Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 09:52
Static task
static1
Behavioral task
behavioral1
Sample
4112b5902a2c86ee600e8e14583bde35_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4112b5902a2c86ee600e8e14583bde35_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4112b5902a2c86ee600e8e14583bde35_JaffaCakes118.html
-
Size
461KB
-
MD5
4112b5902a2c86ee600e8e14583bde35
-
SHA1
bc485add31043d9ae05294b06618436b392af3a8
-
SHA256
b079aba94059435b48cda3306bc137de6a2b1939f3fc7e5b691f0d862ee8e1b6
-
SHA512
3ab11200608be95b2c2016b1a392a8a9c7438a42120117381aa114644bacbefb6fca9b7dceebc8ac55bf87250c4d9cdf58dad362d7ee527555545294fde36530
-
SSDEEP
6144:SxsMYod+X3oI+YtsMYod+X3oI+YLsMYod+X3oI+YLsMYod+X3oI+YQ:I5d+X3H5d+X355d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421842214" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00cfa83e4a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000356757c5212db8191536d013346eebb1d969639a9d1a4b70690b73dba22990e0000000000e80000000020000200000002734de48676ee244c6d98005bd948a9285de1cde5fec3d96ed094e70992eae5020000000de95d0f0f4e70e709355e86bd352c040045824163e36b716c756008373bee71b400000008c80aafaa67c9dd5754ea5c2ea8970d6539bdebabbe3d17f11f4f395418b417164e1a542abab10b33bec7bf3532d2404cfbc77b119dc9f470283c820523b3af8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000dba611e10fa824a8e6b233a5541d1ae1c40b13d111daf809e2714b75427b4f7b000000000e800000000200002000000058283d58595451720b7d3886a6d2120a41e777357fbbe8cc9f200d35ee7f0e8390000000f80dee60f09924207bd2f72f85dccf9424172d0683b2de45e5561bf742111a005aec969973934c60741610fb47ed1d67298d01de4777b564cc9729b6066146fe89026261632850b56857c2055c146feb42ad6a58bfd5c46e87bb331258670b250abc42cc1aff5a9dee772dc03b0fd36f3b04bef32e0448ec0a7c8fff9c31e4c013298b3495a0877be864e2e2d5b8e3e2400000009fe7165f8f43f1071726298f9d592115b4ed475b5ec74608c767a44e6d0369d96b4903ee582b22e066afe9ceffe805fb6f8000e6e1a75b94ebe33a6070597edb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB6AF8D1-11D7-11EF-BD6B-4E7248FDA7F2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2100 iexplore.exe 2100 iexplore.exe 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2152 2100 iexplore.exe 28 PID 2100 wrote to memory of 2152 2100 iexplore.exe 28 PID 2100 wrote to memory of 2152 2100 iexplore.exe 28 PID 2100 wrote to memory of 2152 2100 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4112b5902a2c86ee600e8e14583bde35_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2152
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c51dc4acd8f2e6251115da149f6c342
SHA1d3517a8319ad97d1b6ec9174d0cf56cdd5b12faf
SHA2567c3ce1a975303028d4ed4aba0d907fce5d2a792422fc11b39f6487985c1ced08
SHA512fbe43ee0ba42a919d0ae2fe20f80c728e7e117ba45ef609432e7244ae941e441bff5ead9a0ce2fd4350d6712e5806da68ea81d6ab59f6d6d20754d16dbdb647c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535a35d64003dd1eb61fab4f2a960fd99
SHA13fd0ff7af6afb0d2a7e7db45b4698610799ecfcf
