Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 23:47
Static task
static1
Behavioral task
behavioral1
Sample
b5d127fed8647218169efd9d854023b7_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b5d127fed8647218169efd9d854023b7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b5d127fed8647218169efd9d854023b7_JaffaCakes118.html
-
Size
51KB
-
MD5
b5d127fed8647218169efd9d854023b7
-
SHA1
1d36814f9f27206dedb4d521e224d99a21599b6d
-
SHA256
615aab98f00d3249df6e9e1b89a6502273f1d6594230b7e751600fb72f8092ac
-
SHA512
9f87c9be167c8707afc486f15aef92fd063a86097c84a3b9413006a98a1b06c5819d787b05cb8e3360cd26059d9d504e6b13740d1b8c24acb2c2decdf47ab0c1
-
SSDEEP
1536:UdMqDnoBUADsh9by4MOyTWWC10lOdFsMu:UdMqDnZFsMu
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405ecf9447c0da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000020f5aaeb0f5b2025f4794f59e147079ac0b6b246c8a5607a2ac9a5a6465fccb7000000000e8000000002000020000000ba9f9a7e946cb25ca7e3ddfc30ff0416bbff555faf28dd3a3c221649b26dc5df900000005f17ba801ca2fdf54368c585df7b985010d20c3db7b737a3b9c4ce83b40f995bf520651b28c2a2e513ec1df7bff72fe793569b6730403c02ee4ab2210887d7ada887f4f032e0c8efb7ccc0e9ddb48a475b08e6db8696cd8354b7d19db98afd17872a9a22d28015005f83b5cbe797cc8a6a7783a344d9d63aac3c6fd1bc8830e5b3a300f49940a2eba4228f237067be8a40000000a6448167586b870b427643acc37f98d58eec79b72dd3ce1fad58f34fe723c62c0294d62c53d333a920abfd8c12d678f481f28ea499891b2c6948229c139d4ef8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000022db91e09fba925e8fdd51a2b23ba1b1de0e56f75b16fc875d32a35c1c7cc748000000000e80000000020000200000005c7645b42d2188077532e13ae4a61b80a2062fb915f1f80f5241557016e7f29c200000001ac3dcd96e9b89b4070293b10f833ce85d11277f682cdbcd946ec41b9d7cd2f740000000dcf35508758f0184ad0f43355ef7224c10dccf859df3b9ae93f3f09184071c238158c4832e994aa389ab651760388942e6fa37b882b01806b4a6c5b3c57b8386 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424743499" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0120351-2C3A-11EF-9586-DE271FC37611} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2648 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2648 iexplore.exe 2648 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2648 wrote to memory of 3060 2648 iexplore.exe 28 PID 2648 wrote to memory of 3060 2648 iexplore.exe 28 PID 2648 wrote to memory of 3060 2648 iexplore.exe 28 PID 2648 wrote to memory of 3060 2648 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b5d127fed8647218169efd9d854023b7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567e6e9b5e8c975e38b6a9d0173d631ea
SHA1a6d7283786d4944349e48957bda50fc27015d1ce
SHA256b7b592f473f2c4e62ad7c7ed804e4d3ecbf3d6b895c15003a061cadfeeffbc55
SHA512fbd4126fe3cb97e5e6ba680c24561c90260fc743e6cbc28a7682cdfd06ef5a2342dca6d4d8a3afd7d8c6cc7a1a4dfcd821f37ef727ff7181e8a771d45aba567e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e19a893c2b0a28ead6b1957f62fa5256
SHA1701826f95122e383d578416732e908b9e33b3182
