Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 19:01
Static task
static1
Behavioral task
behavioral1
Sample
684966964fef63d29dd1a0cdff12af56_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
684966964fef63d29dd1a0cdff12af56_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
684966964fef63d29dd1a0cdff12af56_JaffaCakes118.html
-
Size
18KB
-
MD5
684966964fef63d29dd1a0cdff12af56
-
SHA1
36295c8b26c024ca1504043ec83e226b3d4c9311
-
SHA256
93b598f92b08b190ff22f40128d062c3079774af40ff980ac9a729a3690fb3ef
-
SHA512
ba29f58c47d724b08e4fd4662fd8ff144bad44917bcd5db7caa17d95ba4088ef5859dc865a659fa7d1222684c41d852e1991bb66c5e448ff8a736dabb3303885
-
SSDEEP
384:LJfyaQ5yz9zWWDfSBCNVSYPbjqZ+MtS9iFX6:LJfyaQ5yz9zWWDfKh0buWmK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000007c35f5f459272c4256e4f54195b6037e776ce9e20f11aeef7eb2e7b2dba75377000000000e800000000200002000000055967a379af914a3d9af00c26049bde489a76842f93045ca9e5c1c1bb27a66d72000000092f1d2ed67fb8536134a54ee7666623a61e04b481a0e622b3795d4f6e0b9abad4000000026a04439b92e75302f65b54d397fbef84e887e21443ec22afb5c2910624d556b809f15d215cd05a9d8c18fffb39a939c7a9dde5d44236312aed47f600c7cc657 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000006b5c1d663c0ae5a89c24dfc536fe2299547643b1d14be33bc7e3198aed822a08000000000e8000000002000020000000c0ae6376476fed4bb11a8900270915e4d5a415d846326354a7077342ffd8732390000000fc574d7a5e7ef81314d708955f400b5c0f2626d01cf3fcb40c11aa357178888d727f653a4f432a5dc4a0b557957f89235ad138486cb5fc1ac7036d8f713ceb60a5ee8debc20f3eb497df06bd22306032c744a19e5e39931e0b3a269592d6dfba80bbb50d9b3c5a92dc2ea5f6595a59acdc15e290b5f2a94bf0df45d58851366eaee3cc74073428ebb11251ca8275a3a5400000001764f569e73267b3410e285f3096be0e2b56fdc28ab13491a4e24177f4063158d571e6ade1d50b05f6c437d737219fffda52051f7a5ded94b2b608c2a2df2c14 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422566346" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC4C5BD1-186D-11EF-B6D8-6A387CD8C53E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b39f837aacda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2204 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2204 iexplore.exe 2204 iexplore.exe 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2204 wrote to memory of 1332 2204 iexplore.exe 28 PID 2204 wrote to memory of 1332 2204 iexplore.exe 28 PID 2204 wrote to memory of 1332 2204 iexplore.exe 28 PID 2204 wrote to memory of 1332 2204 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\684966964fef63d29dd1a0cdff12af56_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562fe977ae2594021444eff3517b3ec37
SHA11c3e9fcc37173e265e50e9dcfb22c72babc10fd7
SHA256174d7bffdaf0929d45041cadeb3757cdcd6c3ca03a41ab1d0987c97bc5ae87eb
SHA51245cb721cf90cedfa36159c6f253af462a341d3b3d39b515611b5953296456a561b9e0f308ea92815ea77ef486e15e7b3a7baa1516fa4d46a29d2730d82ebf1df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ebed85cf64e36b3a8552d31715a3bc8
SHA1b50e8faaa7746716273b2989f748f52e5d6405fb
