Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
4eb64a881d6ea5f7a713d04fcb29c5b8_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4eb64a881d6ea5f7a713d04fcb29c5b8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4eb64a881d6ea5f7a713d04fcb29c5b8_JaffaCakes118.html
-
Size
60KB
-
MD5
4eb64a881d6ea5f7a713d04fcb29c5b8
-
SHA1
5191fb43b7ed794ef3bbe81a5d39a686d1a40ea2
-
SHA256
0a0556280f2641165770b172c21600d046058eac990d2e2612fb1f46c436b0ec
-
SHA512
a0a84fc84445ddb55be444e89e8af33ebb60e1a5ed052152bca247479d5785de473e297862464cdafa8d832f4dd081b8770d61c3c39fa8a1bbe8bf88e246c1e2
-
SSDEEP
384:vtSH8/bKLqM0PGB3mrFqY3zWWHAoawjt1F7aTNEuTlft+DBTvkwSDUv1:vP/+2M0KXWgoLiEift+D+xDUv1
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000097186e785662a2b6f4beb263ca8e5f9f6009a879454c2472c5ec2d36248d7d90000000000e80000000020000200000009008ecd3fdc9339bfb1289a7d015626e976341762c553a67221813d02e3aa8269000000002c6a341dd8578a05bf2d8ea761aecf89c65ffc3e17b92f7a0088335b294b0886a5e0d4b3b375a0259f5be0742e1e7255a709dc19e224f6e350bb0b26f0dd9a60ee4f5c78671448afe7f7458507b95c2f7657d7dd9169507f92eaa023bd5a87c61399dfefe64efeb5f0514caf036e1e1fef54f3697385263c814c61c4e6dff8853a2b6cfbf1c364f5c739b8905031acf400000009435452259853a16be04c63edfd8cab0db298391fa7fc85dcee0111bf8d45e916a37df59f9a087ec5e23d2010bb305b085f35480abb3dfc186a4bbb310e7e0b2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0284cd21fa8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422087593" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000289e453534b2fa6f75226ffeaaa0cda9a36913234533bd7ac2db2c75a7a0b4f4000000000e8000000002000020000000f8d04249ed0924dc97a8e7ab4ec318ae3f5e8326889aaf8f64f1159d502b75b1200000005b0b4e499f34a2bc03af5d6d7384207b28624fc4b08381db4b81ba03c010ee65400000001c421b8c5fe2b0905af5f43d6db1d839856c07ccdca7a6576f5f0fd914bc559112dc4e0cf8415293ba50812438dca7f8409cfd466e15c7e5f56e7ddb1f9b4fb9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD532C21-1412-11EF-84D8-C2F93164A635} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1576 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1576 iexplore.exe 1576 iexplore.exe 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1576 wrote to memory of 2336 1576 iexplore.exe 28 PID 1576 wrote to memory of 2336 1576 iexplore.exe 28 PID 1576 wrote to memory of 2336 1576 iexplore.exe 28 PID 1576 wrote to memory of 2336 1576 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4eb64a881d6ea5f7a713d04fcb29c5b8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1576 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b34b7fe1199a02bc9f2264357b4e8f6b
SHA183274fb611925a548034acdd34037530c28d0ffa
SHA256797cee55bd4748b90e816e1283ef403c4feb003194ebe9f33a58cd15738a4a59
SHA512c98a946824c5b24b09f9d59383b9f2996c5b91d580338e2e95f107997728dc70badab11a0d1da9319153d036318593fc1523193328fcd657efdad1c7fb7b34c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfca1a49afd4029d069aa5c2c9f1f478
SHA1aebc62df441382668d0c797a52dd4ae3c4109350
