Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 19:15
Static task
static1
Behavioral task
behavioral1
Sample
017889d4b6fc1c72693e7cded8f35809_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
017889d4b6fc1c72693e7cded8f35809_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
017889d4b6fc1c72693e7cded8f35809_JaffaCakes118.html
-
Size
658B
-
MD5
017889d4b6fc1c72693e7cded8f35809
-
SHA1
f0043d80347bde858782cb62e8cfb54e22d1dde2
-
SHA256
346f372abdcfd23c78a5e379ec47cd7be0a75177e3cd607eb9318ace04250a76
-
SHA512
3f690bb5ac01bd10288c5e5a5e3931537544b2147bf1053bdec730c237178880ae50e51d13397ead5550d2eb4006d42e43341c9dc476ea76248d93582d921258
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49DFE0F1-0401-11EF-82E1-DE62917EBCA6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000ac2542a3c8435be332eb84ee05f3fb89df909e128995dea2418db04f86c8b9ab000000000e80000000020000200000005724c08ee544de522ba577efa0886a50014759b920efe51b343f465be516941e2000000050ca2ae6b6eef50345f00120cba6e28f6cc70fec71ebf385062d166bb2522f4b40000000115aaceaba7642d67be1db7bffa29ef3b9a5b3a7cf9047c27666f4615413f0fb0b90aab5655005c1ffaba80fc1ac41a5e935b963bb4fa5492e49182b3873e20c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6085b01e0e98da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420320772" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000ad73c4a19a4fb50e5e11cc9115388119be00291ebfe67eaa2afe0a89e74403d000000000e8000000002000020000000ae5d09e312597c1c4f95fd04dbc22de2e1a17f2c0222184e4fbdc116f60159d090000000ab2902db4118d431d4a3e3bc93e6a9be292e9a413945adb1f2159cacfc99df4a0f4c1507f279c3171c991c850b836e04cbc74c6f35621ddd9b0950243508cf2368b2c50e99edf926fab81ea86083fc6a36f62a754b24479a214c2b94d2c11cc9ed424b1fa27bf2c85bb20dedc63ca243ea6a5fc19975c985a6da31f99de7cee45932f3489f8ea7d4aa083e6b30077d7e40000000d01d5c44e522790faa7cb773274b4cbd650fab0fd0f324f2dd29ddf952d9dccfda8e56c25976bda9dea12ee998a9396cef441335c19a6b32cb8a2bc3bba89a49 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2188 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2188 iexplore.exe 2188 iexplore.exe 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2100 2188 iexplore.exe 28 PID 2188 wrote to memory of 2100 2188 iexplore.exe 28 PID 2188 wrote to memory of 2100 2188 iexplore.exe 28 PID 2188 wrote to memory of 2100 2188 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\017889d4b6fc1c72693e7cded8f35809_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f2a8fa839faa68114a8266254c13fac7
SHA1ef46c0c40b65aec8523f9000d1cc5941393a0d64
SHA256e677f3b6441e00e030919a3e6fc9c732e2d238a823a0dbbd61601ef093ac6cbe
SHA512ad118d6a534906f57b8396ae1fcf53fca40cd28df6638f3833b378c75b893dcfb3b364ef0e1f4691d8f67d0b824a04eb81cc2eb820bcc016f815228db2a76fd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55070a8ec3106ece7c33e48ccd419e786
SHA1aa25a3197948508b27a6d8637b8d58598c2af0eb
SHA256005a7aa554e92baf78ef8ac9dfeb6b78472aae89d9321bc563145dc9a3464253
