Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 03:51
Static task
static1
Behavioral task
behavioral1
Sample
231277589d5e0c4d386e1ec6e68333a9_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
231277589d5e0c4d386e1ec6e68333a9_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
231277589d5e0c4d386e1ec6e68333a9_JaffaCakes118.html
-
Size
68KB
-
MD5
231277589d5e0c4d386e1ec6e68333a9
-
SHA1
9429f78e196eeea4a65b84588af2f1ca5a702a53
-
SHA256
76dfcdea1648762a4ea4b281b92e20a06e8ce1ed892e0d468dd43c61f9d2d2ba
-
SHA512
12e78c134456770358399dd46f67544d09a44ec0d82cddef0797852e30071d79ed11d3121412d16e2b136fe41bd241de101c0b1168974fd3f96156791b7ecebc
-
SSDEEP
768:JiLgcMiR3sI2PDDnX0g676KtEa8t6oTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:JDCtE9tjTcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421302176" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000bc88c6041c6948d1fd4d5f540546818c6b67b55ab1aa4c0497703c01af0d6a54000000000e80000000020000200000009c5d2c05e81ca0c6fae5774840f6fce9e695ddfb00eeb76c0d7cecb64266d5fa90000000da1f60c2931fe3c337b05136509a75691da0eb3e0dd4017058a1b4b0eb75e7436aa2fc2fba6704b285dc4507db76baadff0409ffb635645e7d32830af7e7a9edaabdd451bf61cc7b230fad2463dcdc14ea9a5a3444222cdf798a569c82f48094257d626760093e204530d957b07da33e70993094a59b5749d2351fa747e3450617105914eea6e39edaacf985c41128cb40000000299adfd934abfa652b9270817d0aff2fc8e62adffd17745234b760997502522c44cf4c4c6d2d579f8609a43b825e09327536a61c8ef33b56e7071e4c5b0e9bdb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000008d57853fd41676bddce0869f6d3af0cd7dc37e6a6f51d8297285d3a2cbca6ad1000000000e8000000002000020000000ae5ee924b326b7b8c54dfc5d57f0f692433d81d67ce7f012d93240d3005607212000000010ec6447e8c17317fb09938caab4cb15ff25813c27db977ef5f11bc07dd54337400000009f667e1dc3b7b8a5e6c38261e8e7312b0a6202eec25317f787959df0c83a62175feb2b49b28c9c264ce76fb9dd97caa943a653931156c5f671d70f0aa9aa034a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60115a20fba0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BB45D21-0CEE-11EF-8303-EAAAC4CFEF2E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2224 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2224 iexplore.exe 2224 iexplore.exe 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2224 wrote to memory of 1704 2224 iexplore.exe 28 PID 2224 wrote to memory of 1704 2224 iexplore.exe 28 PID 2224 wrote to memory of 1704 2224 iexplore.exe 28 PID 2224 wrote to memory of 1704 2224 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\231277589d5e0c4d386e1ec6e68333a9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6ebc97ba7ebcb696a6897f5661bd000
SHA102849817ee2f5cfcd318ccba2d15e3ad1cdbb274
SHA256d1e9534a88e7fd6824c4ffe13bd40b9f02d37d5feec8f9f823dd3f517a65a3e9
SHA51216c539bfcb6635b8ffe475f6c0c6b01cb80297a890d9609f66843fb4d1d4d7a63b91a4bdbdfe73b63443ebc1e406b2bf026f181a9eabe592347d800a03df7fd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d537bd337fccc9857afb017994e7aa3
SHA17586ce76dab8886cfcec9ad0baa0179a993cba2c
SHA256e158813b59d1d25fef810db2fb0841d9ad5ebbb7b4f2ea63a41b6c013961f724
SHA51220f70392288530e119ba354d6d38a9495bb997197c78c793ff9b6537535e63d18cf6d3cf05850d9de78e074bce585999bf1e311fcf9eb1f015ec97146ac2d9ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aea20ae8690a3f3b3aba3ce2295e39cc
SHA13f6d6d456647fea59acbc8de01f940f22cf3b91e
SHA25609212f9469c3fe8648c8b8f0a980798a4c999a4903f99bcafde3f8c9b66097b6
SHA512e6ced19ee001c244e6cd77cc583ad77c5172c229f8f534f8e35f74cbc5234c906f8f8cea8b0ef7193cac4c8b0178026791311cd7f6d8e3c65f97801fdfed1c57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595854375928c543736f9183a2fdce496
SHA17a3cf3f859e1593292f51ff4a3ce231f28395f9c
SHA256cb103c572238253d4e9a3301ef05ae5c13140bdebef38b09582cc5e83baaeaf4
SHA512b9d90f2fb727b45e4624a963e6651788a4d67dd0c57501a7ec39afd02351d2bd336bab92009e8074bfcb9e26c5e8481a816d79b41c44342b30716181fceef42e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5dafd1aa82dc35dc1612f12b27ce314
SHA14d231dd7d440434dd93fb08c52314b1bfbbbc35e
SHA2567e84aeb066cd7f8102c5e9fcc04dc06328b40240fd6146039b69aaddbb259c1b
SHA512056ab8c79a38700e0dbbb141d90166ab22aa50686559800a75902b02070e294cae3b3848a33742ea4c370e5d181c96b186f7e03dc6f5d35b33a05c8253f6608f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e438907e91715cd1d91ace8a3c175aa7
