Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 18:33
Static task
static1
Behavioral task
behavioral1
Sample
6f742115fe74ea28ac936f12c1c14e4c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6f742115fe74ea28ac936f12c1c14e4c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6f742115fe74ea28ac936f12c1c14e4c_JaffaCakes118.html
-
Size
158KB
-
MD5
6f742115fe74ea28ac936f12c1c14e4c
-
SHA1
f357557836d83892b04c902e3ac99a01c4fafe77
-
SHA256
47b9c0e2765b7106cb016dc9b20a44a4b60fde4a1e1a95673d02374d78d47a55
-
SHA512
78bff8b19c4814cdef328984811278c29debf43e58087a685b26c6caf97daed08730f78f240d538ff3a0f86c87cfaf7d9feb10cc857fc14d5b27e0a6c0208fe9
-
SSDEEP
3072:SwNmZmC0pY0QjyfkMY+BES09JXAnyrZalI+YQ:Sw4P/0QGsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CA22EB1-19FC-11EF-8178-52C7B7C5B073} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a961e2f0e512a4391c70274a29e7adc00000000020000000000106600000001000020000000d52379b1a8331064ae4e62347cae6f9a8a62e589cdfcdb51d015f441ae2587e7000000000e8000000002000020000000b9bc24167a78912eaf3c465b6edd8538cea0fd969438960219d93e984c3d18a6200000002e12f8f52186f2a9fddc80c29fea41045cd3ccfbd092582cd7e16489faf5b0a540000000d2e220306f8cfb8ce2acd289c960305aa5e8e7e284bad435af6d186e224e9e200c97ba655bfead1e941f9a6399ab7a4e1b61ab1279a99398d62ff6f2ba72f18c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702a054009aeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422737502" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a961e2f0e512a4391c70274a29e7adc00000000020000000000106600000001000020000000a12ceaa695960781097a9b4e658335294bd335e212f559b5558e99dd71597e31000000000e8000000002000020000000a4f828e9dfb4978159c65377fb0c6a7f59b76a049c926ca902a2da3f811dd8ef9000000093149049ef7530dac75d28e87ba191b68f202a5ab5b72796a3acfebb51df327d01f267a1606fc63c43e423df93d3097965baf9028cb89fbf381ddf4b90296544e36573b802df430c141d821e148600fa9762c1cd6b32f1db3085a4a8d551990287788252480e7581f77ae223f02f6b744a2728acdf694bc70649107f80cc90052b0e2a6b36034db69fdda82cb9e0a57c40000000ef36c81635e6dd6025ff356715b9f6e999f6024ab3279c90c9116e1565498e375083cf0618d466d0c94a30ce1acb953edc186d06a91cd2f265ec88cc2a03520f iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2784 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2784 iexplore.exe 2784 iexplore.exe 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2748 2784 iexplore.exe 28 PID 2784 wrote to memory of 2748 2784 iexplore.exe 28 PID 2784 wrote to memory of 2748 2784 iexplore.exe 28 PID 2784 wrote to memory of 2748 2784 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f742115fe74ea28ac936f12c1c14e4c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c78d086415890b60b3bd6272d321dbc2
SHA1c46b87d8465611997a18806eaec877b1e5b03107
SHA256a3d992381c5326816f0fe40c2530a8082b676c9797e662c190939ccec3ef51d6
SHA512e2c716b9cdd755e0299b2fd49e959f05424667e50251920240f16ae6e5b461382709f53a3cddc1fe984d988388ffbc89599c05486f36dcfea8fb714080aa01f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f65c57ddd8159c963d085b3105d1d7cd
SHA13a1b40599af1dfa2e367bf3333e83e3362936ee5
SHA25692b173fa715c8dcce5e5f08f055648a41354e2cb899c9a030fc33de477f64afc
SHA5120af431ad8d8566b175f6eae7672f5e0c217c5bcad404d6d03299368957c6ec0b16cbb7a09b82e14c5ef5cc71dedadc2d7613e7e8ea5a2be79d4e43d2023b2299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530d97df19fc1f74beef6092e18bea98a
SHA1166a6d803136d8e2f10c6d742f83dedc3ec36647
SHA256057b16b98a0279efe2e80e29bf14518978f22bc77e36222ef91eebf07627e0e9
SHA512e9fcb5511cac127fa27740fadc6e49cfed74b66ff5e869ab488e0d07180756c06c4a4f6503e1fad24d83f88c8ebe482c78d3671e42d8cafa94983f9e0af3f085
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5346e7c9f2d17c4edb255f6d33d46467a
SHA1e452372977b8b9552c5382a69da79116bbcfea8b
SHA2568a520da78ded3482cf25f08e59fce9c66b97d9caf8b1b714857936f5b07acbda
SHA51290a9567f05062a23c98ed7f8bd705deabb0940f2517641bee240d6c31a4679839f9bc5e8276f0ae0f47ddac63767161fbe7239624e1526abd567d8f86584abbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59523c4b5799339160dca8edd2c2f44f9
SHA19ef8c49d9c56f65326889bc47cea48eb66879cf7
SHA256adb82fc4ce2a3193ed8d4f1cf59591468a114719d2c5f9c2bb52098241abcc8a
