Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 00:52
Static task
static1
Behavioral task
behavioral1
Sample
2279a7e8951b9ce6c83c656b4a871d92_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2279a7e8951b9ce6c83c656b4a871d92_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
2279a7e8951b9ce6c83c656b4a871d92_JaffaCakes118.html
-
Size
43KB
-
MD5
2279a7e8951b9ce6c83c656b4a871d92
-
SHA1
551bf8d05e51e2f8dd93a685fd58fabff1278717
-
SHA256
71d345a67cf56c838990eec1f8e017c22396074bfe7e7700464cd48ab83736b9
-
SHA512
e54289a9b8e034825054a3e674bd0d5a2cd6c09da44c9796c4fb69e495dc4620b8ac50803299284d20824917eadb7bdbe3b6188e7884251d5a9a01bd6f1fb14b
-
SSDEEP
768:1I+vbG2+0MGi+vZGIikHhGRGXiOgOeGBGlGslstvtFOs/wOen3:K+vt+0U+v5ikH/iOgOJFnYOq
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000002105303318df23803237fd01e9110a3e43335cc5d1b5cbc3a8c6b9e399e15e82000000000e8000000002000020000000749199fd3ec9572922d3641a6ea0e994443979b51e9ad6c7c12e2dcae79b8ffa20000000223b0dafd9adf4b538761b90374cf59e3aa6c47d75f98ddbd07528cacf0314624000000021dc4568ff6607796a4037f8c263de801ca968981e836b91749ebfc29f3358fa000114c1a7e0b718a8e979b7f1efd96af00b5d9a34367f85bdae674e26708813 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000cc40a3faabee72ce04c768ed68163d17907de7810e4ff46498eebc27235f96f8000000000e80000000020000200000008d04ab18d67f231c85e11c48e27a8e67eae25321dba162c1578379cc224b68a79000000093edd674a3daf8334f64967582ad9a945ae18d30f26828c772291af50ada77fda6c6edc442ac5cab798361a4ebb4912132a76226755425e6354355b35f393793d85262faa8f017dd1dd9ba87fdbdb05dad7b6261a3b9366e537513a955428dca1fbd49dc9840e54c81914304eef87813595653f98d52a50fbe2b52b33f114bddd773583421bc78fef79be4124d6561524000000072612555036f0337aa1723614f9ed79b430c61e2a9e6a3e7d2f31d5d253c9412ffc68e7a2f0a94ff197622373d9c94915de6a6b1d01d0a707c7a8c834ac35b76 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421291395" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10737606e2a0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30FD1351-0CD5-11EF-9A09-E25BC60B6402} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2656 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2656 iexplore.exe 2656 iexplore.exe 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2540 2656 iexplore.exe 28 PID 2656 wrote to memory of 2540 2656 iexplore.exe 28 PID 2656 wrote to memory of 2540 2656 iexplore.exe 28 PID 2656 wrote to memory of 2540 2656 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2279a7e8951b9ce6c83c656b4a871d92_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534d3ba41dfe7d41f40241d5129a3b325
SHA1566f8c8e2140a6a967794298e25860ddea78e84a
SHA256f09e86c778ff483ce684693d91c897d5adbb5b25a4de58762ef623baa1d6528a
SHA5122449c9ae82d4213bf18ab0b4d7014f73f52a8bec8fa73cebef12afb137a49a7303f8ecfc86ddb4b7425525d6fdadb1d9503afc6c4f7f04fab21628be0fb38834
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4fc3746c74d16a7cc273adaf9713e2f
SHA1eb984be5a8ecaf608ff4e3af5aeadb01ca458626
SHA256e238c49fce9b6fd2449c8a4649a35a140426be8fed4c94657144875711288489
SHA51260b8802d8194e9ed721b2f503bf5a1d54932d89e759ec5cd77ce8bc1241569e6c9ad209be4d63f196e8bd0276e52d12a46adb218a3c808dc0096f3dd17500237
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556ce6f8c4084e057bf75d1f71c549d0b
SHA1d3ffb150787a799633f5f04291b5e70957115fe9
SHA25638950a48b56c7a1e6eaf4d92b6a991958739c68d2fa400f1bc65769423a6f4da
SHA512d3701378d666542de8adf808319e17ed003bde0934971866e522a3a9c071ff25f5d23351ec52b8333a34414f242b73eba22f8762dedfced6f4cb5ba9ffa4ae7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2aac24af51fefe35c8506c839e673d7
SHA1d799b34307098162a8c6e2c9d1477539e4e3037b
SHA2560ef8dff9886286a45debe80d0bc750523f8a57c7d7ec6e2939b77a5c1c5446d3
SHA512c877feb137a2061d1e225081ef640a6b3f8d913b6233cc757384db0f12eb7472f3f0b6bb56dfb02b92e05d11b0d322848a7966fcbac8b478bd039c08404c061e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591c82a7ee4326c5e000f3716da94408d
SHA1eabdce379faf269ba203f74ad3e8b690b182e952
SHA256a6d8ddaeaa53bbc70b04de6264748993ceae8f210c50d6e61e849c6cabc0ed71
