Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 06:31
Static task
static1
Behavioral task
behavioral1
Sample
2dce615c03da1656144c90f7a9d7bc36_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2dce615c03da1656144c90f7a9d7bc36_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2dce615c03da1656144c90f7a9d7bc36_JaffaCakes118.html
-
Size
4KB
-
MD5
2dce615c03da1656144c90f7a9d7bc36
-
SHA1
28cb0267ca47db95b635dbbb6fecbe56c0c9cc83
-
SHA256
7958b78100aa13dac0109b5cd6f9e969d78621ffbe002ec0e7b8f677c3eb831e
-
SHA512
16e2efc40ff8e1e46fe92aec648f829cd1f49240ab22fbe02be05c16196d0388d29846e7c39cf6cccf1fd9cb6552d39893618c1e5dc7884a86557e394902cee0
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o0WqLiqr:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDx
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000031b731a7ef408b8808e636e491bb978075983b67e26862d28e12addb214679b5000000000e80000000020000200000003e3f90dd53876fc35d4c6ec25e40b9f8549603daa9e5873344af298c93bbdf5320000000fbb7b958e1230d6b71a3a7e2648e007cc9f0935de83c9859e4f14d3b672280c54000000007362cb5afc08df875addf4644b5457b3942741399d458c49781d0c14c202a74559349fff8d3f24d75630461e9d38424fcb6ea2e8336a5d5308854b6a3233e33 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB2770E1-0E96-11EF-8C89-6200E4292AD7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000b6ca9eabd698e3764c6d8f751d7388c316b22bbf9f4aa9ed04806c7df0d198ea000000000e8000000002000020000000763d06f5bf421a4bad64eaa6bc2efb572dadc5d136cb70742545455285f71984900000009527f35035e6d84da3c186fe33d7591fd51d74dce61201d38724cfdfe26d51a157d3541bbfb74683b9e958c37532eba1ead718088e931326e9d061e441c95fad22e158aa4169b4893f0abd18372d0b6b31df6fb3860a558793e2d74945ca4700ff78c303504044387c3cbffdda0c4018b29c7e3f8f35116904c9f130012720b5b5c7a7abfe7daa816aa6476e26d9c51740000000696afafd5d288819170c330554753c3c9858038304f1144ccaccc2331a9004333a54644f5eb4d90ecd8d6549049e2b1dc951c5e77a0e451adb0af51cc1dfc6cd iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421484576" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a9b7cfa3a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2232 iexplore.exe 2232 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2832 2232 iexplore.exe 28 PID 2232 wrote to memory of 2832 2232 iexplore.exe 28 PID 2232 wrote to memory of 2832 2232 iexplore.exe 28 PID 2232 wrote to memory of 2832 2232 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2dce615c03da1656144c90f7a9d7bc36_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a03127788fa08873638eec8beff27b5
SHA1c12737a86075e67c614fd0cd5a2d104466907e4a
SHA256b4f8d3f5568d404fcd3baf196a8cc9bb0bef3f3f49fb769ece9e80cbbf656a36
SHA51222590b17203c9516a249966deaec9e127818d1ba2fa9e37c6ce7a098402c127b0d268180e640e7201d99390078f7165b1c3df260808545f3352f122bd741bf90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e28ad77c6720240583e4ac53464fb49
SHA13f21d202e1f9c3a21ffd1978975c0000cf104753
SHA256c91edf2a4149367d00da4cf073eaaeb03392fec93c5d497e11555c6fd43a9acc
