Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
105e33eef6837609346ed6a7e539ed02_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
105e33eef6837609346ed6a7e539ed02_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
105e33eef6837609346ed6a7e539ed02_JaffaCakes118.html
-
Size
4KB
-
MD5
105e33eef6837609346ed6a7e539ed02
-
SHA1
78ee6e8c6aba0609ab872339a1e84ac0a97c6c22
-
SHA256
1dc26453d3ee3218ef1a9b3870486148e371367c9a3a3758dcec5ca97f94d022
-
SHA512
5063d68f65ad0271556a9892e91d0fa3550312e92cc6668d79f09df21f7a647d98af12fec4988fbdc2f0b303dc821d5dd65255c6d5b3db73b4292538dff1ba52
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o5HVUyid:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54DB54D1-093D-11EF-8442-DE62917EBCA6} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000039157f856fb52671d65b739b4129ce8eea64a960aad45d834c9a10e707023a88000000000e8000000002000020000000846e26a7926d733d4a0de7dfe771140b77ff3f87f727e3d0a8de8a17c402664c200000003264715026f7da5384889be58140683a20b4167e664d293e6ba315f7db96ce634000000026654add75d4c2d0e623f73298991e988de315a3928270d897b4d77be0dcaad951e3e0a15862bca1a6162a633f096b5bfd74ce714c0aa9f0d20db1ecf983f7ac iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08053294a9dda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420896317" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000f1356835429ad98ca2c2f576051d826f79295b6d3a0d6a26c603d5830f848a83000000000e8000000002000020000000d929ac5bd1644aea02d6421ce2150c35e1390a4be3fb64d9de4aa42d6c8d208290000000a2456c2f992837cb37506aa451f8c2b1cf159d3c2e4037886728c45e8d642d363b2d04816b6cf90634944d354b589fab57818a98ab3981ab02946fece31dd2eb94929e0a0685a93a515079d9bab1f6b97d5099f21980551cb3d7a018ba2680f6a3b7cffb059a554a0c71f09b4edd92d988e3cb58c935ec483cb9b159d78950a67382bcbf1d2a4165bd98538dde9bca674000000009f1d43595d58b181a98ef0d7bead999c25a5896d89305477d19a02559c806d78bb10e280342e9f1d28fd61b4f86c5d17bdb1af2897f0f63f861a741623f16f4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2524 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2524 iexplore.exe 2524 iexplore.exe 1684 IEXPLORE.EXE 1684 IEXPLORE.EXE 1684 IEXPLORE.EXE 1684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2524 wrote to memory of 1684 2524 iexplore.exe 28 PID 2524 wrote to memory of 1684 2524 iexplore.exe 28 PID 2524 wrote to memory of 1684 2524 iexplore.exe 28 PID 2524 wrote to memory of 1684 2524 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\105e33eef6837609346ed6a7e539ed02_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5853a94b6b060da71079ab2a61baee9bb
SHA1a71b264f4d60ff0b5ce79261cb506f47dc85ea38
SHA25625c273a4f2fe4ea03f42a0b88dacff10de75d2680a76f28bd96d232069d0b025
SHA51222529da8d6ec74f7834af089813e22dd580a21ca0fdc5e9a5cd3bf0d1656251552f78937842e3580a63afc1b17884e99cf091ab5ce9e445d5b2069518cc28446
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50101b26a50cd8c1f11b24fe10cd9654f
SHA1463fac749aa48e5211c15ecdc57696020150c9c2
SHA256030e36c5d16f63818bf564ea94e711de81a65d596ebafe6e9532ce1fe1874d6d
SHA51211bebd2f3bbfa639b432700a22e8047d37ffcd045fea0d763d5644e90e74cc10fc47689f5261fb8cceeea201e0f7cf0dcb63663d4b58fe70cd163fcde959d786
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598fd00e7bf1f17eec9f9ceea3b36653e
SHA1d185d38565a5cdbde1336b358975da4294bb9b80
SHA256a8072c66aaf8ce92163de5aa7f69110900a32496efa58d9518961f59ac90a52c
SHA512eed04cefaaf73ef4e694012628ff49053ddd321298ec7bf6e538e3f692e0fe60c817eaa31105361732ea630298a81521d019168bb6de29aa7b72339cff10615f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be02ac0bae87cbf13351670ee0e8c086
SHA199a0979aa9ba656d46abc7d6b6b88cabecdf5add
SHA256acd66aa31cfa23249db8f4c10555ae0c1dbcaad7887392b84e2955af7a654138
SHA51298e3bbda94bd491c4aab07e7c44abff46d8847de0b624d3dd5930d5cd57e15d4bea359b591b63236a1c822159158ac7a068e590aa6a84b8fa6f1e83accb9b5f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5970d756e0a62dd05e1671bec309305c8
SHA1cdc73a4e476a94eceaa9d462daf3b67cd1b768ef
SHA2560f3e64334f92c2f8a4aa7951d18b2044bf29e5124ec5000f56550d1742f4a90e
SHA51257d974716e2e72c309892431c86f000d58ae9bef5449f8b8a198c54f4114a0170290b0f316a21f7db77e5d4a6a1cb83296daba24592caded314659cfe5b297c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8e76f850ac520eb2c07108889312fe3
SHA155c90ff5be987b6165e522207e9cd2605f862ad0