SHA25648432781958a0b2b8bbe608f2d1928775582c11ce21adb9fb8d781318ecfda9f
SHA51292dce2a6bd78916f0aebfc39c4aa46012668ed09c80aa4c551cd67fa38f4aeccd24f669226ab17622fb217be565cc1315e9906bf955b5647e7c4a2ca4bf32f38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ed62b8d122b72c86ecc30e1578fe2ef
SHA19d4bcda7143108a666c0f9915334cef166d23762
SHA256e1a5694a7624e92a3ca1af3f64479528afb74dc1610a2e1c028be5609ef89734
SHA51242e28eb5d22136f709576d3ff6b4c0024f27fb041848153ec5630d7265992fce85ea0dffeedfba84ce75a35b8feb22bba8f2115cff1c76aac9cecbfab9f2cb22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52523db882d872fe41fb4d7673e80602a
SHA187dcb554a148a81ddf47c133faff10b4643e7cd6
SHA256b5543b654a7b4060774d807566537ca7ab47e9363aa70c4bba52af4ea21c03d4
SHA5125b7d646a6d2133a7f86788ecef3a3e3b05ca4cba2a1b35b9cd27f1f1a339f1ea253b97b2a9e69d4fb01d390fb42e0b974029fe72e7737f9653a84e1e9f41337e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6e5881a83c329f0df5a0a8bc6c22d81
SHA15773c3b6808161b5ec29cee535154eab6287aa17
SHA2565b304000980819849a7f337d16e1e89299060391845aa9b5c95fc73de02f4b23
SHA512cba87bbf722fa890fd706971e389451977100cdf5880a1102196da7774d201cc209456a8d3173068d120a838b9e8bfbb7cba97a1714b2a1dd624f879dba7ed9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f64841588a15cabbec692c94685e7a23
SHA1864f8af861b2e9829372da9dd44be03dde63dc07
SHA2561c090cb9216b9b66ed21dadd09a75ded195e3e297482cd6f04a45165b2433778
SHA512a6403942092db0b3f1662935a5626b70c9e6ed8f607e57f4dbb2e8c3abdf198ff3ed94a5583b9e2b040003f9052b85aefb7e1f3adf4b8be070806a1673043fd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5b6d91990ed3df096ddba5bea79a245
SHA1fa0fda1abe3ce4493e817036141cb43a971a46ae
SHA256774e31160d9925d7e3d726d2c9a9583ba616b05a9061ba5c4d1661763b39be9a
SHA5123961302dcd2a98aeda11df954edf7c39d8e90ff8cc5127d617b561ad1916242f0d2e46b0aa470000f752005b44ae9ae609c551069b10fef2ffdef716a4e1e64a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcd677ed9d96d44fd01321a693f8f8bc
SHA10566da0be6b9f4858ff4b90f0b3448d7048fe199
SHA2568be9884366d1bc8753377ae6819be77795162be85b7436a0d4d5a4e7f33e9680
SHA512dd4de93e893da67f763fd4f9299925847822bc5ef7b3effa885e1e1dd28bbceebf848e565a7b53ebbc5dead7cd794e5e8e0f26f652fd2338e135d74d0e5c3cdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbdde74f93f3e5ca176626756e8172c6
SHA1efccd8b2ba71875dd50e5ca171160f1cbbfb419c
SHA2560786366b47ba92840f98c33add483072f46ef6ffa12a712d68147e5963f232e0
SHA512230ec8a6ca4c7b79f716117ba55d5fe29a7f42f8f0896580518ecccf51074e6a4fdc10ceec89a4aedb3d4195ae0d338215840af48c00163c108e9624fa25511c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d83368e52c21ca34d5da65a19905896
SHA1fe26f6c606e581e2f53cb17ba2609fc17e4974bb
SHA256bfde097f632af0cb844ca684ebe429f5496a3df44066cafdc97853eb7230eee4
SHA512a4d36d8f9c7dd8d4b1c7f0b924017811eef23d58de09ffea30b92b01a551388d4d31b5898b8bd9afaf104b084eac35b8549b55102909139500c228cd1a008936
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531762f16cc357959a787aad51a8d29f6
