Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 13:00
Static task
static1
Behavioral task
behavioral1
Sample
12d920683b9963bcd7fd1b1a5b4f88b4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
12d920683b9963bcd7fd1b1a5b4f88b4_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
12d920683b9963bcd7fd1b1a5b4f88b4_JaffaCakes118.html
-
Size
4KB
-
MD5
12d920683b9963bcd7fd1b1a5b4f88b4
-
SHA1
66868d86bd18e649f90c60bbe06fe4ec6b0cc859
-
SHA256
2d499ccf7b1b051d4e14341aa3929a16ed543129a712e554222ecef349c5b83d
-
SHA512
6a892bab0403309b483ce4ac22a2ce2501a00c2811eec5e00d76cb2504cc77a4d5bff1f42434998e2ecc0f0e9b8159188a1895eedc6f398cd6f72c1aef36bba7
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ogPjad:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDq
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000498a6ae968d0395b5357902ca9ff266245717f1fb3eba697a4a4fb01809256ef000000000e8000000002000020000000e2c272558fdd1c78c3c48d4af8872f2f1ed2c205591512cdcd72680708e02b0290000000860a465cae96701f36fa5964cb77f3614dbe66a87c590b346193a1ce204658a1c5c910abd3842be3a33f2d095e81fca530a3e64c5bbcd1c8a569cb17c341d11f2b790ff1c7fd3d032402bada67d2c26aceb9e555fb077adb4e0e1a5b7a3476e5ec3d182496f4dc368c07633afd82a932aa6d03afd9537ca6669d59d3f66dc17b7687f1bc5ba4f4fdc3134e803f93294840000000776a40670ea46b4f3b3252e92b8463e6eceb8631edcd45c73f156ff8d5517ba9495835918ce434133ad2808104a0c7df706f234636b0c7ab6fe0cf359d803b7c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f083251e239eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420989498" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000090c2b1e103f87267273a2f39a469d48bcd829550a834aeb00d34361a9f4f9c6c000000000e8000000002000020000000c4ce8e21f13a2e1397fb00c7a4616bbd4f41007749a8198ecc7bab6d2042608d20000000b53c64587067d480991b7fddecd6769afec578c1de7c30dcaa37d320fea6af2540000000b30972b20ea2dc9c762a4ee025e26a92efdc18ce0d20acdf11cfd60c576874026ea3a832eb2e613d4fa90cc5dae1d17cd21b60c30d22e7d9667a7b00b71c412f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49A81061-0A16-11EF-B937-729E5AF85804} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1700 iexplore.exe 1700 iexplore.exe 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2640 1700 iexplore.exe 28 PID 1700 wrote to memory of 2640 1700 iexplore.exe 28 PID 1700 wrote to memory of 2640 1700 iexplore.exe 28 PID 1700 wrote to memory of 2640 1700 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12d920683b9963bcd7fd1b1a5b4f88b4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc95c1ca00ab42ba311735696109120b
SHA18f2f992295004f88323a67441f2a5f24f8b11cac
SHA256ea541eb9165db1e3a1001a42bb0b90c6b61c289f516a3b96abe993f2d5161306
SHA5124ceb17b5cf200733016291905f260f0bc20de9ce5abb96a6a213a36e19f8f4612df2aebbe00e451af7ba42c725ca834a6d3b4df8d1d5ad1e8d8254876abc6e45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587bf0bf3bdf79abaf70e25a7cd37496e
SHA1c7aaec10baaac04ad7d721243c46bcd511b2ca02
SHA2567ce9ccf2f23eea3f3e0af243b6b2a11818613ff135d7f3102ef88f171b2ea123
SHA512cddbeb18034ea845885a26786b206b98d93c3abf61721e94680c5a6785ce507b881946461883792aa05abfe06e88f1491daeac036cee2dfe6e64cfd4bfdfb060
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bb8185d39fd8d33108dd90ed3a9b8a2
SHA1860e1b37a5542fd5be595fdb3b68e6fdfb1e0ef5
SHA256fb0218a7312cbaf09d4f41022ce7d9aed9b394a2b4530345161e2761d5e55b9f
SHA51250889f46a1129b1266f7be48ed12ffceb1345d9b4cb4f96c6ef08f8e446a6789c19ca97e8fa72091646d874075138bfafdeae6adf99e684639249a1d612d155c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521ad73f588fe539d39b3f2ef7896e9ca
SHA191163ff6dadb0516d39e5668691ac640e5931875
SHA256de7edd210e4ee29dbf0ba07004406ae2cc68900cc633d87347cb9680b0920554
SHA5129e1ef6d822685795c818d32ff832185b6111967a77cee2bbcd13c6991017c2c549c75a377d9c66c849e27d9f7c11973b647718e5f248de720cece3dd0c2046af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f3cc8a10ff414deba548ab12c0e9e02
SHA16e9b7fb15d7811cdbc0457ca41745a82dcbce671
SHA256e51fe3993947783756e24857033f9cc13f701d76363c84e3165f6b2b4a73b9df
SHA512f0e879589d5ceb77e288ee80609c91a57ee3ed7380cb17abfcadd30d53670f3b235537ccae5d02ef034e230a89189304363f973b550e8e1a60461472209eae9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582de89d46e1b6680baf7e89b9c7d5031
SHA11a934f06b715a05e47296c043d4da32fd515ec88