SHA2569e8be34689a1ca260bd998f84cd554fd3746051614549e4903cff59990a3d628
SHA512f345aa3f078ece230397862c030b37086696dae4640a466321cc0def996ebf07819ad8f18d8d71f2835699e3f399b23919c8c5207b95209e0ea72a0f60644d19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577f0aaef73b6ae293e178b76ab4fadd9
SHA14eebc7175b6693ba14221c3ac67fd7a145ceed48
SHA256486627e34593b625be0a1efdddb8262903e46c87f02e133db3118455d2a803e5
SHA5124095a95d3f3acfd5aa05ad33e278481f7a7c6e5f9fe13bc939b6321b8562c1f88be86c55f156cc01cb1420f9eda49de77be33d97f3ce1e550683b1ac55c0fdac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e654c1dd614c3d96239dc26c63e6aaf
SHA1a626739bcc11b031956c485504d32d674e253706
SHA2562698fd6dc63b2639cdccb2434abd0d40a0d1f76483748a4007c3d098c1c7f861
SHA5127629fddc7123bb15d6df0462a90e8958368a502c269cb2676a3f12698d4ba6b24e7a86b6963122af3465b467b06cbdd52c4227a66dcbd23633b6be7677e85b43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0b5c0ce99c3d00dd43be7faeff374cd
SHA11e7a22fa74d414c484f67b2275fe8357a9eaf0ad
SHA256f70b513995e28a24ea4b6c317689770d1457b7f4f1e525aa3d49716c85b722bf
SHA5125aa1b4d50c8ae64b0c181862d4bc9eae8543a466f1db36bc304d82458f43f0ca60f9fc76199959d51209c1d67ca60d3ef49007f19f25cb1ed919a427de3839a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8fa1eb8272f09812c771948d7ce15fe
SHA15b29cd2dd5902fb87690f6653f4edb7df916de1e
SHA25680ec0fcfe704c9df22881c2a1bb31936b83b72f1d28eb2e59b9b4fb01b891900
SHA512ade64da697926792fc69c2fb1c00e7951e38c54969a600d80b7f1aea2539fa4314591dc4944521402120cdc0c333cde8cf224f2568643ba1281cf3c9a5642273
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a01465341023454f9bba189b6b5417d
SHA1bc43e201edf8bace19b7b4c33b5661ac37bbc23d
SHA25682eb4ea12d91daf041321f23f7411ec8edf41fa4b152fba50d6441f3d7a6bca0
SHA512baf78cfb14cff642dc1a2b61a96aa5575d25b6b3a302ddcbc8f6f9e9864cfab8bd9e97ca0694d43e5189bc59b47bfd840a2bb1f2b9b7c8c4d1ae1b9cd55b487d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2e22134887d30e6f51867d4031d138a
SHA1f3aaef8f66404ca3e4c9af9ef55c0adcd7e5f153
SHA256444c210fc5c6d02647e709053f1daaf3ad5a4ebd7d6ce093a8f398bf9fdefc1e
SHA51252443461f6a1166e1c5b41b68fbc0cb2fef14599a595e164f708d31cfdb1851707c43b992c2ece75172b9fd3886bc47b236a61f1f26d4aa35fccd82f3ff3573e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1b5faee97a8a265cfc5bfd5a6271afc
SHA188f2c24cd71c403d56c636fb40f243ae1c7e673d
SHA2568ae58747d96eac8aaf3cc0b2ab02ac2f11cc3eca7488bd5b209825ad6de138fe
SHA512937289abd26d97c877d7f7b215c78180843e08164e371d98f694367b274b2b873c9b05177cb63c28e8fa2c632a6194806c724b2d1d495500297f06b4cc90cb79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad016edfc35ac1794158876309e7be08
SHA1ceb697bc75e0cdba12ae712608bcc6b72e759e9e
SHA2569a2ca54f1cc8ebd837757ea817ef57c533206a60a79f5df2c439cae56a209829
SHA51222690db2d200f43538147a7ee4f7cf736b359787f73774d526ad5b42226b7d459aa3c7c83f165ad9567544f9d71eec9d6a8fa3a51d0b2107b0f22f64b4722241
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5cedaa2b1bac8d399ec1e7521f9da4f
SHA10dd52feed1f4996adb15dfd2ad4924e2490539eb
SHA2561e314aac854a1980eeac37045397ff931092ee1169c0fa76e6c3ae577e8ae173
SHA512376c9732f090669e4107754d204bd255db68ccf59af7039274ebf7e87ffb60b2f8ea92dfa5e7dfb1ad84b7105bd573bca12d9aa075a04e90ed748a8f73837131
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d01df8cda6fe4d441c2e0946977cede5
SHA1feb4a9ed7e0aed8c35d29188d62f7f66be1a4d7a
SHA2567430e5bea169066f952eb761d3b3760fed60abf1e98ed4358a9980ebfef1fb4a
SHA512531856eab49030dd5d1da24100b5f09887aabce81a2ee4b876bf5e4019fb6a5a9c8f9e1e55ce64d4aa74ab3dad411f5ff54c5622f5ea569cf547ae544514ccfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500e012229464fb4d60b2a1d5b1675cfb
SHA1dee918e074c30d2486c2722bd6ff122406e4b1ec
SHA256ab0e74299e478547c96d00277d8287e623f46e879de5c4bd5a2f234423f5434e
SHA512b317a69cdb0dc1e731d8049e8bcddec5ae8dd38170b53f05ec1b4a5dd86eb4e22eda94006ee652f4c72d7d7c0b61f207773b57214ce7ed67b22f71af7b105987
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59305ab5a023b13bd16db10342ba9a2a4
SHA127136b6ff82b0cb61b01c02fbe99b16f65d9f8c6
SHA25698c581f0c8ad3ee782e86d8bb50c862ba9e3e903ac6ede466b11571a92f93b82
SHA512f65bf6f187251ad0b123054a67e43d12a23549a6c73c3ebcc5cf51958f219ba520ceafd28e9775fb74d25e633075f78058ad9a4407ed85d1af577159fbe2718d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a