security-soup.net
Open in
urlscan Pro
107.180.58.51
Public Scan
Submitted URL: https://t.co/oGaTc9jEsl
Effective URL: https://security-soup.net/doppeldridex-delivered-via-slack-and-discord/
Submission Tags: falconsandbox
Submission: On September 05 via api from US — Scanned from DE
Effective URL: https://security-soup.net/doppeldridex-delivered-via-slack-and-discord/
Submission Tags: falconsandbox
Submission: On September 05 via api from US — Scanned from DE
Summary
This website contacted 5 IPs
in 2 countries
across 5 domains to perform 28 HTTP transactions.
The main IP is 107.180.58.51, located in
Ashburn, United States and
belongs to AS-26496-GO-DADDY-COM-LLC, US.
The main domain is security-soup.net.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on January 12th 2022. Valid for: a year.
This is the only time security-soup.net was scanned on urlscan.io!
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on January 12th 2022. Valid for: a year.
This is the only time security-soup.net was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 104.244.42.69 104.244.42.69 | 13414 (TWITTER) (TWITTER) | |
| 22 | 107.180.58.51 107.180.58.51 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:82a::200a | 15169 (GOOGLE) (GOOGLE) | |
| 2 | 192.0.76.3 192.0.76.3 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
| 2 | 2a00:1450:400... 2a00:1450:4001:82b::2003 | 15169 (GOOGLE) (GOOGLE) | |
| 28 | 5 |
22
107.180.58.51
(Ashburn, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-107-180-58-51.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-107-180-58-51.ip.secureserver.net
| security-soup.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 22 |
security-soup.net
security-soup.net |
771 KB |
| 2 |
gstatic.com
fonts.gstatic.com |
43 KB |
| 2 |
wp.com
stats.wp.com — Cisco Umbrella Rank: 3365 pixel.wp.com — Cisco Umbrella Rank: 2898 |
3 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 120 |
999 B |
| 1 |
t.co
t.co — Cisco Umbrella Rank: 600 |
540 B |
| 28 | 5 |
| Domain | Requested by | |
|---|---|---|
| 22 | security-soup.net |
t.co
security-soup.net |
| 2 | fonts.gstatic.com |
fonts.googleapis.com
|
| 1 | pixel.wp.com |
security-soup.net
|
| 1 | stats.wp.com |
security-soup.net
|
| 1 | fonts.googleapis.com |
security-soup.net
|
| 1 | t.co | |
| 28 | 6 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2022-03-07 - 2023-03-06 |
a year | crt.sh |
| security-soup.net Go Daddy Secure Certificate Authority - G2 |
2022-01-12 - 2023-01-12 |
a year | crt.sh |
| upload.video.google.com GTS CA 1C3 |
2022-08-15 - 2022-11-07 |
3 months | crt.sh |
| *.wp.com Sectigo RSA Domain Validation Secure Server CA |
2022-06-11 - 2023-07-12 |
a year | crt.sh |
| *.gstatic.com GTS CA 1C3 |
2022-08-15 - 2022-11-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://security-soup.net/doppeldridex-delivered-via-slack-and-discord/
Frame ID: 357B67198891848ADF47CECC0120959A
Requests: 28 HTTP requests in this frame
Screenshot
Page Title
DoppelDridex Delivered via Slack and Discord – Security SoupPage URL History Show full URLs
- https://t.co/oGaTc9jEsl Page URL
- https://security-soup.net/doppeldridex-delivered-via-slack-and-discord/ Page URL
Detected technologies
WordPress
(CMS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
- /wp-(?:content|includes)/
- wp-embed\.min\.js\?ver=([\d.]+)
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Font API
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery Migrate
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Page Statistics
18 Outgoing links
These are links going to different origins than the main page.
