Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
aa292e707c4ae5f6ccd54068c5c77ff0_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
aa292e707c4ae5f6ccd54068c5c77ff0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
aa292e707c4ae5f6ccd54068c5c77ff0_JaffaCakes118.html
-
Size
461KB
-
MD5
aa292e707c4ae5f6ccd54068c5c77ff0
-
SHA1
15c1b99036d823b37ff75473f85baecee2f417dd
-
SHA256
e21f18773f0c9fa01b08f9ade0c60a7f59e138e9a69f0ecd017b19f6eb3a4fef
-
SHA512
4b0f19f522e3b1e0012e4c111997dfc25aca89430c9a430dd2dd71ead784af8a81d79b587acca2e474728632d715bba8b3b887f08e77076384f5e055e6f5ee42
-
SSDEEP
6144:Spy0sMYod+X3oI+YGo9yQ5sMYod+X3oI+YGsMYod+X3oI+YLsMYod+X3oI+YQ:I5d+X3z5d+X3G5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000aaf21e0c3f2510c2ee398df4a0973f770bb1cd34eb7278b80f1ab1d6b0230b9f000000000e80000000020000200000000e4a6b0aaa46a23c311cb55aec3e150a07dc5f11914c29faf69d97404288be49200000008fa747ad7cdcf5cd55a22f2d94fe3c65362714dd0ff838c30f701db13fe8f10d40000000eff666d17248d9235b7caf2549ae6ecee2cd12fc61a1adcfe0ad5b8a15e4b6477e343c3971dd933d5bc4c1f99e6ce156bd189fec58f2a5f4f8a97d8ebea38a27 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ea3e8766beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEB76831-2A59-11EF-B93A-F6C75F509EE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424536882" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000abdcfbd247094a2873797bc35df38085c40451acdfa9b629b3b732637e0828b5000000000e800000000200002000000095e988d489fdafee47583feb3d5c020c2279963f0ea2e601c0addd146d6e2048900000000eabecbf12cf0d9f27db2302f3013903b8eb37d4be924e518da83084e7cde5e9c087e2341a10ed3702b8dce21b3a928d328515f21ad582eba25e1b4b74071bef8e6ae4087c672abd92a5c2a7592a55dc4e72e12e884eb9df748493614caaf472a2dafa70c2cabedf9285bf2389a76d8ba6038add491d0753b3427b5ed497885318e4ec9fd919496683bf99fe9faf8bd54000000093d0cd9c6b8c9453be1c49be2d7463b75b09ee2921bda5c77fb119fa5e60cad6538748620c25ff28ab1903c430a8770d88db6aefbcc87f850dda766c9df91e49 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2976 iexplore.exe 2976 iexplore.exe 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2364 2976 iexplore.exe 28 PID 2976 wrote to memory of 2364 2976 iexplore.exe 28 PID 2976 wrote to memory of 2364 2976 iexplore.exe 28 PID 2976 wrote to memory of 2364 2976 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa292e707c4ae5f6ccd54068c5c77ff0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2364
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549da7c25fb33219cc128e48c481494ff
SHA1f8f2f0ae41b6c2f3b8d8285625def233163f14ff
SHA2560f10dd950506d86af31bb3a5ece37d504b42ff1977f0860dff6aaf84938978c3
SHA5120a1a62d7c15281d8cab66a7df1fc7c8cff09ce76c94912bc9650e193aba73a576fd0a3dab88de2d228a7d20b878d53123359b826b0fbdfffc619c46d79475a03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c23e8b78dc86dc173c732a72ab37a62
SHA1b051263053173796c67a0d51830fbf8c6ab62da7
SHA2567e7427856f41b9e574aa4fa25b630f7253fe09c50b4a98747d62823e222e9e94
