Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 01:19
Static task
static1
Behavioral task
behavioral1
Sample
48e9b70661cb84c653baa603604663a5_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
48e9b70661cb84c653baa603604663a5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
48e9b70661cb84c653baa603604663a5_JaffaCakes118.html
-
Size
37KB
-
MD5
48e9b70661cb84c653baa603604663a5
-
SHA1
aa8c8e440888586fa6b6617759104b305dd521df
-
SHA256
b34abd3badf0e6db480d9edf01ccd08fbe1281c75155200f4b4e29df41e57be0
-
SHA512
1cee3333f1ce4ded268c24b6f35060dd059d0c4b42bc790a384b255dcc223cb44930e541c3ba1e4906a1c25906475eb0a2d3ebb32b1588b0cd57359fe4eb7261
-
SSDEEP
768:w2S8IQHK7fCRvkg86migV5gdwv0RgBOU7yeJ:XS8IQ4g5hgV5gdwv0RgX
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000076d08bb9b2eca9192a3eb14f07337ae2d4691caca5f2d88bb61eaa8e0657848e000000000e80000000020000200000000a92a59d2ba921b9ee9773c0fe60d95dc070d982149aaa893db99d13132d369c90000000eee1fb31b1898dec56a6fc1e3f7b758adc938c734eea50280b256e3338e2f451fa96a6d545ed3e8dca8fe24ad99550c8a05f364dde3c78c7a4d3686acecbb79419dbcaf2cf1f6517c7a87f6129091a89af31a4a9d860dc34747eb3b09beb05c6349b7c2fdc3652ff0fdf254017ceb11c45a88a1eb7fcf3776ea6c1999f23ce6411aed63b696ad622466591a5f55841de40000000f780d23352e07e6352d539c0a39f977ca50223836135c3f171cf6fc3e551e8ed4c7ae36dd781b8e5b36e34ecc9d947d7d356831831fcb94f410d6248096518de iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000009433b619010fe6212d58ca4b39f44132daf01cd70e880fbf5cb18c0a1a24a784000000000e800000000200002000000036ca025bdc2f1297f8627b49b8e0d3d684f68d9181b353eb2c33f35b3903666c200000009d74449853939af287335bab65832a733cc6d08f0209bc096f31eda02a5ce7fa40000000c86b5e9f96d4a6e29aa14f7e6b4b9e45d31fe0f5c4bd46bc34fbec3333186128cb1f9a5d90ea705064bcdf7ad5bc8ad346e6b81b52fc7bd97240eafb87377054 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00949202fa7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BCE93E1-1322-11EF-8C93-DEECE6B0C1A4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421984216" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2980 iexplore.exe 2980 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2980 wrote to memory of 3024 2980 iexplore.exe 28 PID 2980 wrote to memory of 3024 2980 iexplore.exe 28 PID 2980 wrote to memory of 3024 2980 iexplore.exe 28 PID 2980 wrote to memory of 3024 2980 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48e9b70661cb84c653baa603604663a5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503595299027a1044734955de7d0751f2
SHA1ad2c11dfa0850ae37f024f44fcd1209d445fa8ed
SHA256d9b1da2e6697009502fad026625d4b5c81a591c6e96a55b0cfd6d8ffb7e7438b
SHA512e6fa7536c88fcec4cbd42ffe3b0437fb224b73033a1aed7404cc30e746e3182c11e028aa62be8e93c7dbddae1442ee5485171b53824c2f3361c646d4ca02fb36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543ac99f2959b5d64a6ae282dc0937c5d
SHA14c61500bbc053f75d38435b83e916fa4a8ae50c2
SHA256f783fa8c5975376cc4734bdba04400336538c41f8e2aafcbb464783cf5dbb044