URL: https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/
Title: DoppelDridex
Title: DoppelDridex
Search URL Search Domain Scan URL
URL: https://redcanary.com/blog/grief-ransomware/
Title: Grief ransomware
Title: Grief ransomware
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xlsb/acc8aa92-1f02-4167-99f5-84f9f676b95a
Title: Microsoft Excel Binary Format
Title: Microsoft Excel Binary Format
Search URL Search Domain Scan URL
URL: https://www.virustotal.com/gui/file/91164696edc4efba635e5246a48693e8fd75db2eef8e06e354848365b9fead55/community
Title: VT LINK
Title: VT LINK
Search URL Search Domain Scan URL
URL: https://support.office.com/en-us/article/working-with-excel-4-0-macros-ba8924d4-e157-4bb2-8d76-2c07ff02e0b8?ocmsassetID=HA010336614&CorrelationId=2aa46e64-978f-4d6a-bf7d-950ab12599a1&ui=en-US&rs=en-US&ad=US
Title: discouraged
Title: discouraged
Search URL Search Domain Scan URL
URL: https://blog.didierstevens.com/programs/oledump-py/
Title: Didier Stevens
Title: Didier Stevens
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/e1ea0a14-8d2c-469b-8875-272091ea5aa9
Title: BIFF
Title: BIFF
Search URL Search Domain Scan URL
URL: https://www.decalage.info/python/olevba
Title: Decalage
Title: Decalage
Search URL Search Domain Scan URL
URL: https://github.com/DissectMalware
Title: DissectMalware
Title: DissectMalware
Search URL Search Domain Scan URL
URL: https://github.com/DissectMalware/XLMMacroDeobfuscator
Title: XLMMacroDeobfuscator
Title: XLMMacroDeobfuscator
Search URL Search Domain Scan URL
URL: https://github.com/Sec-Soup/Python-ToolBox/tree/master/array-decoder_2
Title: my GitHub here
Title: my GitHub here
Search URL Search Domain Scan URL
URL: https://www.joesandbox.com/analysis/488098/0/html
Title: Joe Sandbox report here
Title: Joe Sandbox report here
Search URL Search Domain Scan URL
URL: https://urlhaus.abuse.ch/browse/tag/Dridex/
Title: tags on URLhaus
Title: tags on URLhaus
Search URL Search Domain Scan URL
URL: https://support.microsoft.com/en-us/office/working-with-excel-4-0-macros-ba8924d4-e157-4bb2-8d76-2c07ff02e0b8?ocmsassetid=ha010336614&correlationid=2aa46e64-978f-4d6a-bf7d-950ab12599a1&ui=en-us&rs=en-us&ad=us
Title: https://support.microsoft.com/en-us/office/working-with-excel-4-0-macros-ba8924d4-e157-4bb2-8d76-2c07ff02e0b8?ocmsassetid=ha010336614&correlationid=2aa46e64-978f-4d6a-bf7d-950ab12599a1&ui=en-us&rs=en-us&ad=us
Title: https://support.microsoft.com/en-us/office/working-with-excel-4-0-macros-ba8924d4-e157-4bb2-8d76-2c07ff02e0b8?ocmsassetid=ha010336614&correlationid=2aa46e64-978f-4d6a-bf7d-950ab12599a1&ui=en-us&rs=en-us&ad=us
Search URL Search Domain Scan URL
URL: https://twitter.com/sec_soup
Search URL Search Domain Scan URL
URL: https://www.linkedin.com/in/ryan-campbell-7219b7138/
Search URL Search Domain Scan URL
URL: https://github.com/sec-soup
Search URL Search Domain Scan URL
URL: https://superbthemes.com/
Title: SuperbThemes.Com
Title: SuperbThemes.Com
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/oGaTc9jEsl Page URL
- https://security-soup.net/doppeldridex-delivered-via-slack-and-discord/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
oGaTc9jEsl
t.co/ |
369 B 540 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
/
security-soup.net/doppeldridex-delivered-via-slack-and-discord/ |
60 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.min.css
security-soup.net/wp-includes/css/dist/block-library/ |
79 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
font-awesome.min.css
security-soup.net/wp-content/plugins/contact-widgets/assets/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
shortcodes.css
security-soup.net/wp-content/plugins/column-shortcodes//assets/css/ |
3 KB 684 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
yadawiki.css
security-soup.net/wp-content/plugins/yada-wiki/css/ |
3 KB 864 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
3 KB 999 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
security-soup.net/wp-content/themes/blogfeedly/ |
34 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.min.css
security-soup.net/wp-content/plugins/contact-widgets/assets/css/ |
1 KB 370 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