SHA256452faf1379e55ebe213b0fed9d8da1be0dede472e2ecc98bbe614cd801db4251
SHA512680d4939e95caa261eb704c517011dde8d3b1ad05097fd388f6376268fa4f97dc34793d4c2a817c3315ae376efac4d89f93f4e5071c50db6c2b7c41dfc73f045
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5078b69cc83b97e3f8921867917f8870e
SHA17c0c4771ea45f60dedeb078120a6fc130e3dc8b1
SHA2561c6d742b43d03b4bbab24b4d2cc6b4af3d698eb328cb5631b47305142be64861
SHA5122cdc396cfd65ecb3e5fbddb1241bbc68000ed460b9faba0f38cb384693837ee5fe9c12af486d527a61737ec77d00930198afe4880460848825eb213895603a6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e231ebf7c32375cd499fd8f8c65909b
SHA17aa1a715d19c36385b085d11ca5ea2caa20770b2
SHA256e5f239be0f766bdd3dd214d2f2c2db17e6d6cff8fb6ada0267d78b27123c37c2
SHA512bd4310fbca3f8d53f3b9f7d260ed9a6f417d10e353044d60868edc558389f30dfa487e7bd60e2d84a0305187233b74c1e8b42fd6a297dda86cf35a40466a1ddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b6d9d12a2f9f181d5cbfd88124d460d
SHA1b0e05ae8ee3ec24158b62f6cbcc14c50b136266b
SHA256eeb694c4361bc32c4cb0c418e7c721b383966f46da296e8560dbeaea60531262
SHA5128f8ee081ba49b843adb79c7e71fd7acc7563908b34c56a815b8eb4e4cc181bf15e7eae049843b6bcf3168cff9186ad16abcb135039c69ae4aa9345127b1d5238
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ec1d532e137a2ddb5b885bc51c97f2e
SHA10a9fc1e120d8f972fe2ccb84ec7acd1ca2498225
SHA2560533e63b001c4a0971cb3a54f34686bfcfcbda4c517350ad57c78ce29132e946
SHA5126d91a5b424a2c1d05eb61f97f446101c39c865991382ba3681c4944d157e4bcb34ea2c06bc1385b91729b502cf733501ca5bbd3848aa4a5e6376cf7e7b54e1db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558a730214b4b38dbeb1585b223105706
SHA178ea2f917c9cdac5de8a8d0638e7a0a85c5ededb
SHA256cf85d8e4b3d36b5d1e485aec6fbf745f909708922e1151c3578bc0035d5b8180
SHA5129904092645fc094f545bfcf198541af64b4eb03c0e81489fe32201e602db50cecc35f950a7ed75088504752ede571bf95b065866b94cda1197417bacbb8b4433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5994ceeeea7a8b23883de870481f2d55a
SHA17d6d1a9f60a60c5b34c4a2e91a8ed8a13e4e8cb4
SHA25698ea47452db68a883fae0c8444172e1687c4ea1f3ddf03f1a4e82969f0f8d2ce
SHA5129fbcc6b1a0195144364bb9c7cfba2136e4d404bdecd7fbd6532529f136e5e3e6d284defdc13b3b930b0f32ca17b83660006acbf2303e0e2980ddc54ef8e35182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ce7692746f66eccc3c4d82b5f8d9201
SHA1455616400060a8c04dce339a3b763fe3b3fd05b2
SHA256bca2351573f315078e937dfd599a7a203c9a2d671e48f3054d0ecf103b1787ac
SHA512d56f73f7dbdec889382a4f1fd4f12b04e991243bff7480e461fc0dcb12c2c4f491ebb122b7315a86392e774da9e77f696c90385433ffa837d44445e82a35b791
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f00942ad80dca78c138aa54dcaec4d6f
SHA124e0447a4e1c5b4af73b823a003336ea19c05024
SHA256b0a877d32e0ce9aed8bfe054872d96961f6c5f775d9ab4e81d7c6eca14948fad
SHA512f8c2c5b3f9e9b9dba4a3c8cbd5adb67bde269b6f985a3118ec174cdc15c98ad591c4f74e348c624a87f9736d51b7495bcc78728047a0408a9b1e315f6052cf8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d82a8052f81064dbacd6c29466226da
SHA10482e5b7ed8ef35cc60519e7e9e5c6d85489e3d1
SHA256324a19b1cede4f0d61576d1173e72fa62754005060f8c33bc405504e93945401
SHA512406fa19087f4b3a191766810cb527b34c892f2408a909bef44413b6e028dd49c2b94775dc69dedb5ace328fb948ecfb51625d8b2354476599f29e433f73c5daa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce24903ddaecba8de7a569f772dfd9a9
SHA1cc07a7c6badb9e3a478267f813612acfb0e8c8f3
SHA256bc203ee17c159437446981bb7f4165bd8051d620901e795c9da1e2ef1b9162fc
SHA512d5c80d660a622d6daff58318d392cabd475b8e0b1fe823e6b2607b9de536f24a751a53d3fdcad7c5545eee30d8eb603b4b472bc83ef0712a53313083a428e0be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c5e28121b2bb17d08080ccf4a81ab30
SHA1c74d3f34c1ba21ed8e4e18e6e8354ac2d3b96f0a
SHA256a0eaab083966c3a9bee48ae3a25ba0830da4fbee6242d6d0c68d272e37ee6925
SHA5127d7ba34c750d62fd2cc71c798b4aae64669c80d119f0dc078401d3bd2457a39c7af8db72b23322eef23de59c78d3063bc5db5d85e5a66b1c286943e70fd1f558
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511c2b9599ddae6e69115bfebbbe0d7f8
SHA171beb1df7ab5a9f22061c29fcede4e49faa1ad35
SHA25660dc436135f5ffb5e37df1173e65eb515ecfdaebb7572e3db97ec02c1db998de
SHA51256d3a899ca7de0d834fe42838f1e42183d9c3924a901c4343b2c9de04e0eb471681002bfccda4c2055f3806e9d52092f4f61ec781f656efe74c31f70c02a3210
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a