SHA256caad364605f79c4b18d0c5efc12b3a709fd8b062adb31af4652b351fd057820b
SHA512387d49fd2a0d0e61dc5075408d7ce3aa599fc2d8b58447397d28eb34a7646dcb8fabf64e077ca54dc737a8fad3f71ce7b7933a0c4eef5358e6439e1b7e2fa578
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f453385ef2ba3679e5ce967b69ae62dd
SHA1b790370bbc6cc09259fafdf777ebb308449feb5c
SHA256a1b94281aa2fc35365b6b3fe2916fac849cd970d84af353baf70587dc91a3523
SHA5125555cf108b5edeac34ee3b46a654f14045514da8deb8b84ff77660d9e95d278f4df498fb546cb1348aeb79b402ad2b02c719ab7637e2106693bf4b07d79e8431
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ce870d85518156afed84a8b8f2acf87
SHA1a66d15797c924c4f2097e0acb8d7b97d03ca7bad
SHA2567f226044dda63a6d8a16035e5fb67a859560b9f416585047b5a7d429fc857c78
SHA512b1023f8b99758d82235fc8fdc50879d49209267750e64792d2815c900118569889b9c02cfa30175d903d916d30c4757bc3804aa5cb77fe13b1c0016d6a634173
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da05e2c4a13a53d8af96cffa862f739d
SHA1e5a7755cba774996aa72684bde3d6ee533a2f7b5
SHA256b1f7ab211adb9ad2a948f82dfa4c9add2bb97e228a91a2af18a07ec1514e5359
SHA5126519a572048392967c8fc83509615d830212392b85631a96fb4dd2311c15c80173f93ff16d12437ab3f02fe1d3363c8f7557db93eaac1420f100781986339e9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdf1f4387b13245a76e3760490a68f22
SHA162c2caa2cfa53cbae4796cb537bc16bad8b207f5
SHA256a2dfed15cff92dc6ae3ed6834df18d89f977093546c01a852b789078f481cc34
SHA51265356033fa752bd2416e952b9822cba2f0db55fcd2a577dda4c1a378bc0848e437f5dd629856a0707b8e74aeae9cf827be00800368222a80c41873bcfcbba0ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e2033d108c9aac4f700abb35345a9dd
SHA1ac29f74b1b0777bda70202e374316c149e10a0fd
SHA25645ce75783a0b314c1e6b23a1caea155411c16a449199c3b2274cea62a819937e
SHA512698d6d89e3e7fd4b5f3804fff2d91ee4e7dcd39df8dcf5853f8e122d88c37b3ec0e8e72ebf2a214019de13d6b4205667aad1bdf7e2db328fdbe1acc7e1ea614c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f44db12d6c3ac71de73bb6059caaba16
SHA11e18762c864f0e714fe871e7d67bf0f11961604d
SHA256517031ffbb77659413e0aa4919dd04088b72d843a3364d52afeebe70997d837c
SHA512f80e40acec55f4055a3a307ecb108868cc60c02dc0916a1fd9e341d87bac8d194f87421793f56f3f35ea30b7b849e96ce525fd99c4e6cd01192f664cf24b3bc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535a6246f13b1f70b35e5cb2925d2dc63
SHA1f8ddedd75d51a4a1b76b98bde26fdacfcb7e8e7a
SHA2560de66a182d674512f81027e690b9fa6327947e24aba476dd6fea4c03457d7a1a
SHA5125eb57445ba08bc8ecca6e043375c2d55c6346af4173bb87b3f3008f8944b0f6353a891fb517e1fedfda238a6a84e032fecc065d9ac16cbd5f018f2f3362d4286
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd4923d84023ce86c0719377daaea57b
SHA1358a691efc0a042d2b00e6ab44b616e98ce1a769
SHA25657d5e8d13a4d8a8e8fa993bf93e1ace0a4beed5fb07be6c805b504b25c4e2995
SHA512bf422787248ed66a59e265c46581a7a5ef96dc374e00091e166e3d321b939b3f868d811ab90c2aa0b30ce713cf22a15e8c3ced2b04611da5aba158b2f802e9a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503349f96820cec54bd30ef8a1b1c6339