security-soup.net/wp-content/plugins/newsletter/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jetpack.css
security-soup.net/wp-content/plugins/jetpack/css/ |
72 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
security-soup.net/wp-includes/js/jquery/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-migrate.min.js
security-soup.net/wp-includes/js/jquery/ |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cropped-website_newlogo.png
security-soup.net/wp-content/uploads/2019/02/ |
51 KB 51 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
comment-reply.min.js
security-soup.net/wp-includes/js/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
custom.js
security-soup.net/wp-content/themes/blogfeedly/js/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wp-embed.min.js
security-soup.net/wp-includes/js/ |
1 KB 744 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
e-202236.js
stats.wp.com/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wp-emoji-release.min.js
security-soup.net/wp-includes/js/ |
18 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2
fonts.gstatic.com/s/karla/v23/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Screen-Shot-2019-04-03-at-8.50.54-PM.png
security-soup.net/wp-content/uploads/2019/04/ |
66 KB 67 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
qkB_XvYC6trAT7RQNNK2EG7SIwPWMNlCVytER0IPh7KX59Z0CnSKbGkv.woff2
fonts.gstatic.com/s/karla/v23/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
dridex_draw.drawio-2.png
security-soup.net/wp-content/uploads/2021/09/ |
45 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
2unhide_edit-1024x540.png
security-soup.net/wp-content/uploads/2021/09/ |
310 KB 312 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cells_edit-1024x393.png
security-soup.net/wp-content/uploads/2021/09/ |
162 KB 164 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fail_edit.png
security-soup.net/wp-content/uploads/2021/09/ |
33 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fontawesome.ttf
security-soup.net/wp-content/themes/blogfeedly/fonts/ |
4 KB 3 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
g.gif
pixel.wp.com/ |
50 B 93 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| _wpemojiSettings undefined| $ function| jQuery object| addComment object| wp object| _stq object| twemoji function| st_go function| linktracker_init object| wpcom1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .t.co/ | Name: muc Value: 188ea667-4ca5-4745-800e-8ed153e55ca1 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=0 |
| X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
pixel.wp.com
security-soup.net
stats.wp.com
t.co
104.244.42.69
107.180.58.51
192.0.76.3
2a00:1450:4001:82a::200a
2a00:1450:4001:82b::2003
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
03dd4b22b7c6c6841f1df803d60d9a56a0b794c8f28b71705dfbb4ad052538d3
10f91c693196f2c27af73a23adc69159567c43983cf273d0a81cf77d0caa8a9e
143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103
18a2c260c90428e8bbdd3634417c6fc893ca40ed222c6dd31997a44985c9c86a
20b4bdd91d22259e853c40db0b8d48a2031270dc8d8514c1a3cc083b017b3952
2b5074b9993e266faff0c7be6f5c65cc79b6f5d55b62d130788861ab3a88c86c
2f086baa21a9f6cb3ec29267c447315d245832410dc86ba340054f2205443c54
32055bb809e41ed6400e7f13f288084901f884f3f58b74c3556dd958516f5ceb
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
80a61ecd477cb6ea9fd6be1efcf69c5b5b103fc5d4fbfe16cb08a2048648f1ec
829c7c7117ff1251846c377c8f00c0816b645c16c7d9a2ccd844f16d182baedf
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
a2b52f4819c133bc281608895d14021d514a47cb8300a6d671226785319813f0
a63e79b5a97bf477e7d6ad34b4f8be2e4e8c7f3162f7d58b156ff0557f65c312
a8e01d52f3951fc4834274c935f0c8955a2f3283f25a764102683bfdfeb113da
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bd84ea9082370b10fb03e2aa4dcf6ccc52b6d4a53269fb32f21c44638a02dce7
bf12bbaa80ce62cb61edcef007bad86f67c93548cbab965b9a1908b8c31a8850
cc78dffb44abdfde70a3d5417e7244c468e1075da6d43b861aff53409c603bd6
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f8c2240958cb1fff47d921ca0f3097f9e7403ada01af2382477ef42c404c38d4
fc8056f5eb7f648bbdc21a541061cc8401f22ba178e5caceec3c78fd33e208dc
ff7cbd7d791c0f01f1b7db211981bb0506701f663e9e41422586b9e625753ba3
fffc98a93389756a03fa41ba20f9c1a6f39907a1b54ab0d44e4db4dbfdaa54fa