SHA256193e69730bb1a1746edd1b6852bb2b4d5e12203ca6ec3a71c6169b653695d7e3
SHA512c8bc0cf552266a018b1418e0e8f950cdd19fb2c3c77c3efb550a1c190ad7c60c9cf40591af1d91c6c6afa30d4a7ffc5bc3bcf742fea4e23ab935a6cf66fb304d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b436be03262f04b9e9a0a8f1bd127613
SHA17af37163e352728ec0ee74213c772e0ced5a008d
SHA2565547ea3442cfe66a2721f3e1a3dc103a1daa06f04e90aa27e4ae9abf11a63cbb
SHA5124feb1220d931e43488220856aacfaef25c3d24102d143b1cf2c2930dbe2d78eb8138dd17500612395dee007987680c87bc9a61e778fdab097377df3353f3a1ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abbb101e2027aa75fe6e6ac6c2b2d1f5
SHA1b4ed999fe00803a51950ffb758a13ccf78e9c066
SHA25601d73c93b4620cebe4e3f5b1e96d7d95a7b11785288d1d1837f083e36102da59
SHA512fd926f0484091f16805cf0cae994abeec3fb960b172409ec7a24eb32b64a603674c18c807ff19d2dd52cf68f9622ebc3164963f820786945f1b68146e32c45dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9e4d72cc8fbaddde987ec470cffee3a
SHA110c4a874a745ed5095e7de11d86fdbf969c7abfe
SHA25636800e2883b1e7ba3bbbb59a93243ea8e8a6276137d63ea0063effe08b57f519
SHA512048a26f9edd3029eba388ce3f6cb092b776bfd5c25e00ef4d6b7859365c5b1f3edc4d224cc77956e9bb0e6eb4083191e1dbb373cd139a8def60b3919a325a677
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fdbfe4a5220d0f96c33e430586ec77c
SHA18fb8cb54cc6da26e6d4f6f7fa6137506f72af109
SHA256f2166d223416c526590953fc1763b7ab6bf8e1f76fe6b619b1855c64433fef91
SHA5124c2d67a82284fccf41cbe07e0fb1029628a9667391bb4880863c499dccc855f25d76d5b0b80a54f612b6eaa928780398fd6464d9531e234f68bc9ead1c8841ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc4676b894d837b6a4d3d1acff636f67
SHA1797589ae83f5033697ea00005cf992a2637e46d8
SHA256a3e76c06a7efe9c83436f93300e49053dad70cd576b248580edba7922d2c0513
SHA512a155d8b87dae18e3a67cbc40b1c8e8de64daf497429df23f86a5ad4c0a8329551a9cdce7cbac361ecc9e5f3029ab37981967efd9b89a061b1aac42ba82617a77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cce43c23abd5eb5670232436ac4f498e
SHA1975bcf73c07bb40c7c67237f3e16f1d63c4885de
SHA256e34ae7b4a23fe46cdf04d27cbf35c1e36da3747ca779613e5e021842c72d0a8d
SHA51298ed0683177bd31449cbbe596587556a6bc5431d8e2e244342d075fb0fdcc091883ef820c7273e548ae8cfbb030fd0f73edaf24fabaff0f18c2b589d8b0214e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c5debd914c3b72d1e2075b10c0443c6
SHA1ca65f231f9f23020e797766884288f3a91762a27
SHA2560584341f6954877a79d8cea130da88df6fd1c58cc5a631b780a9664e7dffb4a5
SHA512f4088a41e6a38c925cef106027cf24e5e6489cb0081f72e9cfadee71a819f610d7c93af51790f95738d8fd757bf9539ddbb53d678557739da9328f0517b5ff45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be05c58de8a2ac52fabb27e20ad9def5
SHA1052a7ec4a73e8c6619e1e178984e075a08eff443
SHA2564ee63651233e3331bf68841318975721e6ec604e3dd85108e38f241e7b29a661
SHA512202f1b9b94b8b57b3d91ef03d4f979608d0d457368cfe58c0a092f1d0a6487ebea95b03247a1f5922ea532529c743c0587bc5367aa2c25801bca6c6a31dcd8d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5238c19e7b94c7040b5bd51d5fadd1a00