SHA5123a22a697ccaa8a8034e2149e8cdcfe261c562b3be3e90e5c4421502cf2c13a64129dd4c86822f4e5bb584733cbaf152b4f2a40d0176dff62b70c5a0add7cb3c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bbe56d8da742395099bf2a51b6d3e6eb
SHA147d59008ba2deef980606592bdb1f9cec7522f3f
SHA25647dba479ec5731dcb8a2e21f6d5c746829533da5094fb4c56da4402a51a1f816
SHA51205ebb951d7e79b1abe8e532da7ffa10fd0a086255ae23d4aa6c6d967af1b95b5a49a183670841e38313e096bfff84818b713fb1dd3714f890d59f4b665c8f3e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f380eb45ac87c3294af8aea7a41fa562
SHA1041a64197af39c038b9f17ec8c993da537353cff
SHA2569934a336e14dcafbb48f1f0bfae792a6d965c74710f1ba229bc71575a78c2b64
SHA5127b70da04f54b00e5b055780ced4db34f2e9ec8c770a0d504f5819b801e8532576d48bfca4883ec6134629ee8bcc4a89cbf6c620660493c403f5b03af6fe2b953
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59114555a703499d2d11ae2b7cf17eadb
SHA19637495142f27504f8b16c42bb6ea2cb7f687582
SHA256d54ad93a30d4a559aa3da3ddc3e38eac5207e1bf9030127cbde57d43c7c37562
SHA512a068f671f4437c7f6a093e4485bd0cd17c8cc9a74c8d4a3c34dc3cc31d580bf7c0054e554ed22b0d7e31b30e41830e56ea7b501a6db5d8aa5f4dd45d0ae0628e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD535af0825e9a5d0b8a8dccadf8880aaed
SHA11960affe88af6f5fbc09cfb8b110ff524e59455b
SHA256ff5338ea48a7417280585e2068653a5b652c6b3eeb497195a3ead942e0d71669
SHA512b8251c5ffea13569367edaeb7c707ad0901eb8d0fec6592da56412ec7db385f9e1ea92d03fff1a3c30403e3175d489aed3d66f2a89bac558eac13b3da41bd120
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57d4c9062cf3a73a6f1d671caff1dd1bf
SHA1d75086cb07b2b567786e0ed021bc6faec4c25bd4
SHA25662530654480b924f77d22e3a866f99863acbff386445c13bf154dac39a3286e5
SHA512af028be8ad94d39e3d583c6a049c54678ed6f3df53dcd1544825080dc5840b6fecddb0361f3509be7f0a933dac5955d6f88f2587810971cd477476e9337cf777
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53ae3d67303e655c09920fcf6b42f6121
SHA1f7f4a19f815831896c259cfb242577d9161d18f7
SHA25658fab8682b63450ce6dafc923d511e1108f56bde1cf463b4f7982ef0d0eb0ab2
SHA5123943283b9443c399f260b3499b0cd3bd97f170687f1d3000ab29fc90c8e5e5f17279002436c522c1d530e1e413f5a850e26294218b3d99998efa7dbda946755b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a1e0cfab36a05a32a9db18ecca6d66b5
SHA18259b8b0cc840e890a65fc3470c216ee180d0560
SHA256de5842760863f71c0f59806c65f3d17d7b34e2ab4f30b39b775b5cddb0263750
SHA512d079a449b24cff119f5ac0735cf6eddbec721fde26dced38bcc495b1953cbdb2367e09da311e58a76af1b55e422b8e791585745a5143360874764d8d92cacfe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD589f8d1791e36ce3460a288992cacfc15
SHA191d628f5f0e2c649010e1a7f1a1210cd1aff8eb4
SHA256f2cad4028c3a12520248f82fd18ed7c1aca0f399cf788b6fb2ff1391b77622e7
SHA5127b84bff5699ead285de2fa51c8e1097bc4bc77b6ee96900eeca17ded7a3543dfea207d485842bbe83234fee38d5cfdd8aa7dae7d4b814cd2923b0b71b3f34069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD514b54fe353b60577fddd61c6e34ef74e
SHA198269103068eb87023a50eca769aad283b0a96d8
