Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 14:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d664454b2f4aafefe4e8d79b34b319ae.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
d664454b2f4aafefe4e8d79b34b319ae.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
d664454b2f4aafefe4e8d79b34b319ae.exe
-
Size
45KB
-
MD5
d664454b2f4aafefe4e8d79b34b319ae
-
SHA1
28e9283962506986ec9d2e6d3b85738e50e02979
-
SHA256
15f69b3b7720d59511b4b73a9a56045b5a6e8611c09181de5a157fd16542d6d5
-
SHA512
09ef21390529088275bfad0c9a633898ba544a097d0d1e7d774d58e9efda80d8764b776e038edede777ecb6681d58e5b66166473fe836ce3b921c46f0d4f8162
-
SSDEEP
768:tMVvp3w/SGIjuUb/0FD3SE4Y4cBRX6VX+Re5QH6DMnP6is0WMusig4s8HY:tMVvp3w/zMcFmEbREX+Rh6DM/s0fEIR
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run d664454b2f4aafefe4e8d79b34b319ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\qq10000 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d664454b2f4aafefe4e8d79b34b319ae.exe" d664454b2f4aafefe4e8d79b34b319ae.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts d664454b2f4aafefe4e8d79b34b319ae.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3280 attrib.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini d664454b2f4aafefe4e8d79b34b319ae.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31095309" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb81c2d97e83014aa839d28a6b89bdd400000000020000000000106600000001000020000000e4473df27013a5caeac6872376ac17aa1e413420fad65d748c1d9e7700e232b6000000000e800000000200002000000088686ef4d7eb41ddb5e890b4c634ce6c3c1e3175b5c69c57cd3fe0199b58bcdc20000000be2844208bda171cfbeadbab0bf4e983f7fd8a17c55bb525a5229cd68d0b2fbc40000000eeec1d01a5fb26921983c336e63075f994f129684853276b55d79d93574b8c25d9b3126e2118b7f8156e6aca6f94f5d57ae79c5b4a55de623af4b18cffded41f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2085804e0d7ada01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1309079961" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b1874e0d7ada01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{79A6B4A0-E600-11EE-9216-7A73248FA209} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31095309" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1309079961" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb81c2d97e83014aa839d28a6b89bdd400000000020000000000106600000001000020000000674ceb4d2ed27212848eda3eae2ad82aae2efd6fd1d2f9800f1d6109f9efe121000000000e80000000020000200000001105e0b37d278c43e875c7c65e219eeafb593120f1547eceb50f63c2cb58d2a3200000006e76e153f81980828bddeb0fdd544e861d1fe210f1a9b24b0721b576e52299e340000000b4e58d1b6a6e12841c1afb78da5003f4de2ea863cefb97b7a85cb61c19602f4057d91777f5bab797989150a5f888704258be192b06405a510407f6782622cd17 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3344 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3344 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4340 iexplore.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 3312 d664454b2f4aafefe4e8d79b34b319ae.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4340 iexplore.exe 4340 iexplore.exe 4452 IEXPLORE.EXE 4452 IEXPLORE.EXE 4452 IEXPLORE.EXE 4452 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3312 wrote to memory of 4208 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 91 PID 3312 wrote to memory of 4208 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 91 PID 3312 wrote to memory of 4208 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 91 PID 3312 wrote to memory of 3280 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 95 PID 3312 wrote to memory of 3280 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 95 PID 3312 wrote to memory of 3280 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 95 PID 3312 wrote to memory of 4340 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 100 PID 3312 wrote to memory of 4340 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 100 PID 4340 wrote to memory of 4452 4340 iexplore.exe 101 PID 4340 wrote to memory of 4452 4340 iexplore.exe 101 PID 4340 wrote to memory of 4452 4340 iexplore.exe 101 PID 3312 wrote to memory of 3428 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 56 PID 3312 wrote to memory of 3428 3312 d664454b2f4aafefe4e8d79b34b319ae.exe 56 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3280 attrib.exe 4208 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\d664454b2f4aafefe4e8d79b34b319ae.exe"C:\Users\Admin\AppData\Local\Temp\d664454b2f4aafefe4e8d79b34b319ae.exe"2⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Windows\system32\drivers\etc\hosts"3⤵
- Views/modifies file attributes
PID:4208
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Windows\system32\drivers\etc\hosts"3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3280
-
-
C:\program files\internet explorer\iexplore.exe"C:\program files\internet explorer\iexplore.exe" "http://www.qqdcf.com/install.asp?ver=081229&tgid=6688&address=7A-73-24-8F-A2-09®k=1&flag=bb111c26ac0ccf3d4f5ecdf979638d10&frandom=9954"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4340 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4452
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x468 0x38c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD55053317e8184859d45b056508f8b533f
SHA15d97898e9d1fee87bcad32fdc7aff67cf943e03a
SHA25695c5b99cece02c009edae32a383cf989f0f94d2e84d86ddbab0481eec0e340ea
SHA512d8e0f0355741f3167ee6a8500abab3957c9ca905410dc0fb3977ac7def786c73ae504618771982803eae5c0c08c7d87e2c104fcf6d2c4efdf174858c2c73490e