Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 15:19
Static task
static1
Behavioral task
behavioral1
Sample
2a977b89dd947c56bec5636b5aaa834d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2a977b89dd947c56bec5636b5aaa834d_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2a977b89dd947c56bec5636b5aaa834d_JaffaCakes118.html
-
Size
4KB
-
MD5
2a977b89dd947c56bec5636b5aaa834d
-
SHA1
721262da9f94e240d107987791244c18c447a436
-
SHA256
d736d9e54c3f609be038b5b63dd86c1c855b6a2d09c052afce326103cafc519b
-
SHA512
d03877e95a52ddfbff954b1be9dc08047a19236a7a39b2a1791852ec0470820f2c7149d972e167005b43001faf98bca5cf72abfc7916df438d187e3e210fdaee
-
SSDEEP
96:ziEpovZmV4MSEPBDvV0n47ej/hgOKiljSR1QnyneqhjapEpx7/:zi8ovwV4GD8/h/KiZwQn/qSEpV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000a227c98cdb0cf7d906cecd310c719c6c69f2081225ccd3bde7d4826818cbfae3000000000e800000000200002000000065eab81e0e1de4402b79abbc5d086d7f436e04e8db08ffede429a04cad17b2a0200000001b11a97a74dc620b790d8bebfa2f677a01fd461a6eec1fe3cb9504362181987c4000000066ae4164f33083341ce49078dcad693b2eea7c1d57365916ea1f44c0a748169ce5aab37e0ecd3f5d9d46d409b663457ace7957f6f8bf0030f4bc68a46ee6caad iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000f7f80146923de8b75bc7d0d4b3c74d3581bee022004dc0e0f742b2108b51b71d000000000e800000000200002000000001a14913c0a158c451d1080709b552610216255ff3ea162fcef080096dc4566c900000003724c078e546dd431a7f45530eb574b35a1f3093f3639061d58f81087b0f4ca301ab309e762ec9b86966ff340a86d642e2912be6cb494733d65b321e506e224b16b0225cdd97693ae31ba00b2ea40f7c78b8acb1d39fb2c55bf3f1e60034a609c5bd66932b22a60d064617278231b06bf82bedef192229e5e9dc024688ad324e0ec5bf8c28d52a98c2d23ec9008cf53f4000000079ae11cc3e9ff5bfa4a5348021dd36a5ea52f4ee271b22008930f22a964ce64435c7479f28284e553109af9212d95f3b25a770741cc59cda4216ef7f95bfd4f6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307fbc5524a2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92EA73D1-0E17-11EF-BE4D-CE57F181EBEB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421429855" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1764 2036 iexplore.exe 28 PID 2036 wrote to memory of 1764 2036 iexplore.exe 28 PID 2036 wrote to memory of 1764 2036 iexplore.exe 28 PID 2036 wrote to memory of 1764 2036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a977b89dd947c56bec5636b5aaa834d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3b2e56e7df369409dc08eaa7c48eca5
SHA1621081b6027aa95a5c461df3e1608f6ab0812099
SHA256becbfa597d9937c68ae3ad251ef82594edc359980e53986362342f5ac67baf0c
SHA512e825c07bac3d0c50d220e21552ccdc7b92dbcad44f4ebbbfa22c5e58da0b4b66d5b98846471491f4e3ff33651ae0606098e84daa3809ffed54dec1baf825fb80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b755b481e2d09b8f55996ae0aa4f1586
SHA142ae53973b0529565d17ca20c2f41ea7cf735f3f
SHA2563830f34acb46fb641e95543139480a5f296168f6608222437ff0530ba6ba0f82