SHA51251448668510c0f35e47f00465eb002161f75786e003d2fe6ff1b1b49bab342ccd670397342db8839167cc39cadb1c3d5e0bb3d317163572d84f73fccbdee83c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba6773ab519ae7bc8d288c7c5c827b79
SHA1f258c6cd35145f44d8b6aeebea21b29f65eeb6f1
SHA256d81d06ce4aafa498580c372a7d0b8bd0d54eb6f1715d54667fbd13c9cf83c37e
SHA5126bde7352efcacd39fb18015ae4f407f4c1ab31a3e619862c4be6450ed6bf28f38d22fb3275b1206ed60f5c868bf8b9661c89a330ee3dd942d818296654eb3b80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54041172f84c80f1101d4e2d9a40f5f35
SHA1c1c454984f59f682307cc49ae72e7bf7f97a009d
SHA2566fa9a0b3de676fe832bd86cbcee59b8ff55a113c63697777cf0c9d2e2b137092
SHA5121d4a693d23bc59d79430c06e5e4d0798e9b711e34a2864651e9e411399c05a59397df8b04ef4363de650c50a3bdf10fc2910f3729013dd824145687fb899b8c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593d5a23ecc88769dd1a00bcd27ad3186
SHA1b54a7a3c9dc68932949218b0328f47153c3d7e4f
SHA256d250500e13b9727435f7f972712a7d91e49f61205053f7c2be3e2d45f1b65831
SHA512e4493e0671eb68c4f4d64fb2abae7efcd323f269289bb094af134b5edba429ec5df145d8a88212def0d211884b4585f3dda3f29eb0a27541ac180f75a28ab447
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f30c1fa5025e6816e25f60ab2169bb02
SHA1e4e4fc843410e1e6612af8947673ba0484a40cac
SHA2564eebe24c9ddc3811975e57414a953b7a05c9813e84dfe7061efa5c0c6aa69e04
SHA5126e8c882f0c94df3f3d2de77f81cc841fc58e7ce2bf9b443b19529d438a2d211609ae92f5f3539bc063034cd3d93241db8edcbf806e4a804a256289d4f1759a2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6a6048a3c92a514aedcae35630513b6
SHA1dcd54bda8751a5d32dc775a5a8709142af2fafbc
SHA2565c0806ef9c01d2357fde66153ab6584c99d3704bc7805524839d5ac399279459
SHA512433c92d6fb1ac9a7ef9b511704a59ea5ca0dd5050868be78fca8c193744cada3a9cfb96890c4ccd8edc53dba7313c4ed5005339b649315a1c2dc14321ce55fce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5707a1e14027689fd30d2ecd5ff136db5
SHA17436705e822af385e1a6614e66213307c123350e
SHA25670891501385ba110b94d22c50c5c3fdaf2b2f457f9331b5c88aa6cfa4e99cf0b
SHA512f8d2da450ca0dc2ebf3a513b435b69f7095cd6b512018c0267bae1955731f278e50552a643c7bbc69113b69aa2aeb42c9f433f63feb2bc2f490815f0c060bb57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff5fe1b415739a9b2e7c0446d5f4b759
SHA146f4168c4493767d46dff24f67a741b9a7c98946
SHA256b5f2d28bd2a2c2dadb1fcd2e88f5012bcb816a6ba62be5af35dadb08b4859516
SHA51240e1bddf6c61de80dc5da426d1265375fa7a1e96611e47a7a5fc050b745c0b9a3f6a69c17321509d2af0b67e1a3471c4bd47689bbb30cc1c2f7b6db58d042fc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a758b86ca28258b533182ace06de3269
SHA13c7c313ba5ad25b11f888a193836b584e8a1c19c
SHA256f6b61b8a6819d3bb221cdd27428b330f052f7c487055ce0ddfec6edd1318790e
SHA512eb950336b676b599af18066d1bd950c3fb0fbf23c9f4bb114fae2b6989177971d8623ace44e36a4bcdba99dc78dc4e6496703bcc1a344cf5b7a043447c647034
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa3353fc9c4dcd6d9d1b1e2a9e85779f
SHA110da4f58b095200382100362f764f575414b7855