SHA512b565da5c863d166d1822c27f5a0d92b1fbeba0de187370d362f9bd9cc6bcaff26d02af58afdaa173df8b2006e7c203357219a2cc8e3e79cc1e503b0d1deeaa33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c46d3281e602461511fdd9cdebdfeba
SHA1f89d43a6521083eddb2417fddbba8115f4e3acea
SHA256f71ff6bed91de136661a6dd905f8f06b8261ad9ee4fb93377bf66908388f1385
SHA512ca4d3dc9d443d36ec53bffb57e9534b07ecec8db340482454445d62ba92e63e4b45c5d64ee23c29257d98f22a8d42d074e37b764e82583674f42ebf7c9ec4c1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fa523badcf102533b8db0c0dab81dde
SHA12baef1e5d8228da70e07d5c061b0873727d12a73
SHA25646dafad99effd6e7b8b07eac62d0131d5c4e9b705245c457860323d17d9f7f82
SHA5128b706774be84af227eeb061074c1c55612301b01e10ea8da12b19957010fe7ba129558210765206e5c44e182e751b510d12fa47b9dd918d6a87aedf57188df0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3eddf90e1636725b4ccaa2a98c7bdf7
SHA12dd17e7054fe889224440bdc8623d0732e16b6cb
SHA25642a5256f477249b8ec12ec7a3f58673b68961d42caed5efd04cd82295d7fe881
SHA512d242fa63a424f4fef79a458fa35edd3d2bc8b6ff431b716d46a64b29cb62ee903e4874226603c07dc63d287b015f5eebf6ad1bc53f09efec3bb1402a8504af41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b665eba6ebb68f4add3733946c553cf
SHA1b5db9aa31d49c90253384e7e7e01b8620be1515d
SHA256b96cb28a63f3f0f9e081c1d92f77e87bb27b98eede897de4574cf0ea7a4b3d33
SHA5128799b81939f153d7fe840f4cc84e3e41865f4d1e90324237884ade3ff2a7cb64ce2e6ee758f1e3601b544d01b445cbf8fead0ee7f58129697983972e003ce8d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e0a2a6e05aab73c0e2b0470be239726
SHA102747e36487d20bf24198951f1d78a7b49bde335
SHA256369e88dc0c255b72b2b3795273997d92188a7bbbf4fbe396607e07c435a0bd34
SHA51263f9ad05ee42a4333a17d51d9dae7cd75301f82b6ecf8f90b8523fda8e0ca278bea186afda480ad34097f081b6edc7d165a93d07412cdffc64934defda23a41a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565426e4619cbe325ea641736769db099
SHA1ab743988b835e38f8f69ed3c148e099f038f34d6
SHA256acf26c82816fdeec0b2304ff94e6affda4bdaf031c8d4c197d5bf5e3830bd654
SHA512617fe30277e8e6436b89594056446999276bd435d2707ccaa3988fe18aa882441e620e7fe3a9997632799366ab3d51d9978fd44fe3b9ecfe82adcd7e54418c1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f4d2a509fe71ac81ccb0a183e8566a1
SHA169ec487e42766c32119e61f2fbf6d1559c09f1e1
SHA256d38d9d591b8ccf1acf285c8f3da22d7b5e506e773d146025be8042a76ad862d1
SHA5125b3c698159b9e9f812865d660635173a6acbd5b6493a39904f690ac71940c67314489f23729e4dfb6331089fbe16fa77b1d6d03aa4254b17d587905c49bd23e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de2c824d2dce6d8f55aeb15d283abff7
SHA1a097ddb62f4211bf496d0712fce32e87bd931ed3
SHA2566676b217c92029f269d7016c023ef1f7a7f1db21e28496f442b10b263b29aa4c
SHA512e1e4c31322e44a14ceca6aa8ed8f6b0820587e7bac572461312927fc8b22f18104128721b5bd2c90a5d20b5c336559f740a29ef4fcdccbd1d0d098ffb897fca8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506e9f17b6f0e80f6d57e378c5340805e
SHA1f47823b1ad81f00d9ee187542e3236f49c9d6c21
SHA256c0299500d3f014a97556dbeeca654b729412590c1e699ea8ed0dc50d9886ee7d
SHA512dca8920175484687e11825d5938334966796877aac0e081776b8d3dc5418fc35e4ff74fdd755abd63ab8a7c900c326ca3d1f0025d1e83a02bbe7d60736cc35e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54914f6f6419c2cf721539833ebe3c2ee
SHA10c62c46d9ee4ac7dc38e316ee99254c7e9467b12
SHA2567c9476d12466cdf0ce19a2261cda1b62d5f0dd69db203db2e7463a1b4459f990
SHA512ff745667950a54385dafc67ba5303fc2f6d9da67d639c56e13efdcd87d0421450bb5c5895ce616d8fdc0e9e7f9575017dfdd99a534ec7428bfa03272a30915e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58246019de4ea72c3707607b3a6f07841
SHA191a22634227005ee0606cc82da00ea7336450101
SHA25656121a60c8796de602ff50a3b849e835845982e861f8f488cdac2f8a96d2bdc9
SHA5126529b8a57fe297ede174c945e5989b9937302eb98a1ced7bcdf77db7cecc6b25e6c8264ce9414fd51d9dec3cff163b4b0f98a2c2ec6b504db5ab933f1f5defee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57426e2720266b72f32b9dedb8faf3019
SHA1f6170cef913d28a0bf783557a59e2abb5d08d162
SHA25631bce0f863171f59a082546ec08bed186fa355eef90c9254cb2399eddd9acd46
SHA5126990aebee6060ddac7ef1759c5d9cc673e9ea9e5e4227d33af71c830936d74a0c65364dfd5388256f84c4a1a185d70e0ac3a9aacee38acdfc00f5194f3cd0249
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a