Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
19/06/2024, 16:55
Static task
static1
Behavioral task
behavioral1
Sample
bd5ebe327c2e4363883169092ad29d1d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
bd5ebe327c2e4363883169092ad29d1d_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
bd5ebe327c2e4363883169092ad29d1d_JaffaCakes118.html
-
Size
37KB
-
MD5
bd5ebe327c2e4363883169092ad29d1d
-
SHA1
df39536ea3f75379ed5730661745b3e7f2d8f4fd
-
SHA256
8584d17a65ba4d4e7d133ef81a46f4995aff315994e06d952c1b789742a6753c
-
SHA512
f00e931816542f9be2f5acf750236bf42bd1c084390906fe3d07df2cf2d081a7ec6ae49b2444475f58573ca25bca1eeae9fc6db7708421c24040923fb4412155
-
SSDEEP
768:bFqbG1bmrsb2vbxI5Ix/g9br8z0FjEoGe101JR4JiYAX2VMqzP:bFqoKrsS1I5IxGn8z0FjEnBHZG+eP
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4836 msedge.exe 4836 msedge.exe 720 msedge.exe 720 msedge.exe 4564 identity_helper.exe 4564 identity_helper.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 720 wrote to memory of 1124 720 msedge.exe 83 PID 720 wrote to memory of 1124 720 msedge.exe 83 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 3656 720 msedge.exe 84 PID 720 wrote to memory of 4836 720 msedge.exe 85 PID 720 wrote to memory of 4836 720 msedge.exe 85 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86 PID 720 wrote to memory of 4904 720 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bd5ebe327c2e4363883169092ad29d1d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb027646f8,0x7ffb02764708,0x7ffb027647182⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:22⤵PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:1632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:82⤵PID:4608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:12⤵PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3872
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3884
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
Filesize
23KB
MD5df14665f460474a948ef6f3ca958f319
SHA178acca6b4ca9499ba20a2341060e9e62d1365a0c
SHA256e1351a972cfc2b3cee94b36da7a2d25d94e86166685a084a7f8fc1f3e578270e
SHA5128a6bbf19d0a305b4617604e34491fea97b0d5d88b6bc7ed635daa1fd7c580fe5aaa799eaa298c949bf4cb69d8d415c0e823b6128476008e527c130a26cf59cc2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD552671bf0905e2aaf29c8bc21596c9c5e
SHA125180b9eb5aa479b70e01014da5a201c8adc8a02
SHA256698b3129b2f17642a56c664e0127a9aa89ca3e8863f8e327c149aa12e2476b26
SHA5123611e47af582222a849311b0100ed7eab1c222ff60a7861e47acd4bcaf231bc89cab5cb7bf7a70a863c9abf53dac21af500f9e89a9e62f37aaa8c7d79edb8478
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5adbd5409e3f4f934e71fd3c8bd7eb207
SHA15dad9aee59ea80ce67b89ee7b4cc455d07c5b33d
SHA256b484f81225dd811a4bbcd6468cdbe08b148b9665322d04e7f43232890336ab98
SHA512f6eb3ef569f942fbbe2f6eec9cbe1e8fc21b108cf1064478ec6f573908681e5bde52393bee390cf640f3d1da4c54e89114c6d0770527f67341980bbc2e30301c
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
987B
MD5caf804e91bb1224e72c2cfcb564c1f98
SHA1dc853226b4c0e928abfac500b7ea403fe321806c
SHA25638da88353e07dcf2e30225e0e58dbe5025d2a666e7b3f369a4a7ed0b1214c314
SHA51293f9534325b202d6903cf32bae8d98fd936fc3724852db1414eef4856f9d8986b6a54f1090522cb28d9ad836b2082a52c799e1826174a09a93ef0de1be6cdeec
-
Filesize
987B
MD52aa753d0494e1557442e5287e8dfaa10
SHA1aea94c833bb021f40ab950b45d7e705efa6c980d
SHA25693fd1244fce7e36c3879368dd0896a0b4618218b78e685cf8ba29e5f3e7d0e86
SHA512d085bb9c3f821f5fb9a823ec8edceb7d169f73b0be6708168056ca8db25259321ba217e0ac224fb412a33e0fe3dce3566e52d8e2916c004bbd9f20bc815d55ae
-
Filesize
6KB
MD51bc40c03dc0ffcdcee355ef947272d44
SHA1ac2f45af1f3fdeafa12bbfd7bb6d583024db3ae8
SHA25629e8dc886beaeffb03e42fdf38fdef3a7d6ac976e3e97b43782ffd912d08e0e5
SHA51253a83fc9e8fe2c6f974280ca4cbef19241e86fd9dc066a2faf218c11a01bce773be780f159d494b3c7f64dc9ae8cea60ba902acd0894d2b2cead4c61edcdd40d
-
Filesize
6KB
MD5ca8f8afd7369e8c630cc82f1bc606367
SHA12b8d27b1026d8f3e8e99924969afb3e61b7d86c5
SHA256cb94f606a302db8c58cd1babe4775de5406649210f5fd88659fbade5038eba9c
SHA5121848419c383510518d520f6f73b18db1f3fb06769efd95066e4d49ab4053e1504b882acedb428fd691a9a0d64b0b0c153adc5a15ecf5b3c3033a09cdb05d9d7c
-
Filesize
6KB
MD5cf6fe6729a76fc84bb0bf0bf24c4213b
SHA1df4e7ff8bb2523ad01ad79d9ae259843db89b51a
SHA256f351495190b2dd472a293fde984b864b5d0a2d4e18ad0fe66ed46b4446d18a05
SHA512fd827eff6693c0d9e480895ebd702b01ed815504584c90e274341d0b23454a3e7575b5e283689101ab6b3bc73f9d4cfd00a23f89309792539cd0bde8e527cdf7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5ca1ad2324c47dda0c128a2a44ee28524
SHA1ecb54e0463c48bb2d7652ff4b2937ce533ceda2c
SHA2562594bf474a81f0d6e85a4be5ef75aa91f52fef752d0efcc80f6f985a3e2c1c20
SHA512705ea43866a023b2f7b8814865efda12efa037244c9033af3d4c9502c78699286715ba3d1480c7da367244618387caf8836faf74af08e9d5d24552e4665fe853