SHA512a72cb6fe43e87d4a88ceed2745ab31167c3fdd64b00605d51377045df88948b1fa1f69b097390d2313fe7f8b41894b06d2d52b1b5787a8ed7c3857a39e23836e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b9b2a7c806b414bba5a5bdd81ee8822
SHA193fb04e46677b747cf4666a8e1e3a665a12b49af
SHA25626825aafd7fd8a407cc5392231f0e76ed283aa343d48a708e9e03f8c31ce56da
SHA51246e04afc7587dc16f463434d9368b5d4d96b43150b1e5934a33f4df7945157ce40173db8683b83463324bc33a4f86a1be90f2e65a6c08dde4058f3bedd4568e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587305a2f119103117a8996f24532727c
SHA123ce31b4c8aed43d02a378a138533e6d8c710b70
SHA2561abd89b3982f1d7954b9af5d970df06ab01aa0189a219104b58f3fe659e71f49
SHA5126fd38d1a0943562303bd511aa00159020b3ec69bf440b16273ace7298aa0b624d72b6fd8ba5d7bb3c89fb55c84f362031b57f502b501975808aea64f3871d505
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fccf9b4a944bc8ec4b45eae073323eee
SHA14b626fd27a041766b5355e24e7092459d00f9c98
SHA256342a4c063e642eda6687b3f1d4c987ae77b1f67b02598e102754d6bebc4b05f9
SHA51217b21b3caa6dd5352980a70f4af99736ac0b6bd0c327ba31a1a3fc684b719af47e46f4e6c2bc8fff7162c69b3206210a7138f7dffa1c7eff6d28210d975f0149
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad24477377b97f7cffcd499c4738d82f
SHA191bcfb1b8e9fb632157927574eff678b81809ac5
SHA2566277b06f42be3cf386e711fbb41976f1b8230186ff5c27dc780c8788aa21a12b
SHA5122fc6a3d6c7bff4001c5a0d94e7590a14b0b177a5bd0910a51e6a16a7e1a84475fcc20d06a6b578ea7df8eee9ee3483701c311fda11f666c8acd767ea5fed2002
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ca0b87b0582a27bc3e9b53972de76a2
SHA1f5eaf1eb55281f5f7494c4528d02d6a1653e2c3c
SHA256e222e63658a85546df86915e0a603e5d6113853f908e13c60be25aad035292f9
SHA5125f4be060c6d9d4aa21e0ead016e4327039f82b21ca3de2d7953d9ccf68431911fef7854c5853e57813247a91e63c435057704d5dc2b71ae8a8affae0eccc28d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba1aa8f2315f8841d72f51072881b7e6
SHA18432c52e6b189d1a1e64b878d657574ed3c0a1a3
SHA256db9c8fd21945e0521931f7269c02ced6d596a01ed156563bfb48e6327b03a345
SHA512c0efff29b9f9ab49387308a8a7fa326d2c888addbc9b22a2ddadb0e74882d1b550b7d0b27f79a7f4b99e6259e5831eca7f1c47a8a8f2616c056c8033294bacdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5670d3d372ef8ff0bb253f29defb28d3d
SHA18d282449cc9a78c5b0d6be47f435d33247cbebfe
SHA25683f01ea56ec1ddcbd435625717e63a2967fdaeeabea231e7c5d3b800cb85a7f3
SHA5127e1aed9e55124d3305682dd0b028c00ef50c26c7f4f8e031224f46a6bd460daef1988c2dc97a74805a221a4cf80df16f4ff9b0e6a910cc29c666cd81e17e97f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6e35cb07c3c9105c6fa7d4157f05638
SHA172323f44b568906db88c11e43c4208c72d58a355
SHA256fe73740a230007081b9010f54678a56f61e5a408ce8284d6b0c4372ce1cdb4f4
SHA512ffa472c568ac2c77b9a8b55fa93ef4c43c06aaa2970fd39cd0c0109116d1633cf97e2531e887a061c59156ecaf3941609d348b1aa911493982c4fadfcc37cfe3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dc07edee5b518cc42f0cfd9dc99b828
SHA1f16b1205cb28feb305f9c5bbc1827591e25210a4