SHA1c19ecd4bf878b491c41f2911327af43342e8f0fc
SHA256db40a858694c158d550fdfc392b583c2038f991edd712ca58d5214a4f6aa999b
SHA51229b71fe476f28a8fa856d5b3b0f73bb18f5f207ba06a257d187424f18162944549c2176420a29d840a304749580e0dfcd55019fd945b177908d678538fc8193f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7153110846467fb8c7a53877f6c7c48
SHA1c6409f1c9ea6e6994b07b17248a017683cbcb023
SHA256971ad33a8da6d1c559b5928f52c13346a2a2d545d79a9567c13af10753443a67
SHA512324e9a486e3ddb07ffbc4c14293a5b29a92fa479e2b4b9e623728b6dba3124a65247f72b993e036750a20ca3de525a334da092860ce684042b16aec64be2f903
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f1c466dd90210c3cdd75014ca82c696
SHA18ce24f584f53ca8235c5cc24f47eb8a983efec68
SHA2561d46e25bd447184bbd9ac5ad6afb5853a72877708411b52bc208de7527db7c4c
SHA512c126eea6f123319bdecc6851d030f91e5534a810e2f83137ec7983755b2d36e1887b392c1e00f78e55e50a1e392c0e01b569ac309be73c1094b70f6342a2183f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52293efd7ba4ae89b7fcbae052ef061f2
SHA1533a109debf1c918d3ec8da91675993e75d25983
SHA25657686211ce28093952658e17eb0f95f0059e55376a61982eec22bcd8f353ec42
SHA512a40a2bf817b3514a461b6460d53b64eb6991d263a99e44e4bce8ed8763ce17da55bf6fffc6217336e48ce3fd7efb3f144ddbf591d6f7f8161c91e5f4d8b9ae57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53de68c95cdd73b96065a2a548326f71f
SHA1a68c225de36e2197ccaf33e27b7d5ccbbb4541c3
SHA25665efe0614520a191fd1f1fb3195355aa5309842b5c461d9f2387888e7ec24237
SHA51291bc0a0b276bfa754dfb68b56bd0e72070ec3e4e1c33139187edde81a56d2935f43b1049e0d06b6d2541967e641949785485bb9a46be9164774798520a301ace
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581fbe6743cbf3e94dfb5cfc90c1267e7
SHA144ec88323293dac0eb33f4b31c72915e5175ff3c
SHA2567422f243d7d6ddfb17890b5dbf27ea21b79294f887a5ccbe28b1440c3d11c645
SHA512ec595ae81188fa4af3a52689e1ab5ea497b7622ae2dd40279e7a3e7eaae5ff7129cadfe6737bf9a8c22dc01ffe7df3778222ddbc166f8c4381815b7b00d6020c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526b4997b6b0e4336dceb829f58d8b57c
SHA19978b270231625fe7cd3594ac3a6ef74313be9ec
SHA2567a742d24aae4796449404a314f4b9cefcf5dae80ab9205fa99165cca65ffee1c
SHA512b6fd634b12ab58e445a689c1efe00799ced58dd64f6a3e8c9b7b5dce5ef2da92f68ea6a394940fdbf7b79feb76dff04841a6d7b6bf4dbdf72b8da091a613063e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509bef2b73b2d6fba3b32f3db990e7810
SHA16484e3ad166b680bdac2aa8cab12e4cf00c39ea8
SHA2563274427ab7d99e8277c1b1417915053f363afacac4aec7a1c9882ee16a7d6993
SHA5125e47d201aae934423c4519b2c45102f2accc09490ad7123ae4fb42e41b3b030ee15182594acaab04cfefdccb1dcead64f6a6ce8664eddd672dcb8bae4c7656cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f570a30c4274c35c430768443729e6f
SHA12abcef0f2143b040dd55ededdb9aa02775d09715
SHA256e88a6aef65478c6207d1ac43ff869a8d7d22902c2d681c70316636537768331a
SHA512fd6125f6b1d477bf3502cec1b57a8cedda8771ddbd9459fa2257d51ba0288c8ce5b247c920adf611bcedd3bdcc3bcb100ec2414375b97522397c668b3ccd8f02
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a