SHA122b613d95fc9e207023433a0a962c45ad5511be8
SHA25688ab6ad86c2f2582debb17affae85d46c3b13dfff1bf1fa3e2a3dee403ed6826
SHA512c610baad72240b0c83ca4245a63f529f16a5d1f5a8e27206345a16acab8e5dbadb2b47eaec90ffca4ad7ca371baacd1570470d39cfaadb354460c3abc16cca9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cb9c9cdf2d9d7ab1a89a11d798c6791
SHA1f22dc89847865109fda2035574b23e86c10c0420
SHA256930a55ba550a2358c48627eb22b4215764dd48f5922ff9b694a02051158c7f44
SHA512d74ae330a551319f07d2536a417ea13b16f5a6956b8080a9f5cc9234bfb6899616b21454621ede1f7451256cef5d2268d33640b6d23c588e33eda9dc5b6e3acd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5923f97c7675d3a073441123e30005638
SHA16fb97adec0daf99a12ba8cee30b80a07869ef1e7
SHA25676a0a55f970a13b63d26111e6ea45e64a2ca9267491fcef5ba6b5be79d843d3c
SHA5129df84df4e7285351d58a98f80b54b325f6fdc80072b6f3138bf6ab1a33542270f49afde75288fc5d345285a17268543fd857d7465e81c562d163c07db0994db7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1b64b13659e838c602bf2309435ca3f
SHA18332358fa0e78b47e008b320c824c947c31d0046
SHA25642e34ca3654789f6a4ab4809ce994850f1e75766f6b3733c33ee6063a370feef
SHA512e76b6e0f59fc26b355d7a698bb2408446d0ed3158bd0e82dde307afd1440a03428c385097ff90ce378c066cbac86a0d1c5bea1bb9dae55fd5d4aaec201953ed3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555c0f875a0c08e09ce16f2c6a5f5a621
SHA15ef73e759fd3c7a41ae05eb4007aae7aa307af7e
SHA2569f2ab30fa89f5b1a2d31ffac195a4b38fb2f84b5c2c622140cc8146fdd94b39a
SHA512b504338ab8dbf5dcd3b6ef9d52c8b30525674affc84d1c0edcf971d58467572ed7adad70ddb9060ea405719d8e788767b4f10471b6f65d7778b0a296b4161310
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fa9128fa44479b208bde69c7d500767
SHA1636150ca4fad8cd4fcdc5b6f5ad1de666cbcb27a
SHA2561765a92a5c4ec67952b42e459d2e0eb23270c20ff72896243c545bc2de1f35e5
SHA512b7c01d692e3e3b752cfd25bf208aeb539074a031cba56951e0762891b0deb7a03a8dd88456bbeb7d13707eacb85b15792a5f291742138bfaf4898a4e3a361c80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fa935778a8107b837bdc22d780af825
SHA13d343df55301aeea4be0a74709f815aafae62f3f
SHA25645e95dff25998e41931f499e0f91000a514ffccc6c3fc6e4adf588f264f1d0c6
SHA51257b3f1328fb5eb81b8501c959eed7099964f93c4e65081b4da97f2d47390754c67f566aaf64f4070b150bbfa06c25ee943829ee7d1dcb5bfbe6570cf158256be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59106d388caacdca5be12ae2a5e279b0d
SHA1e46e5ff170ddb0b631523be85b80fc4fe4969996
SHA2566589b4cc89dc914a1c15fcf253a9b26ad94b02982c7116d54d99788905b625d5
SHA512848da932ac9fd102f9728a299f95d026d419a9eb316f8e236a18b727a4262edb47a86f1843fd008defc2e9dd63375fe956a908099298390a97767be7bc79dd8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fa7cb0bba9f138f8f4e0c1f0e40cf90
SHA1ecb76cf91a5ccefe7bcb40917f1665ac4c100ec8
SHA256abe5c1ef7b65881ea897b35b0678cd7ba640cea91e7a60868d90ae5e7d64a67d
SHA5126ab8207e18a346ea17b16d3eb8b5b9716595c3f42a07b52575a13c5ed3256ecc21a2a705ce149a9d905217984bace4aac760583491bb7aa35b9bf825afc0cd4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556e041051a97ad67cfe1bd5f19f2f15f
SHA12f03bb16a99f0c1c4d77f82a5914d295fa67a156
SHA2560d959f886f5ac515c07f50719dda42626d2a3763340910931eb393aacbfc462f
SHA5123d4b5f2be632b003d79a332e9e06ceefdde95ca4e62af1ca16311200b480e8df050422228dc7d998ee3f331fa4e28ea5d1aa9cf2d48f38aea4850d711e45d76e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e277bb8680e37960a1995dcef1395024
SHA1d0d3a9f6c48b86e43858c663f4e5dbc2c3c5ab0f
SHA25632f17210abf49483c555a7ea08b2f7572ea6bd4646d1f1a4db2d71720b494e9b
SHA512761dfb6a68fa9f290ef7c3259f2f726c43cc58328d0765c112163fc7031caa79f8236c69b6617a8330089c883625d966fd9e1e5d6a6a93b2b865ddb26d9a84d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c990c98b46d73a42e333804c069475e7
SHA15785c7456db1977ea2bc19330de5ea43a1fc6699
SHA2563b28c63c14e01e8201225ea161bffda934fdd54777b9877b7e6a69a21d4722de
SHA5127ad5ebf535b3914fec71bef5f7a2ba6fc65721d989c09d3dc39ad6242781530e962f4f76997a8f34e294ab35887e8af142d4e3d5dded8cb3a7cd3fb3b4c26c67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576d4569eb88e69d91d69423a9fb2b162
SHA1271c21eefe101d139c19547c5e9411e2df1caf21
SHA256fbb033906a66bb477b199544a46dc7841881a2c865d0d493de37184c58e2ff9c
SHA512322493be34b4935a228da840ba1af5c870ce952f2ca7e0eccab05aa634842a609070694264b90379e0e9466684d803ac24e3954a1d2d248aabea83b6e0e5f23d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a