SHA512152a1b1a703e0fffd8f693a74c279864ffdb46678de266ab8c432c1c18d6e593e5cb9b4045cd9e7fbe16fbaa10dbe0d5b60b2421113094b918e8bb0f9f024ed8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511a68254add2a311e7e739a6ccafb806
SHA1a1ffdd3e3879af14e5adac381afbf8f77e5848ef
SHA256440e99a8205b455afee060de0cc26eeaf5a131b6eb32f00ed5c4cd75ba3d4ad9
SHA5121952289de259918c7dae956558085ed6c99bf4fd468a60ee4f4434b8dbeb5e072db14d65a02c7319e023b94cb7f5704f68e57c4edc83fa22b000738b48ff3050
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3d917e56b9fe1d00efe60f03300b8e2
SHA13408a029b6bebc4ba7435ba7aa1683c174c5e11b
SHA256f34149e622e9f93f0dac6529a7673803e29621286fb34a0c94b035932d733ea3
SHA512b7a904695dd795ab293b0f8ba3dc6ba5fb4faf3ca87f85914ac4bc08a4035df4ee90c4793572042818c74af033f3a98281a11348501770611c9f07b0ca3718ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ac5b44c16156180d68c26deeae076e0
SHA1a40540dc24e95b0e2bd649ee87abf97134ab9f9c
SHA256aa3f070bf8551a7594a24306d3a153600a1c89d50bbdb828991f50462e3206e5
SHA5127ec9373ef8082f5d27751cad60272a9b92eb9eaf13d680ba6bc60bacf1b006e27eb752bdfae3cb30792f4b3dc1729da7b0253d08d605d420a33cd0d578be6f10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5628b09d1546b77a7e3b2f12dfcfa8a83
SHA1908148aac6ee73e1b8ca9cb0d51eb663d83ddf90
SHA25642f88568b55c6a4a1dd899c53f466f9cc4dcf9e23c6ae55554ca8ab0989ddc2e
SHA512b2ff06965653869fbddb61e3e7768a172508c869375df0d48c0585bd050eaf56f031e3e653071c86144b194b27dd5e7d23f248df472d0241709796e954c3b0b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c150b683f42292a585caf630b61963f
SHA19c19cc624088d28474531e33359c86951ad073fc
SHA2560cb538e58513de4acb8bf37bbe59463b1f4dea12c74d8f44c3ade79166c13f5d
SHA512d22f13131abac02c8c14894b51f2153653a616d6fe605aac2cc79ca0235d3188326ddbfe14f66c1e80090ea15bbf60126842c163923f1845dc9c7a181b1032e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9601f98514b416ea982228eb7cd7d0b
SHA1bf6eb3da614923f28ea5f458c8d0474b741b9717
SHA256d831476bb9c00c2b6745ec68ddf1be08222d8c04114de2e5b2f16d124737b41e
SHA512a07906bfed85217c26dc74ead5a56d0b4c4cbd882b6a31bb9c9244db3382642e2a0dbc5b9c2f826e3743249422f4c2b70314ddc0864c12a67e40c37b84592192
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5916e9185b742464263ab74ff8835db39
SHA1d0242fcb1152d1425460095c53c38b0558628789
SHA25621c8d9873d5c10ca24834e75a3edd07393bf753e9e42b5d2c120dc1ce1654163
SHA512f76066dfd9ac7bffb5fbafc282cdec5048a2e5254c306d6a1102865f4f1097569eb837a6e84082f7874fee885331e892212951eea81e9e2b479021558b0c17de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce6367a6418d1f176b99f59377241477
SHA1aee80f381fae53d5e28d72d985600087cb95ff16
SHA256d021515f308faba940bda6b52b056f7a562bcdecdd4f892eb131751a22c66194
SHA51269b653bf0cbb081a076e9b55479d668f38729b187ff6f44bf66da062ad242b5225ad5954153a8e312033f9f899afc5c053ad53694b9759fd14f3de8fe9bf0a95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504d08d65069e114d3a52792cfc813f89
SHA152dfebc42bdab69db173d8e99b5b847c5b0b9e82
SHA2560dd4fb6c90e08bfc5365583d90fc77de13dd4d433c7505d07a7b556298337294
SHA5126785a9fb6f981cf0bc6c7658470f7dadae64e305048f6c53554658d5ec7b0796b7e4fad4217d5a5fc603c7bb7643189af830b20519699a711ef309d1108d87e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586f9a7b537d73ecbbec14352c421192a
SHA16bcf102bca1c095c983534371fc11fba906d63b3
SHA256735ea271d95277230ad3ca8b32c9bd57ba4672f633f56d6e822dafc55d8b0585
SHA5127110091b9a2cdabcd1df802edf31865af92e469fd68c8c0ea19b24a7d5b9606e0f9ac6ad7d902930e5612fd3af8838253932f56e65857e5496fcb9c860d2ab03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec266b466a9167b2187f83b6091bc84f
SHA1190776dc9c93503fb4362176b76a02ab8470e08d
SHA256791f48aca2117be9e48be5a314d63aac3bea4deac4a3f21328a9662a250e48a9
SHA5128c8c13dcaca9ec7b09517d663b3baceb6d0976da2e32173fe79b5a0d74b6f8e694a1f658dd78e818f4e0a8f5a1e545223ac3bd1c2861dd400922a8449fb96420
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f7ba6ef529db9254fdb75599dea5176
SHA1f498c332a0eda14572f4efe536eb214fdef2b1e8
SHA256da3d2862b81a52c9c33c43c7d7f77d1b33b7d8da12a9458c8c410ae5593915e7
SHA512a598ccd6448e62f6fc2acd7cacb691ff201f44a7fa3dea376f63694d9ec3c5b77e3268d622d7521c7f3b19088a53a53cc872ac21dec4e4510aa987e86ec9eae7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a