SHA5120d913863781819707655158a4540c43156a1e9129e19eab6acf2af220dd5c0693d615abfc30fbcd9c113819b4f39da5e94668bf84e02bf72b7e469acc089faca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec23d3aead4c420f19982fe569ec423b
SHA18c6a3b7ecb434a267f4cd2c7c5a7ded852eeb2d9
SHA2561fe262ffa2dd57825c3874fa63e2919d3592fd17635d7e31256dd169f01aed1f
SHA5121f55da6482fa761cc79bc4b6ba42b0917a93c9ff54b5a5537221825ae26f4eabb0ac9929e55053822653e540c788d504edd411cdf75484250e5492456d3ae34f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fc5eea3002d0bb3142df9a1587223fa
SHA1711d0300d4f88c39b4986bc6036d1441ebaa878b
SHA2566c1e519deae48aa2f8869f745507dfc948a6315a0d14c4ba330beeee42b80a3a
SHA512081ee2f1e1f903a26a90badd72a18d8db11c45e0a582ebfe0c00bfe3f60628b9e643c4c2927767a5b3253f8509ba324a86fafe677868489653b075f7ced79f3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfee6c2e99fa0a1d446fc312047cb4b8
SHA152a5eea95211a19d1d6f6b1db37e73b5c7f4d7d6
SHA256b8cc129af4f93f600f8455c672c50bd50c869d2fbcd113dddf3b31ed07a5bd17
SHA512c5df17c99e2d24f4dd7fd2e728a6c036a4d33b49239e3ada279b4d9884dbd2bb805afab5da527a3a6f0f6773d512bfdee43b27f918814c714e2c07aace3ef868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd6b44806314226c43fee42769daf92a
SHA1934fefb7f36bdb86dd29bb1b97e0b9269cff3eb2
SHA256a1d0673cc97989c225fa251fd4dece6616d8a8856da1f36ce2fcec951a370eee
SHA51209964652e37f07d342b56a513bad9e7e8db17f7bc81824aed25afcba91fb1839fca44783c94d96c069e9fdc8f1e16466c74e116940b65c3c210bfefb26731574
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c00eae3fe9295a7e5bb1245186024713
SHA19305f77af66b0452008e675b214d39a3226b02f4
SHA256c802823e157a107f31a4c435eea7ef9c8553fce26013b3d21648b693d661898c
SHA51232f763108506798bde120b56450685935601a894b8d4508e9c7101237ef04588a4571df66f1ee0fe2c5217881ca9371ec0068823bbcaec96d893a15ca7be6b58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f992859e95a0cf87e5857ae9b4249d9
SHA1a0b96da253200fe01bac061fdfd8e4d58d524f9b
SHA2561565babc8c0c458819d221464b6d0a06f64368af87199a2125ced1e1d75ea5c6
SHA51282abdd0818b5734a2bb28a657d108bc67fa8797ecc4e5379a93661ab5bebfdc5a42fdbc954a2192535ed05b01c10652cad0ddcf847f4e688d6475882a87f535c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5411ae5a2b9e866c573e0d64ef65f2aac
SHA190426e59924be70d92d8804a8b0f7883f323ca55
SHA256b3c3c6cb5a1cbee2d8c35cff62d3b65b894893714b2cdb18b0edd9a8089dfc08
SHA512f3711b25744412802f4c4d5ccc87e7d93326dafc0d6299f2557c5684673029cb2b76549611f111961ca69848f3e8af233c4bed0d3ea6e616db84065394c6b40d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ca1388b476c9de8a27dd834b63bb8cf
SHA1ebe8afa286820423dde4646b8aa48a6f0358e689
SHA256f822984fe71135825cf8f5a995ab0212f37a0369516f3a0b327694984d7180cb
SHA5129ceb33ec8e8b5f99080531eff352fe8bb42d22ac52cdf1d2fd6d5d6309af772dca32bc9f89730a39df0a37827453bde23169040472655ab3bb6a16b61aa00105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54765b70ec7e628e5a8f77a9a4dc14997
SHA19e03bebf0c05eba3e34b278d55510de3b68aa07c