SHA10e7af49a5cef66a340129a56d3e1bc33bfdf954e
SHA2561e786a287ad83c65e6a6ba2e19e2629301b5b9a1f021fbe24e0fe6e07eacf7c3
SHA512ba81ab0b4a7c0254a34ff41010493667634355859a7b5649bb949dab1f9945f92b58857a6971f5f202f27f490da0458567016dafa603192410343059f247a176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5149efcf9ca5bdf9f8e5430b3f1b942c5
SHA1eade0deedc60962a8bc5184d8ded3fa21a35ce27
SHA2569dda08bdadc269b9cf382d017647ec3f53dcc6cb229c1bfe541b32fe6b24fcee
SHA512a9c7d86454df49dc2a3247f3107774a77f2d62fcaec5e1d1dce840702f4ee84b3632c00dbcef2f039892d5d4121595f1ca42b06bcef7a5d160babdcddc66e75c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1ec98b76a9aef0e681067189c313fd4
SHA12ab144055c689527759afdbca2b62a92191aec50
SHA25673ce913beb37213cbd2e16dea028312357c238912ebe5bbb0d7833188c6e8558
SHA512a41359b56b5b46026a25a844c6715a84f3a6de935ce07492a6d57d847ecb50448ad78bd87da490f4440bd1dfb6271f7d0beab98e8b7c12d332701ccf0dc9854d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b843542c5c7ccb089cab540f7a1e7f8
SHA1ca4fe297216a791fb7a6b77ffe7a2ab7fcbd3082
SHA256624fb3d5b1b211a881a9e13e00345d10a81554f3c48fdd3c3ea25c65a3dbb993
SHA5129ddad5112a0807582771a80e883e142bd00bdf94fa0ef4c0aef1eea3d92a952993d0ec2129562e6be15639408bfb0f482a9a18e003c912bfb6a4bded98283f74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c6098c47687e232bfa07e8978d563d7
SHA1b0fe041eb1a1dbc0b1ed8d10a51f5e7247a09633
SHA256695613167089fb5e39bad289f0ba82547ac3f2321f211a0ee4e8f8d575215741
SHA5125b9dc752f38523f3e0f147f59adfac701dda6adfa4cf5c313c71f84cb8441668ebd49668910b8643ed0eec795d044f542a6c6fa8f58ccf28c4b7d11c1f4f2268
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd5537b2cca503e4092afa4dff085dd7
SHA1300d70501342fec5dc70b8b2cbed37d6fcd36462
SHA256154fd133c4b4479a4efb4b6cd236157ce26934c2821da7678ea9042d0840a195
SHA512118b78fff987ea186f5978d988806767111be60baadeb61053d13c99826c1863e96aa00396d2c536804c82486dd1627c82d966fbae26079676c25f639b71a9a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2c52e9874d642beefe89c508a1bda4d
SHA11f383e77ffdf3580518163983f4e2e8ac831e2f1
SHA2564bcf83457e40ca7d5e85f85bbdea38860f4ad9de16e994d81593890ca9de9c92
SHA5128bcde54c534daf28d2b7dcf0db1d86b3ebcd2a5292fff71c447726e3e47a2c213ec0d9cdef7c3953d5de4d73c71a893f3b2fc91c42dbf543a99fb5a4885b63e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a4cfc8b57286764659498549647b973
SHA1eacdb3ec1964db1913e169bce6dd935c61f73d0a
SHA256bd8fd2369af73caf069c14b7b060a54ef00cfecd25235a046b344054d1f9e44c
SHA512addbd00ebad7cc6c676d3906f58272790e1c60d50fc66ad0668b32df92dd14808b604ca389522e7924ca95c31bbf5b75f7a2668259066f7716f15f5308345be3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e5d6ca7327d3d04f9f4059dbd3ed0da
SHA1ff13d6f23cdafe80a2f29c712f43d35b251af673
SHA256f55c7e1d9472dfa4e9ab977384a8d07a6ea5348bd21b9b84f5fc7d2c8bb892bd
SHA512dbae499ad14b19b8e05900c1591de1abb78b7f46b601c7d5e715703f801aea64e7ddd829edec1d92d6da1b86e3aac357deba264fb520dd15172fadba9d630d00
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a