Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 11:12
Behavioral task
behavioral1
Sample
d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
-
Size
141KB
-
MD5
d439c5ee84719dab3c6d9dd2ed0fbf87
-
SHA1
7e2efb25c2cff3d571852ae2387f69111eb3a4be
-
SHA256
ef0f4381dec9bcd2151456ea30f3aa92dd981919326b3ae2c6874bc06580cb65
-
SHA512
938d2e265c9f3bb43802f6a609ed1bd335bb2c08174eac46bd4e669b1f24d1bebf4b10f6a35d0cd077a4228434218af058502b2f3b66cc1b1363c7e4af10ea2b
-
SSDEEP
3072:iHGFw1IOjHVDwb2RUPjSm+TMdOfM/QA9GLsqfyc7G/BlYb:imF9s1kJ+K7/QmGLstcoB4
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000b0000000122cf-1.dat acprotect -
resource yara_rule behavioral1/files/0x0006000000019246-6.dat aspack_v212_v242 -
Loads dropped DLL 4 IoCs
pid Process 2660 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe 2660 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe 2660 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe 2660 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2660-5-0x0000000024DD0000-0x0000000024DF3000-memory.dmp upx behavioral1/files/0x000b0000000122cf-1.dat upx behavioral1/memory/2660-20-0x0000000024DD0000-0x0000000024DF3000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\WinSystem = "C:\\WINDOWS\\SYSTEM32\\d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\MSWINSCK.OCX d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe File created C:\Windows\SysWOW64\d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSSTDFMT.DLL d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe File created C:\Windows\SysWOW64\MSSTDFMT.DLL d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSWINSCK.OCX d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED} d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\TypeLib d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat\ = "StdDataFormat Object" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\ProgID d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B263850-900B-11D0-9484-00A0C91110ED}\1.0\ = "Microsoft Data Formatting Object Library" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B263850-900B-11D0-9484-00A0C91110ED}\1.0\HELPDIR d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86} d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D835690-900B-11D0-9484-00A0C91110ED}\Version\ = "1.0" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{699DDBCC-DC7E-11D0-BCF7-00C04FC2FB86}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSSTDFMT.DLL" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormats.1\ = "StdDataFormats Object" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\ = "IStdDataFormatsDisp" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\TypeLib d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B263850-900B-11D0-9484-00A0C91110ED}\1.0\0\win32 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\TypeLib d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}\ProgID d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataValue.1 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataValue.1\ = "StdDataValue Object" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat\CurVer d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED} d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\TypeLib\Version = "1.0" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\ProxyStubClsid32 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\TypeLib d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\ProxyStubClsid32 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\TypeLib\Version = "1.0" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\ = "IStdDataFormatsDisp" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D835690-900B-11D0-9484-00A0C91110ED}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}\Version\ = "1.0" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\TypeLib\Version = "1.0" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\TypeLib\Version = "1.0" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\ = "IDataFormatsDisp" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86} d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C51B910-900B-11D0-9484-00A0C91110ED} d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D835690-900B-11D0-9484-00A0C91110ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSSTDFMT.DLL" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{699DDBCC-DC7E-11D0-BCF7-00C04FC2FB86}\ = "MSStdFmt Format Property Page Object" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\ProxyStubClsid32 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C51B910-900B-11D0-9484-00A0C91110ED}\TypeLib\Version = "1.0" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0 (SP5)" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat.1 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\ = "IStdDataValueDisp" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\ProxyStubClsid32 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D835690-900B-11D0-9484-00A0C91110ED}\ProgID\ = "MSSTDFMT.StdDataFormat.1" d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2660 d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD58315a1ad1052bf9449b156a0f11e1e2d
SHA161bb3b835cce1c13a877f98091067989538a28a7
SHA256d6ca90635e92a9a61458e364a31da23ff70465ac6ff8f98ab5afbbfcd97f0533
SHA5122e4bcfb2b8d1c89e3273384f55845779cd642c6c1be1db887c3eabe5cbf0abfccc9b472f084e748c08878454863bebc629c7704b7713ba0e87a23328b0d7ccf7
-
Filesize
96KB
MD515e15dad71e318db3cadbf3d86832ee7
SHA139571c1c320e14b81904194af65df1dc65a2ede7
SHA256a52c6f44e987fa668d5f5e053223b357e60af58315854ac06465f804222149ab
SHA512dcc58ad21ab8ee7a5afd642f119aa1088625a496bdb1b76ae20206b5c25e7921fd3446f841ee6df5cb5a7028a68b8d000b74fc295cf58ba6a26d20cb7a72eb38