SHA256824bd385023aaafd162ca6a4a2f5a416ef9c4bf3a8a5c10abfc65aa3936a510d
SHA51203ba5a1ba939c0538aca813d7f6f3e5fd47dbfdfa57edfc2f83fae39ff0a812118dafe97c55e79533fdd266338826c24b68f00cb8b3515685f686933bb625f6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bdf930d72573f14edceb7ae98a67405
SHA12b2d2625a07b8a28dffa0bf22d0f98bb9fa5c6d4
SHA2565f793e6c2e315e149796085138baece5d3cc2ff682ef8ee00e58f0137809492e
SHA512fa1388f585d7e7683ce616ba3f0bd0062642764c640e4559e422b9e538f64e9d9bb289b157333284eac23e7d211deffac8d9c474dfff9870cf7c2e8cd28271bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572cb15dcb991b788587c0491e8911f95
SHA1d80569451a9bfcf7d679c5a22a25fcd77433550e
SHA2565d958756244f53ac353530af9de904bcf0be049f860dc1890b1ffb7a5191a3f9
SHA512c8bd7f1436211f08452ed196ba00a9c4ac7bb512ca321e3950f44935176f137c754d6c7ee5652ceffda607e9daaef1d9258d6c492827ccf6f38502bbd3f8019b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aee8be538110b77dfa792e0138436bdf
SHA1edda3ef19ac90d0975157fc9b120bbd3c8123196
SHA25675b57f861e9649f525497419df95be4e5aab7deb6fa8d0b8b36a73b0acdee698
SHA5127b9ea16a6c33ec4449c43fb143758fcd1d6fc2ee1a3bcdefd8f0608e38a3f028f265d802b0f44a3631b4a9815e5b6a24d028137e32e5496b1e7a1dbc954fc9f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5763fe57ec737fc14841812bd1e68bf60
SHA1b6b2d8cef1208cf5904db5299f464e7142208ed8
SHA256bf5635dcf45b7bf7ea3deddc3cf11ed638d9d6da3b8dd911b97ecad5ae204802
SHA512e73db5991e2e09cb76a7da3eae2cbb8d580075991bb79ed4a6ac72b7c5bf02a627ade225aa406cd983d17e9ed56ee2280490739c909928274a3acae38650d9c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee16cda06d051291defe38f36233e6f2
SHA1d14fd7b909850ec214aea23fd91d970557b2a74a
SHA256e35c0bc91830c8ccb34a4cd5ece15f618a7051a015d7a25f1189c2e095ff88b4
SHA51269acb8d355bca94c74adeb213dfec306423ef0329119b43d27c7f12dc8934c33cf78eef99e5b061738ed3655b528324b27ebcfcfe15453b76fee8c1b32159bd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec14425f79b13f34656de1c95b5569c3
SHA15d8852e40f5cf5b761cef4f3ea94e0121980fa80
SHA256006715a2ea4998da78681a777d64b6115a0465152bceda39a197370a5fa203a9
SHA512eecd696fe7d88e6f1e333e971b7d5aff1703ac40c765558fc8b2b8c8fdec3b3323b0af4f12765f6c928b2fbbc93df88850ca50a7d27c10caaa5d542cacab211c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6f96401465200aa5f72a3120d48737b
SHA13bc4e5ff1d08f0d5867d5d85df21b8abf66c1dfa
SHA256dc45b20de50c5860b7b6650d0b0a807c1d1b429b94f59df90af5e0600f80d68b
SHA5125e7b7fcb8f0bf8c76a624bddc89906269f10d23cbca66029b5555561d42455ad6f544b1118187ffaec96b960a58ee3d0d9e1093f07aab91cb20c84ed68c7ec9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0b62e61c420d88a2f12e3b5bb392cb2
SHA1828bb4066c04ae56196c8fe65ff10161e53b4a3b
SHA2568261fe674547b58e3132f9871c54b6f8cf69e3acc6102c528111b3b5009cc312
SHA51245d7b777c5e5d853d40d8d657208b02d875ca6f1b4a7c9b0aff28a529c49869d6dd8f546ef86104d4d6e04f7b466c69091d6755f8f5d6d5ca4fb18f5e488334c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a