Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 12:29
Static task
static1
Behavioral task
behavioral1
Sample
757a985c767379cb1e25d1d354c5be34_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
757a985c767379cb1e25d1d354c5be34_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
757a985c767379cb1e25d1d354c5be34_JaffaCakes118.html
-
Size
20KB
-
MD5
757a985c767379cb1e25d1d354c5be34
-
SHA1
7f40a8786f7e9f8bb23bcdfab2207c1115826b39
-
SHA256
d5d4bcc3ea72936db838e9847657fd11260aeca86e231c3f3c7b11c66129775c
-
SHA512
a9d3de7007cd59f2c7a4d87645288993a87faae7d23b29e59709f07a4c7f24791d798662c5e659e21081ab985e4711b051967f6a6f6f4f32f799e0728a2f46a8
-
SSDEEP
384:zi/KcRAa5r9DIiwVBD8cMQ3R72r5r/rvmd5WScfIk9xhe0zVc9b0R:ziEa5r9DygcP31AmNOIk9eSqb0R
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95AC5F21-1B64-11EF-9BF1-5630532AF2EE} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000bc35df8475cf6657393871c434f9bdcc4fe1ba5fc09d9b9344360dfa56076fef000000000e800000000200002000000073d4c853e7f81e1f05f591351d2274b61514f9348d914c57f33abd072cf6bbc220000000fafeea868a215ea60c48c4307c15c0e17438d381f1a30a1ec38d0c70a3ca9fc24000000056eaedcb6de8bafe26d9c7f119c845dd509a115c257a34aacd402aaf37d45867b5c2013f6247bf544febde09d2d562677020829b51b7ffdd0376ef64af68a309 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f031780c888aabbd91c4d28142abe14f21909185c5d97cc7cf8a89e0bdba398e000000000e80000000020000200000005d6724212885a960e3f45729257d45c03230c353a580db2253f5165093e3a05d90000000fd85af03ef9a142af784ed720608759d09cbae11d5ea4874398cdfcac88297b75598c77cfdaa1f9d5f173c0474c79bf34bb01597036d140f5f283e5d4f48e41c88dba13336ed1bee8aa54da82c4c59771ad0d486599c4ddd065bcddf8824854998c7cfbb9a6edbea745100a9f154d16fa9c295ddde842def76e66e357e759ca10e167339bdbbcff0fa61ed8563851ef140000000bdcbf3283e4de1a6599e23a2512cf922957c901f6ba224a2fbaac083cde8fdec2dbf8c8c3344acb99084f0f182686ad2bd9d0d02d4a1465581853d5a28bd1776 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422892297" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307c216c71afda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 492 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 492 iexplore.exe 492 iexplore.exe 1664 IEXPLORE.EXE 1664 IEXPLORE.EXE 1664 IEXPLORE.EXE 1664 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 492 wrote to memory of 1664 492 iexplore.exe 29 PID 492 wrote to memory of 1664 492 iexplore.exe 29 PID 492 wrote to memory of 1664 492 iexplore.exe 29 PID 492 wrote to memory of 1664 492 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\757a985c767379cb1e25d1d354c5be34_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:492 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d49858abd85f75e5d65d9470a0379202
SHA1950fc19000841c3af582cd0e0572b2fd0fe94f2f
SHA2568f6de9e0450e0a03268bc6fae125267c024cadb67c4fe1650a76ef297de63647
SHA5123ec9bbfac330ba092d0bfe2101e4921bb92df7800e841e5fce5665f1cf3599bc6c5ddf7d8f59c32317400f44a44ecfc794dc5cb55da3c40fd3b16cc3a8ea57d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596474b3b8d1ddaeaa37b59db2cc34542
SHA1adc9c27189d9084eafc9934ae7e63ae6e5b29509
SHA256958b87c74ccbce3224a252353212c3c3b37fb5cc7d15906f2695f494e31522bb
SHA5125ab7ee87d1d65c0884cfbd792bd1dcc39d5a2ac40aab76e6d39fead389e74bf0d42639a9531494b7ef864bdbedbff8c2c4644e131b2e01d805c723d7c1cd6203
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5206cce9aa49b8d6c235f4cf4dae68e6c
SHA1c67edf3facaf6345b5e7fbc6fba120be1daa154d
SHA2564c02e2629dfdd436e1b14254086b1b6f5c443f277b6b9a9e378f036dda03b328
SHA512fb27d140ba8f8d1e9e1eeb5eccfde3448d60a6d56f2b45d923c2d62759e89ea118d2923ec27fc02625280bd44912449e62d45c908a9e300772e479a68fa86818
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59745ddc87ed92fb981230fdb3c89c26a
SHA117a0affc3fd0bd13903f27a5c3cab3f120d1047a
SHA2569c40cb08abc6b8e6819688dd56b643fc22c597dc0ffca900b1d88947501a4ef0
SHA51251032fafee1e7c06a4152e68d1400848d132406740c875b24c33407bc7cea4c6f129777ee57db46d62c79ca52e78fee4294ddca7d488452a0a19ccc92515d4f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d894f268f70c0d42e77362629948c49
SHA1ca3881ded1e710856f6bce8493572b4a9411b78f