SHA5122702b14a33d86bac18cbeffb20510b663cc5eea0a72f5ce73013fceaa1c4e37053865b692d55df15127ac53b616c53d5f101d102ed8ac86e2634eff336328209
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531126c9848c3f4e1a25ad7f2fac21630
SHA1ecfb84eb3828ae576c5a7f2e134845584f8a7bc4
SHA256027bec644b55c41aec70306c50e02afc5d7fc73321730ff730c52ba907f91314
SHA5129a07f1092bdd352ddfcfab54da3595d6bebba431f39b98bd793f2963b8e254a393891906e81e48537d14e06ef0567cf7659c0820a80bc1b498f9a72ae5acf591
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ede4ace4584aeaa5080629659fe1356e
SHA12308e4234992d79f4c5c4fcacc3d22483f6d440e
SHA256c41809797a2d126e9ada08eebc369e814d5717ce22aff31bab8c47a6d55107a6
SHA5125c074f1ebaabc2b0dd41f2af4caf79453c98f001320024bb8c9d7321c30f61704db0085c257b3562a0866950cf6e210a98ccc26a0f17af672069e694f536ed7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aea7094ec96968507babc7c93ab9e8d0
SHA1a6b07ce5765aa63fa11961dfbab25564497f6029
SHA256674f8fb1464d4c32a04f6ff21a0e3654c34b762eaedea79d908beae5b48354ab
SHA5125c6d0033017d7eee15c237cbbad94fe80172acfb48f5314938600a75275ca400869693767495afab8b27b0135ecac6dedb05a13e3b463bdfd1f4dafff1e43883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51565b3aed905c9504f489eb228f55d96
SHA1c669358a7b9e3589283a5a32836ea0132b1712c8
SHA256d0626a98bf5541fe7037327564085c25812abd1b358113166db6a28599bf2c2f
SHA51272fbcbe6f4901a117102d10423d460129f5d59e06b6ed8841c079de24e210e4d18eb7da73b740bdf366b4d258373928e86412d6f7b94a16b4de9fbbd22bf9857
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514a336ec1c07f209c5b15d458776a7f7
SHA1c51cc3def82f2ab981e9754ba47b3318cfd93e21
SHA25654b12437ca84c244479685bbfe8efc5125039d057561bd21e3ae1d7f624c11bb
SHA5127f0d51e6bf26c6db55923cb9abaa239a9929eeacb37f033e602c4fd010df25f6bd0399e847cedf11185b9074a365660acedfccac2a283e544c6980395947a8ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cdd88640c3d1fea981ce03e25ff45230
SHA18ed7ee4a5ed82fa420ec3673b897ba650b6ac8f0
SHA256e17907ec402154c90433e1819d9e690152178021d07ab823f0e6f011eafeebb4
SHA5129080536733d7047894f54006d51851ed61d30659eddc08f70b9f359bf8f86f914834bf0d29cccec1309d66d0e2dfb1fc12729aad9df3b3f3ab1a4726f10d89a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f98e0d77666184caa576bad9e6936e87
SHA1c29ca14030c37679325cab1317fe8a79e5235499
SHA256275bb15bfef628823227d3d649c46cb41bad370a96b13117f22576cf7cc6eaeb
SHA512f3050c9b3e7bc24138dbb986a052532a8857083b171e90a51d8545450b397bf89e24d5f5e56c06fa2935d392d330a2b840bae041a0c96d25f71c14080dff4ba6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b55dda0c460bf61639e1a6e99b1316a4
SHA19d356542f26ff75c657d578b700e5cfef479fad3
SHA256f1d8c4df578b007f10544de21095d7be4ceb2974efd6101433cc567b67a31055
SHA51204787428dcc04c740cd9225199cefe82589b6f67f82e96dc4129de656d7263d03bc119380b5e5ba89ca0b6e983ee522fc04d70db44398182215f5b043cdb1822
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50051ec711d82eed57a14eba63cd1e3b0
SHA12b9867c5cbc41cc964e31398ce320756f3cdb92d