SHA256880cd3745bc2fd47ae5a6116165fd61f0b96dcf1f5d2a1c83ab7dc59ecdc8c12
SHA5121463af924fb3bcfcd0f1b6dd91643ac8d84ea01bbd1fd846433398725ad741eecbd22895cf52a6d01c9f16759bc6a1bc17a38cedc592f5012b7d296e5aa99813
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546d2b1549f87ade00ecefb7010af725a
SHA112040968ef10425e8e489f2906c0f8572c131489
SHA256c124302a53eb26ee27051a4512a8d3d5021cd8f442af363a2f8a213dbc8576a2
SHA512a2320a7be536a1ec5ee98c2d60f9c42f1554b8cabe2b97031625175f7340eeb7b8b6d93320504f71a029ada28f706f039ca8a6921f546feeea3357336153e9c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cb1a3bc9df76ff395c3ff477847e941
SHA1d26aa449744681698fcdd0efc4972f338abd172b
SHA2566ddcd3c481afd5ed30ee9e606964c55e2ddf298704705339595b4fb13f8302f5
SHA512e683f763abcdd346940b44c0087e2c7b2fd5039b73357c3dedf0ec83693fbf0b7eeb81602fe34cc22d4555a00adde854d19c1f5c454c895f331edbe6bb507b27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c59d6be7e3b31aa7d25308741bf05db
SHA1d08dc2f2a7a796f6519df3423056e27957eecb4f
SHA256bb0ac61d96243cfef4b376c856bee00cfb951c4bdbddbe8a86260beb21d943d3
SHA5126b5e1157bdbcdae662727c2027c75ce5c862518fdeff66ba4e9362aa68465d7e5240979753338904f5ddbb551773acf0954b6e3aa1882f03d1c1e23a6f708af4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556740a05d51ee9fdfa08eabd98bcd278
SHA1ab352d4acfd8482be6b5f4b9ace6edb941a83657
SHA2569ce4f8f017c7a28226d74e733661cd2f10799bc192e8b5357928d9ca444f3a93
SHA512bc6f6b2d1c4ed362dd39168461434dfa9c0d6740a66cf46f68b60ef145258d564349c86228aee4be80d593c5b79b7b30339a59f26673cc64efabe85084811ce7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0f1d5727f4812f6e8240e1aa5800b4b
SHA18c3bf194f7b45481e8b4500d490f4473cc011e67
SHA256d41c9fb6790750f00961ae9a609942f29415ec1f4046475d4f8bca4bb1072ebf
SHA5121378cd840222a0f4b6bc550ee356304297519e25b74f6c857fb65a9142861c446c1a77825cdcfa9000f5fa425aad6cbd97ff40ef348baa8ef64d8d5196dbed1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5078f80d36fdd95ac25a7cab0c6e9d4a7
SHA114a25adef128cdcbf213b45598deee72c50180fb
SHA2562a6f0b3b21027bbc34bb6f9cab8a76fc22271622a77e89b07dba071d9636082d
SHA512d20f05cdac7d9c9b0b228d175c9c2f2e0382d6642ac7ab36fd5c0791f79529e2c425a91bc19cef42fada958ce12bc6fc29d6e61eeb95124d8f79f87bb30ffbc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57390c5fa18da86546d1534138f17a94c
SHA1d0586f13bfde3c2fddd8dc487f71ce18b55bcda5
SHA256c026103f57f430a7b065f593a86ed99eafd760c77a5395ec26a77092f7c22e5b
SHA5129e82f5691a1a67bbf4b9de61100eec6e12c9206d6ade1f11d4060cf60b7f094788e962f705f5dd7c6458ca79723dc9a48a86e69496c44021e9e8976f51c52cbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5fc470176fc98a520e6c8cd040e6597
SHA1e889cf35100edf4f9715630d7e6baddaadd17a56
SHA2564ed3eb2d74052172a63bc12f49cfebc3dd96c88bc94f09905e30f170c495ff08
SHA512ba3552c0a3010c20221b728b4725d8e93d47fc59eebd3475f6bb26ea85f9be9f35b27c5ff8855eb52f48f4562f9222efffbd2154e5a4c87e9ec66567a73bc42d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e526e7be7c5c04013057d792102f892f
