGDRXnW:r+ESMT00Y0zX/eZAhgpbhQlIoGDRXnW
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e3a1981d865c050c219652bea38929fb96c0df320a4ca536af7cb847f392b390000000000e80000000020000200000004d41d5116526fed1fa4bc57c99ce42fdb5210ab53e9c78caf1a67a74027c0f83900000006a4134b89d178d3208a93a574a47a52510d0e3541ed22ead7f954160915c6ec54616c722770ee0e3c78c5a021959474191571a9a853b511d5999cca05e863fcb69be2ae9c6594352468f1c9dacef099c532248087b83fce719a5b5ce27862a19797e3bd08ce8ba9c216f5063e478c46fa39eb465129811a8eaa65a43c249c182be894d96ab9e9c7f8a80ec9a50b462ca40000000d5908f2f3254cb8565a04af9508b0134b405a9005ae2ba35c964852db173619e2e4f88ae7fb07baf3c61fc836eb3d4fb16d2dd934f5e83e81bc5bd4c4576f837 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE66F381-0824-11EF-99B2-4A4123AE786E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420775885" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000003c459288b8f8e82dbdbe84e11fcb05372f867377e5c053ad82a133ff1ab3ee9a000000000e8000000002000020000000be9174644c5614e076871a5b01bb319e8a47acb10a06e9bbe9606c403d83331620000000e74f294aa23ba3f7b2a3415a81fdb65b14158919b9eadfbf9fe1f43eb88baa884000000080064db049098c5a85d4abcc2cfd952d71961a56df958782a46053bcc892969e326f2330dada473ca783693d54aac140e336aab4235f5dd857e5c4a93419566a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d6c1f6319cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1704 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1704 iexplore.exe 1704 iexplore.exe 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2448 1704 iexplore.exe 28 PID 1704 wrote to memory of 2448 1704 iexplore.exe 28 PID 1704 wrote to memory of 2448 1704 iexplore.exe 28 PID 1704 wrote to memory of 2448 1704 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d218a6dc938021091fb18f236c2683e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58db91c48f6fa08295a8e0bf9bbeb2ae1
SHA13912885796ea7600dab22cb40663bed64f23441e
SHA256aaf1758be3a443710c690084a81e5a49f4cccb43766ecf04526301b5659fcd4e
SHA51297e6ee02c4c908740e99d80b28ec23d83f56782aad416a20b59b15b50611d168ce38aa874fa87ee07a14804efeb3f0e45dd08779cbac2e0c53980150eda76c72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef8f633b194db9b34e4306c7b69fe7e4
SHA12d8c45d5cf9a250a9642ebe4c36718045984b9f7
SHA256a2a474c02a9808c65b76143ec7fa584dd46eef0482daee93eac0c847eb45b98f
SHA512c4ded81be35075c4e5a2c8404cc1cc98305a49de8fc2aefb036c431238271abf6f80acae23b43bc233eb505b48b904be15b3d377c5e0fa42594531e0341e3795
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de3a325dbc412d650a55a08d8aa0935d
SHA123da936976b34561c2918c7a1f106b847889053f
SHA2569ee082f8d81de2d370d6f6408c5152a34864a01a6b28b3760641598ad6bf76c1
SHA512ce0366f9f6c136a49782a40d7a9c947ee6ef9c53ae1de103ba32397b69e9da482cb379601463ef761e0349b755cfae9b7f07b32d6c509de4b4fb279545f1a114
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52844e1f4afb9ab019fa30d062c1e7f59
SHA1ec79a715e6a7d2817296a530b68aadcf92dd6acf
SHA256e74a5721569d26591506580640795c78c1038f4a41a8ff095539bc0599040486
SHA512a8e1830736d0438c0d17751ae1ee748f5a9b7aabd2f4c8dcb2e9b55c6f99210e0fe96d724c48d529fb9f7999d43fc784729b4014f5db89a55f5fdf0f23ea43e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5266b2f4e845fd9d8f177b2d18f8dc766
SHA1a3c8cf6cdb579ac716ae45c7a5f6f9e4c7ce2ca2
SHA2568ad10c7dcb665814c6a4693dcec5a5f92ce2d8c193f3ed8127d222d5b102bf42
SHA51279c51a8ad3697ffa4101ae367ed1468f1e3f2dd2c3d9d594a92734d3e17fe9cf5688b3d6e03493e1903d370a0aad7278cd1c830fb5efd9feb541d1dace281001
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56824bbf52d517ffb7bb2b3306c59dcc1
SHA174532d14dc165d9d546f3c668448e9ab84c31da8
SHA256d9613755f317245df8826bdc5dead4d4b880f236efe72109aaa525cab4092ab7
SHA51258687ab27be557d71f5fa817d891641caa52a3fa4bcfc99722563172895dccdc3bafb5413394f5bcdb9c9a4e936ae556e8509c0732e2c2cd1c90413b36252bbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c734615e5f10b44575d39c27ae6eccf4
SHA1835a1f7ee94773d7172fdcbf6a311a807d89771e
SHA2565feb8e975e272515ed5447b8d24a86dba27aa6794c86af4adc3b5212d7ba1da6