SHA256e13d7299a19dcf23d1110191b4e754a6c2c70915b88bcdd6ef33a97ecc0169a1
SHA512af20adcb950dac38fb901ed53f561048ea8a360c0cd9c65350ee069538063ab941a19bdf87f408bc557108f707508e475d76611a8e25a1c57b874357a6312545
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e32146e21f8208ea7813b7f69e53650b
SHA15139b75bedba7378e60458486841384eb424bb72
SHA2561cca3e144cd7141a846122ad296adf7ae03fe24c5806e3c172ed9a9ff522abd4
SHA5120edd94750fd6e20817d2490a5929e4d9c14ba1b78a7e44347d5b3ecceed1fcd17b4b014246cfbde357677c15cebc63666188335119d3258c474fdbe18f404544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5831b46b0313f54e26057bb0b1dc4082f
SHA1934a80b17e1d07f3c79fcaae3bdbd81d8675e8fd
SHA2560d002baf572a1d9315eb14c84d2718bcd87eb39717fba11fde42a2141a5ea527
SHA51218b3681bd6ddee5b1e64970de1eb0b20a34b7d359db9c6bdedfe0fe88361c2c29b768de05dc5ded84e9909568dc66da838f79a86ec2b070b01823c1975e275b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576011971cbe56d89cc2a7e2d51ca4f44
SHA15c3528ae02690cd38f0614a94c896d1c46300b4c
SHA25676e3dfc91f6aa50b35e2b68909dd0a409139fe2f221415fdd203ea8541290e10
SHA512aabc4ef48c736177ae7012a715a2de8a55ba5fa387684d99e320a8df50f895477dd678b67513de227444c3da93f2d1a547bc6f4fb759b03c72919c3cda323f3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539d4f418199f7ccbcd53c0385cd9d589
SHA14254f2fcb0d8f61354119f2951c4e706cbc9f5dd
SHA256b33e943e121cd1c4ea52cffe5583e421ee4845e6f47318e056f4b1eedbc357c2
SHA5124f9d159f1b6d623ea089082892d9416cf5864b4de1a147e4431f058e116db2dcc1d57c548ac4dddcfef19ef3ff00b29591b9185da0323b2d5cc5c1feb741b615
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8ff706766aef9c0cabea9034900acbb
SHA11edbc8529e77f87af51150fd982500934e5a841a
SHA25670f0016be1f00bb1820f7a899ae70999949a8995dccda705a1840d2da9e61d44
SHA512380a87b34f27d99328c69e6c9a527a7de9a75707ad3c50fb5d3d98f97e82c296998df1e06946bbeae7a8ebaf56cde670a9a8c4ca9ec01c24872d95a2237ec330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcafc5633d539453f0b0f8685615ca6a
SHA11daba531bedc57e43bb4581d00a573a88d5cbb7a
SHA256be4adea5ea53748b5cdf767ae50905bc6c42bd29d96fcea4334da329bfabbc3e
SHA512e450a74209cbdcc0096c3c58707ea5d8763f2dc59ffe64f81a6f26461a52bce64afe96e689e4fe0a2f81675f59d4f617bb94f13ee4dbc033c9c6327d27f76df9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505039e09de0276c42ecafcac3c7a5d42
SHA103b09373df20bbc0a2a8252d02ea327ab79cc50f
SHA2566f1abf5ce7b4f74fd28437f8aec1cd3cb1c1c6fcaa1781de8e3a8ae7329a4b04
SHA512128590ef90804bfe54141ede4cf2439260e1efbe79bb6318d3cc2c6d2c39c6a9c850e7bc73c99ff9518a593aee0189f2a90d7283bba229f264d879ae3aab2211
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51eac2731a37cf40ed4227e237dd1e170
SHA1cead47d7e52f02263c485d10fa771e1965e51740
SHA256161eb45389f0c97ace1fb1bd92f657548e5f87c38ce450602a4378b337a14cc1
SHA51295e062259280a3ecb5d950419d9f89bec533f8397d969ecaa6b04028fc7bb7d4c605c94a918c403d59e450cf4f4231eb09ea68fc6cddf0bfb812d4edfb95c2b2
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b