SHA1ceb015eddf8c6a87bdf7075eb634be1bcef3b731
SHA256054aa3fa92222581932198638873a3b638c7f6ec85626f6abbf59d22fcdd85b6
SHA512bbce9407453c7525bc32185bbc327372e00ad3d886f162723b90392bf308a896d0bb026e059f17c1ca5cc8ea86f771026682e755cacec5e8dae9497bb2191e26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a36cb50dbf828b92f996d90cd6bfaeae
SHA1f5658fdd2232dd64780a28cdfbd2dfa339882307
SHA25632cd3121ced92505078750a63040b48c93834b675cff09f4ab57b9cb480671e2
SHA5123675fe93477d13143cb329ecae9a5f31c1f9d0b8bdd179a95245b1c3d3635791e0d6b08e3bdc41630b8538fb74fc78d0d7cd520c2fd5cdc3c7364c973cb2cc26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c56cfc15fe19a6b05ba32ccb6bc70822
SHA12aca6bd576dd594e2c606823a200b2c1727ff14b
SHA2563bf8a08fb3baec92a266f90486d858fcf4357e2a1b224134960efc3ea9fb45c2
SHA512a3b069b26369acef91a416e6300c57ad255e092804cb64b6fdbdd7dad6795b2efb22331f5869acc94a81c14e5b12129b185af336af27dc4bac7634807676ffd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad61b1ebe5793c91e3fafa35c4c3b12b
SHA1014d3fae14b32c58893e12f9cdb7fcd0bc907c59
SHA256bc09734b4bd9485b15be3678c6210413f1eeed5eee45057b56c4668d11f3d4a7
SHA5125c3ffa58af7100861c321617b2195ed72cac9e5afc533374bf78a0d1b54937979a662d3a93844760590f9239435aea5c397415a16565b194de9f6a12ab3a18ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53560e5e1620f00d5edd1d0d6065e45b2
SHA17d70d13017a1a0f9143f209ddef43b825b95d5e9
SHA2561ccfe5e85598b01060e6266a5826e21153021801e191329ad41c5b97bb4efc3e
SHA512335728d554dfd56fa486f11d67198d034c0b911013e37d5143d1087ae40632c79edc20c64759014e8d29e3e1e7cd0e6e59e8c4c7b15aa9165ac147d5a553b494
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5011c36fb5519116cbfc7969ff3585acf
SHA167503094afc110882d4572441cc0d041c495b2c7
SHA25609af0cea648e324773752ff790e3f4736eaa9ae8798330366144299b79228099
SHA5123c908e7ae0031c2195444281889685a668e0b23cc5a726266188b4950d0096185e5c3f5fe0ee30b1a308fa680282f3a10f353f0e8a02ac0da5b852e468f53c66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba571c3ff01e6dbb05643e533673d749
SHA1caca475baf04ebf314696583afa0c4052f272fc7
SHA256eb3d62e9aaecc774d9ea1cba8f18d85cc96b036c166e5fc72dce880ce81c387c
SHA512247ccb195fa13da2e65dab5f0d84ba65468363651a491403351025a355860c76bea8ac830beb7c30d0d22731a0d45813632ea52ee3071f3a8c8573948afcf1b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca36ef6074d66f913815f88b981a7f95
SHA1c994c7cfd46f9aed2fbf5ca32be02a9d8b9622d0
SHA2563f1d95029a7d94c45b7555ba71b5595d6222d6e10b7a69dc51c732a6b5463742
SHA5122d199bbca9429dd29b6a67a11ac43459cf0faf3d3a1357bfda0b6f0b0bdcba9b8da5bfb238c0637dda0b6de6188f437cce766816ddde1e2e212632624559fe05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f0827c2cd8f1103f64cda2dfaca4877
SHA1c61afdf04fe4f31a00f7d6c92e74aa3bcea774a5
SHA25690a2dfabf74720947514a00188a8ad2a786e3e56896762757b77431706e1804d
SHA512ba93e02bcfe801c22654cae2be3fe5428bd8d9fd3511c703374cc2e0db5fed7e31051ae3cd6f1e4497b7f6c464434e6723534fd99c06dfe0bacaeea83d3bfd27
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a