SHA25612c358ff63dc781aef7b223feb26e5aef51f33a14116ac4cb63dc5b4ea32ac3c
SHA51252e79cab98b1b584e43102dacf611ff55aca626b6e315a407954cc2d650f8904b612a76ded0bd660700cc2dc28fcb34a525e729229eb7bef2d4b9aec16a2214c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a56f299d8df18ac46e00f215cbb66514
SHA15661c73535356cb28416e5de08dd539d7196bed0
SHA256ab7db398c4b687d290a6a5d552358ee5fb7345283d4398eab4fdd9df25f30582
SHA51285664a19e8f68484ee5a1bb854d14d77864b3bae9cfdcea2ba2a2826b9b88b41303057a6f90550861fa5444c39540e1ed7f71823662f38e053cd785bdec7bf3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD589fa1d2dc5b745cca8bc5c578dd61323
SHA14159094e32f37b4608c837c2eef4b31951ff7460
SHA2562de495c3a30110c680e90f692d70c050823a724852d92d6cf655da906cebc141
SHA5126c4f69dd84864fde3592e7602b7b40476db9774373eef436425698b92521cacbf6774e8bbcf9be873469ae3b3968f338527608d01b6207a345cf07d24cc35921
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b4e446597ca215a4fbc6c036015acc61
SHA12a0ae7e534062346b0e8b3e5deb36854e7d7c1b7
SHA256563491c3fd19f4a5317b8184597e565286c6e3da550a8b484e826b3bc485f4c6
SHA51290ee16d35ee0fed925d638b3cace3321d82741533ed75c7d80865e266cf4648b55832cc672fb979bcdb136819be6fea69bcde17ab5c71392b3ccbeb09e047f0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54b63ce239e218bd9af4063c84e7abf72
SHA15ee8484e75abea43273911efce0703728ec07a72
SHA256b3ea85963d54ef09e680eb16c3a04ebde2305cf645f238ba13c7d20ec833bb3a
SHA512fd1107a9ebffeb3808039e4cf4878f67eb2baf2ca26b964b5b1d8e2b72555c5a8710a8decde059ce4c04d7d18fd16cb025a39ebd30959cf69be8caed89220c9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD565865f4949be5a26ee420724acfabe92
SHA1d790f341f4a5dce7bcf2ee4b042de7a851ef1297
SHA25693c96a8182686f29fa36dd30c7495f0b348976764f3952e3e978d240d22efb09
SHA5123d5362738e280c0702946a5b81d0c636f8c35d12bfc96956211fbf321bd1c01984441d252d7eaf208cf41efa42d732fea2379dae3725defae54254b1af5f230b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d91dd5467c077679ec627d1bcee8a107
SHA17ab9621567b8f7699deb5fe6feafcb793f7b3a0b
SHA25684bcc936d8c8bdbb34b17ddfe0437f01658260d9dbd16f783c723c5e13a30bde
SHA5126b7ee46861d61b885dee1d3c7648eaebce7ca52aea98d0b1b066c7121e70e64e321043991229e0ca3f91bc27278e94fcc46c53f929bbd1f0a1cbf8d682486f4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b428606af119439193da79328fe1ec8d
SHA113fed484027501b4b57e5018462fa7c4e73eb735
SHA2567d026f4d86e1bb6b5cdfd3af07b00b7d2324e3161bcceccbfecaaaffad2aaf19
SHA512215e686d476bf6d657ab8d41d60da02635facb8dc3fa207beeea6bec589bb4ee740050c9a503de89d84e4cf47ac25529c3b8016afa3a2570ee56d249a8821f18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5df96f0f8418fc5309134f37b707be0a3
SHA18a39193a8665274fbd36d8f371d6a775d30aad97
SHA256240ce0e41f06151c33c161e12c5ca160ede8e8fde7cf10f7ec6cf72a6a78348b
SHA512e843e3562980025a36c3371479dc0d2ce9de2982e74e50a30701efde770ca605837fc87ec45b50da978f70442d7581e74e85c195e7c5f27dc073d3d2344b5ca5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a