SHA25670c26bfe50b306eef639848cf22dc92f92a488a7337bbae6982722092e52a8c3
SHA512a011b95d6d01a4cfc1f86d1b2d76af78b3f3b5d855883702ec4848a217e71ee6202e6b924089938f70715a93c85e7bb68f56d87889ec0318ce92fc09d1f11d30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f8b4a536ca5e352958a8f0167b1ff72
SHA1e35cccc219de2e0f5b201a6d07a61f8c17911aa2
SHA2561d0ba9846a70bd9332ef7964c9f277a5a00a82c532a964276dff5225263779a8
SHA512c63fa38b33973a9cba584ff03a9700f50e834c0e9cbbd000551470dba1b996aec0fd9456b4b3dbf97c2ce62cd95cb9436af9c742e6c2d5cd73eb5ea753c8bfe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfae039ba4171a0f0bf623d6008e59ba
SHA1fe5169899bdc5938b17b46b9a7a3b6e6443b1abe
SHA256994ed4e0a0b6fb0ca42ff32d3a5a2fcd57ae7d48cec45c4abb186606ae8a4fdf
SHA512198209018ff934c05d0fbb5169a50b78c2e0721a97e0990c1ff54ac22a01011e0d8cee7996945032346cdf5618d493b6277f9cfb530af688d1a05e0871ef6f12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da3915fa33c747b38101b17c7672c4dc
SHA1732491146745cb28931c30021dfa0eac4f7180e4
SHA256b9410c6eae62cb300883e191ad00b8b115bca731f83ad95a6392ef7c21ed017c
SHA512ca9adec34d78cc5a3130eaf228df264996ac05993b5ef89b09b183a51bc9e4959a5538ebdddb96c2aa5a3bcf6865c006281c2c3da0287e4c6b8d7a81e1214657
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521772c6a7f191f9f9211920594022812
SHA1d3f100c1dc7b5cca582c639dad098885884452d9
SHA256a9a3908c0dd9eb85cfe46e6b43141de6a02737647379c420b69b60c77987c12c
SHA512a40448450d4c72ba28f1d99871b22dd7a25ee77e98fa83f71121af0f37e98b3348d4af2b688a7d8e9205a6c4dec45fb82693588cc5769029706959c893180681
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57792af3e6148c99dd6848d9813f6c607
SHA132e0aeb00c94c6c9a8e7a481e04bbe93d582f2c1
SHA2565981aa5764a50330e3a91b0c642a25b385e58d916a65c685256337d60850a6c8
SHA512d460951b806a352858c330e8e368977aa043b3d12193674f96f16ea6de05240ed762231ab46aba085fe03d9712214b2c9657832829d4b5be675e59f12042ff39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532d2ce7faccfc2a04728f6c12f87df43
SHA1767a91ecdff0f8b6b92a26202cfce2e1fa427511
SHA2562fb9cd0a95b676196717ae1a69680f0788d3e3f42c9418a825e3f91430c5d7a4
SHA5129e8c7056547560dca294b4bb95e47a672246801079bfff4682cd476649fdf4d8e0774240680699c7e2e804957bc88a8985bc5ce2f6a84f0fd19ff4ed4c64a7f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5327c14485b065528d3b76d412a7102fb
SHA1fdc249456309415ae436a38afe99785e8bd58c33
SHA256182b5372be85d67fae0dc8fe335b2f3d3e95303e5e277c1ca246c82a17955c43
SHA51209465d0a9d1d4cb0367db8467b53863e5d57b5ff357f5a538198d7e64c288100717158c0dd5f5e096ac2f95e64cd1107d055303f6029c4df8def374a96ea5a15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57400081222d949b65f702013d578dd03
SHA1d8268d9b83cb116bfbf28adefbba5bebe82d7f55
SHA25684fe78ebd27b91443c006d821d85bcd0919da1ec51a02e6ff9f05bdd4cc15601
SHA51237be5231d2d4e7d8420f908aafce2b442e79f92a1072ed630d46666566d18fd38cbfdd091ff78d7fce35140ed4a3d75208093d5f1f8b53b63e7d5b8bef17bf2e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a