SHA51264b69c3a1bd3af6bd335c8bd71562e089899700811a5afafca46b01c312a5b1b54d29117f245ad7e6721131b36497c76a0bc0372c650869e436cdac3048a2a3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592f89c6535b1aa8d62948a6020d09407
SHA1f274c9945b846ced1a2f2b846d8374a42666a174
SHA25672d5450f90f7d082d08090a0cdad01934738174a8bf2b61d0116ed8c7830ba8b
SHA51242d1d7bad841b89acc6089b581abb0995149f0d186586abb16c8b2909cf2379853f73c165fe7a5b9b5b4dc41874145a82adce1f89f8723ebae2abc43f441326a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583a81dfa2644b7f80d39487402487060
SHA1f1dcc50aba9983d5551dbd5e882f74cc23b51061
SHA256faf194e47f31833502a7bd07009d6df4bd493403d4b4890d28e6f63ed67fd539
SHA5128acebe7674b751aec1dd2f769ab492449abb6f80035a3203c3819c87ab199d33e212295f63f4a76f10ee559c940fdf1afea69d7355d17f509f5d4d06c01a5d9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3b47257f9a264313caf9f4f51c5b0a9
SHA1b6d0d6a14d6b9fa764424a4e2de256fc852d3bcb
SHA256ecfb20df6023ead45da883baa69d8ee66a30b89e28e328c05e362c42034c0067
SHA512953b9cf8d8156e79f5061b3154b98b7f76e713ee3989c7f4f5299f16d8060ec124c589100b905c1ac180b4ae78b0f88a5d1ab49df8fd5d805abf527809d29190
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b68c55e1940380dbb0150c1e7d667c58
SHA1a8964f9913dcf0edb33a8e06f43ae2ef7bfe5d82
SHA256d4eaa38615c9c09759ad727a94b7e6c7b4d2ddadbd2bc4cbd48217cc3d85f7b7
SHA5121a7c80b63324b86c5b5e60d55f440de561d01d6bdb23807156e8c0d7dc20c79e34d39f647f590818824f3f813b395d4dac4da419227a15737a7e689f7b903938
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db7a80af54ee0f44b7810727c051a8e1
SHA16a7d00a3472a44ee7ffb7c7a2322d1eb82ced6f2
SHA256d630e83b8d38d014f692c9affdf3a292ab85138a4be5e0d8d638b72ecd4d2af9
SHA512f79c014173aeecc1a8e49c0c3cc1d07c175068bb23810dc7cca72bd3cdab2b852632f72d2bb263d01398d896126212176cd3643b130d2108711434ff8d8743f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c4bde28f03703f72770eef3dc595880
SHA13f7f8d341fc08c0fb39c650a0d3cfd8ff833e07b
SHA256cc452ceef79ed40d7eb2f8f9eb60d98ae844ccd749351c0cfbb933392a191a6b
SHA512bc34672ef23f0bfe4aa14cbf89d689b22fa3c0f14b55f7f926dc0f5af6fa887ada82a7b282dc658fb6037df02c8a092c0d22e8dbbf5dfe4c2c28f04d8f23b923
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5761c2c824174e2d4a5713fbf45ad87e4
SHA13ac7f7b0abc2322fe5315d879075debad7b7d0de
SHA2565138ab167fc46493a48daab2130abca30a00f3602c0f65ba33356a214ea1de03
SHA512281eec76a19f364ee1bef92ffabc56ce120abe3343d2cbe7d39096ba618b792c9d5e8d69476eff8010b86977e13a7604155afe487a0fa3aba8e914ccaa4ada30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58abc04f61b3571457df33e2a0a499ea0
SHA14d3cbf3d0900d2d69a0928b6543bf9a43ca47e01
SHA256d03d5e3d79aebb3cfe127ad038868e792c9ef0f45fa3eb886672d867d46676e6
SHA512f51239adc9aa432753d10268c5ebbad30b60faacb73874547c725c182e5f5dd56f5b566f0b0d4f04ab2b92aa067b6040eccd64e593faaeb8422d71e572b22160
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7302a79f61a7c27cf09a8f76b7d13a9
SHA15640abed9e017524f2146acec93ac58f22df06f3
SHA256aaa72fd97475e0495a468013c399deb03cdd6ed11c059bf9fe9b1f53e34a6980
SHA5122434aa9d6558a90129fc46619afabd8583cb59221c08dde15d5f3d7a7bf4a2218af431f4dcfc331f899eb6875d514f07f036387ad88de642ac5f2ccccedac63f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d685b8c8dc80096a6c298146c7ffe2c
SHA12450254df99b9fee2703cc5f751042454c453c2d
SHA256249bdd44646353c308580228f4b1852a2312bc4ad5676fe4a6510c42515931cb
SHA512166189e2e9a04a68b100492b473acbb9960a34a48d7ba0c25975089c0cee98379657ce0fe90feedfab36a68eb36eeb8d7110eb194e17cbf63ccd483d6d3c9533
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cc55d9697a6c73299eb994cea81726d
SHA14be8d9dafddc83abe8855c9190cac87094969b9f
SHA2567b187bc3c504309e7d82390e45a52045fb1f4e4d1efde5132845dfaa1caf650b
SHA512b04bce9e1a723039437a181a3da6adcc7b3d1a5f4af1d5ec09348db6e0e419fcee4cdb49b517adc17ce08d9cb8865af3b8349c2cbb524f953e8b718fbca992e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566c386866c4b83accd9a5e54aaaaf7ae
SHA10e624693c10db6d919587dcb8e79ef14de938b72
SHA2561743a976bfc53bffae9ecaf56a7ed8bfc8ab33de465ede8a4375758bd7bc6873
SHA5121c2a3b6bedd9efc826478cd64514a82981f4ac3aaa8b06698efaee43daee15df1a057dbcf7af3e21757015ee092ed8970926f3ac56194448d794e45b534e932c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a