SHA2561dcf1f824967a05293b4790820410a8a11587662a61dda000f2aa94f0cc87584
SHA5124faea4e8d63bafc083183741c23a413eb5b4eb6bea1bbb17edb971e74a629da2de68e400b33ac1f8387b34d56d046e97c9e6c2bb6ad5982790984a54bfd7042c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524442053ed7e6dac7169e2db3e189f9a
SHA19b7bc10e0d6969ac0776aedb4c1620142cf218d5
SHA25659acd63f1586426b547b481abe770644167308e1e1d63c7cc723588ca27cbade
SHA5127745c22bdbee36724eff1b534932a04b0e3bde581d3045ed2c9ec658dbb766a621dd664c440b97f794d1e1ce8ba787529fed38a6f04b054d48bc5ec36cf69ab1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b158ab96c2e29eb471d7cf1c9b3f287
SHA11bb5babf3a04703dcdf55dbfc8f29ec43c548cf5
SHA256a6a95c27a099e5f1bb9c15246ea23c10728cf558baf7e8b43a77a8bff40448f6
SHA5126a4a3f21140e29132ae6f2071aed41867f28d584fb210b807345aad6eff1ba727c98d4b20c5927a0c37b514dba1185255bf252dcef191316cd83a119214649ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5333806c13667e3e43c6395ff10cb1b3e
SHA1c6fcf63df6112efc58b34110b6cca8203594e0cc
SHA25637e7384f7e5f8aacdf61af24505725b0b166244c7714ae1cfbd416f15b2801a3
SHA512c220b4146ed4d2131c61ccd6824a705bf69893885ceb774673ca9d6a10df06adf027c472399d314d896cad13b91798b08f3ef6da8e0ad9ccdb72b4153a5bf10f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccdfa575410bc4c736f8573b39fa30c1
SHA15a4180d6e81364fa07bc1734fadd6bf287e1706d
SHA256a9ad6bdf18b97f336a6e310b3fa1d421f41e872ab230add26af612b6ea96abb1
SHA51233456baebbbf303a57be7e48bfbe2128e3f1f4e4129c358c1fff0c12276b4063935f6cb4391cf626989824ac5145ac6532a603769d40bad220d610e73da30ffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5927ef92ae2e1f48eecac8e2ea297554a
SHA1314aea39d3b39cb4ae44df1e3db3ec6ba09e2363
SHA25694ccb73a31f83713f7cd74c162cf717ffeccc97b763c7c3671b4f30f221a7893
SHA512e376ccc20aa5a97c380a4cd0652e137f79b550dda0d5bb15d579e85d78b2011754e6143ecdbd0a60e0ef6e0fc47f8323eb4ece0caa074f7967ebe7f085840049
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50219b349a1c5d47a29e325db2b395442
SHA172cdd0636978fd00d909f996f3e2c2845cab1d3e
SHA2567639a5d395b3c8989ae5fb432df744354b5a2d025d2cd236ee7de6c19f1527ea
SHA51241fe6d761384998f8be62e63519e5568bce80e48e74c3c23ba61bf44b648f5d6c0db27f9a5955224e1540051e2078c03beaa28a0a1523892890e2fd44d13bf8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1d18ee8cd9c47248194c6343ca45516
SHA10ead92d89619731825795ce9fc074285980d7edb
SHA2564c955c7d6d3fef35138677997f7f77d81dd68a8f4ab56b32c58249f9507a42b5
SHA512210dbaa997f2e370fafa9052fa1ad86ab6eb3cdd9fedfc714caec2ce58ad6dc9029fc4fcc3a4865642982d0847c5ac100b7f0215f9bd9ebf0c6947ab5a616b7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530ccb929ec1202fdad1e64093a0da3bd
SHA127927fa157a653e26d74b1657f54a86b68275001
SHA2566ab9c313e78f35da843494fa414ee4e8fa088ac10e8ee68a652fef26bf805468
SHA5128a4d8f719a27897c6bc051a3b191c9d6993aae80c5345dd77eb57361a226cb253c40e54c822b0d4bccb8bfba8d220d61c70588ba69e78884d600fb07d7313986
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a