SHA17b080f45e2b41edaa42ded3e4e6702623a8082e7
SHA256ec35f005fb81658e83c643472ee3b770b12640c24dc7ee169690fcd15e4c3a26
SHA512d64ce275ebe08bb4b4e38da387fc57d848be75e00c5452583d7568fe7c490e1e0081cf91d5de56d363c6905ef8bc86aeabc62540a0067be779ba4ba62f8e63ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9052bb075aec793f28ce6dc2d7821a0
SHA19f8cc6d5ccdc33dc45d409ba024c252d163c8e1b
SHA25667a777f7426ab2c8408070ceaf2493f449366d33133ca0cfa8a7b7a7cea6be7e
SHA512011415b482833c3521608db144af461620cf6c91b0fc6374c312755cc89f86b97172969b9737a93a4874365bce5844c9d3041210e6277428ba1c88773d7fdf0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7e93e754d3ceb7293e5326f33da0ca8
SHA1c22a86eaaf1bf2a90154647d6c1504aea4d3099a
SHA2563aa835259518bd061a2d925e73c0e75a432dabe716c1d77ed1f86feb261790c1
SHA51235582bcd805f60393da11f5787de3963fcf21afe7fe3ee22821fec68c7e3d62522ba8a57a6ce1989f20c29a5030c796b5addc5af6f2eccdf33884be5e601ac53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d673cb31c7291b250172ca6c8ec6ff91
SHA17cccb7b61ee0385bd691dfc6bbcf81441e197811
SHA256d83d1c081cda9fc4dc6e032025e12025de7afc1485ebd49c4f53f643d2ac7d3d
SHA512dff14cfbe83b1a5a913e4b4fe47b9bfcf0f5367b801746a0253f3ea0cba8d1bc3ddf0ff21e96e6396f9d7ef3d230ba3d72fc7fa030b891b221d3256400067199
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4186d39fcf01291523fab36e2d5f99b
SHA1dabed0b71f119a1e6bb48ca22dd2a5e7176d4ac2
SHA25603519e11d577e34694b6ac32c8f70f7a4874e3fc0c40106dd04edb32763bdd36
SHA512fc0dc08185fbccce25106ff3cf8a054ffc3a1889d2d264590de4447e55006b404a89147e0f9e63bebf3c0c3084b2cd4ce31d293bc4b9837ca6f3dbd18e5b326b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c609c0c5d4f29b562d35e3f1d11b083
SHA13bd8d6ff5be26689982a769af6fcdf86b08a6809
SHA2563595da6c7b2c5bcacb1cc378bfb8a6f2870da48203a87f78f1a8a452b9fc0534
SHA512be264382276068084236a9058f9e8c09706254316d976f8645266428a673cef372ec90b4bec5c0b61e6e82d3167c1b930da0439befa67dd6c847ea3984a86af4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f1ec2b5f84cb3cb2f652a782388cbb5
SHA1bf322596ed1b863a44b173f134c8c7f5d8e6e6e1
SHA25620799790ef68d2ffd73dc7eb8ec277d85091ea491a86959b83f0e08036ed82f5
SHA5124e8965587d61a469d8b360ddb86a3c5204672c7fd9f66c93288fb95b48972ba2a8cf06dee2ea92e27f63bd12a345617582165d505c71e5461ae97415788e7654
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dede544f39818d98bca726c1481a992a
SHA1c28c9946b157515158bb0fb6ab0b2ca915a6c37d
SHA256c1722572e1a7b91644db6fe87797ec3d247b338b5bbf2213e37e04ec1f9dd282
SHA512408cff187fc6e9a9c36cae98591ce3e8287f7cbb002aba2073a03cd5b0b15fbde978d0eceba9047fbec13a4e089233e26bd2de9483b0e07e8c08fbe3c5bc38b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59426682e99624ba23c907f9647ca46f2
SHA1b69c9583a7b483b568af70296e777d0d9d8f8823
SHA2560773176b4cac0fe4675ffa0da23e3913f818fa1593354ad85d0e7c8bcb4a87e8
SHA512b9765c673102cab2bbe445e9b18d0f48aecb03f9c9b59c70a0cfcaf8ef2f90017c1779e89c7548fa48eb3683ca47c58c7f04f2fecb708b75444ab2298dfe630b
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b