SHA25694d9370796f999546e44af7d0352243a157836a866403a4e272fb361c62346a5
SHA512f1ab39c796695b4d7778d3ec105b76887b713b821458af65790b16e404f9cb16ea316d6bf4e913459c403cfaef6b6fb3dd4ac44a340833963d8f76cf511efe81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5090abebc5783014a30f5e9180afb8948
SHA18759d6313e3c2e4e625f1f8ff67b3c191b197a16
SHA256d16b6e342a06c74161ee5f00d36c14606fb4c557c42d0e3a671a3fadeed7d265
SHA51266a5732f1fbd59aae49efb82a42532df81f3bb0d2a0b91e0b9e358fb2b3ae42f7968931e9f178ab9f6a5fad4d8e0e2add523a4eb591cbc5d05653c28213929ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5990f3c954d10bedbf84ea3cba1b13f45
SHA1cf961711a8fcbb2aa163e10201812276ac8e1500
SHA256ecba2e5981fb671718646ede4d6d4d97678e4b16b21cd6e1fd84dde9d671256e
SHA5127e82c5610b18184cbcc963a32a3a9d56ccafeb63e95e8c24b68680ac7f2dc8f5bac01557f826bf14cbe8e4178ce58942afcc8f42da7894bd092bfb29989602ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59aaadbd437c18fc91ea4430bd51b9466
SHA1441c44c3ac9c4e0a4e100f377205951b2c59322d
SHA256dc012584d7e657b12ac733d0fc9688a1079c6a23c69b77c96c140bac51f34dec
SHA5129f84a6401f9e6bf4bcec1595160a1646e264088c9c469213bc8798249a60ac67bd990a4f03b1b760baedb7f7ff88221abb551c5f23a3845d32a433ab10349a7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59648bbd79c01a0c8110b51d5cd856833
SHA12f68c403da5646449b87502ecbb3906cc07e1124
SHA2566f59a44b8af3585c9e48b7e91dd10a2be4f3d16f107e29970858517e294f2976
SHA51239dd600d8530748427a8ca0673be2c2cec20121ac0cee3ace374adac5bbe05e4b65d3f1a40c63507dd8dc57e93dccfd7b5ae118c5ece01af52d4e84997bf7206
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1b55b9809585ae1a08d63a7831228fa
SHA1246a2b7a5a152caf19f9247b15e26195bc0a0ec9
SHA2569ceb4fcc3162497b5dd0eadca9e1e7bae3cf3e174a61874a170afaba27007f2e
SHA5124d24af197b8638260f18cf0905eb5d1291448041ee1ba9c565f8c4d8a8b1df9f7e85b5d555ffef705e0606d4014031fa2941296f1053eb4f77d19194507c5d8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528ae6a481d91b8ca03cb2913e9ca3a39
SHA16cf40bcf63cac12c4ce0b3068a54ecc60f650cc0
SHA2560eb11024058cef9a9fdfb1d7c30682dabd2c9fd9883c45830f9f140ee3e43125
SHA51266fc107c0407c024f26cd53dfe48b0ffa17fa083aba65b0a644ae492c5dd0269afec57d2acbe3d4ed15a10e93c20c9ef38027be066718dea7ff03e083fc35048
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5060f1fdbb377d7b7d24e7971eb34e3b1
SHA158a874f822b157f996eccd3750f5c9402132dc5f
SHA256fc1c0a11b09eab7ee42a4a1a6a0907d76fcd45d578292ee32bf93412224addeb
SHA5124c066a61828ea174d4bc12e04f5c8fb0350cbfdf1e4d4130c79b1a68ad3e9a49fc76da906fe706c3f97aa5e18234ecec3bb64c8ecc4a76f9e2b6ff632b3d4aa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597774c109006112bf130c4a195fb5c2d
SHA1014b8c78fe6c1aba3177bc685b47753b72f658ae
SHA256231eff2a198a8d6a1399e58e66d0a15f3e640078872bad5bc55971602d26c439
SHA512caaad7d9cdf802fa4e7a7f2693f7607aa0a368d1f361fa445933fa54f1206a22b8cf12a2151dc871c40897fa9ea329808d8daed59e22bedfb7a3b2219266841b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce4fa5b817d80e50b70834ec51314554
SHA1b2d6f731145838933131f164870711a6d9d75f2a
SHA256d63a3f4c3027e8f4ef7b02a582b1951fe0c8ae4335b0b6a5b330ae7aad91cca7
SHA512d6298a61852c84d12d0bcd94dcb0e4df72e8ead7e9855858fcf19e92581238829df947ea9d77eb1447d12f98bfce2ef0735833b9cbcadd48573830cc4a0f48d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53890d471e8d03651cc1a146956a70881
SHA15159d12d651e27a3b604d4701d6cef56d8464162
SHA2567b57deedb31a7eded95f7e11efb7d84bf8281c668fba7487788a7238dd2c42fd
SHA5127ff6c4e62aababb410abb977a8e82525d811d65cc54a4efeac5781b27cb2307dcc4fc14644b0d6f6b6fa90347187e0bcc74ae619dfb1723fb1bd495f490defe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a1bdb06c59937b26a42394ec667f596
SHA15ff6a53871f91e8a3a9f8c0538a09b280733833c
SHA2561b608837bdfb5d02f7db8c138f722586534569f97e81d151b52808634f5cc529
SHA512f2c24926cc5591dfc29275d271df853f4d1a0a0b06fabd619ad28c8c7c8e9deeec5e0875a6eb65c42e27094292678d215af3e39b02fe4e7a25d33a0dd02ce154
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b3823799afd3f2916117c785c2ffdf7
SHA121a110df1a8ed2628acb9c359e0ccea1e2218bee
SHA256c2e5cefa401fc15bfb9a1b203a6aa557d3e84a63393ac8d8445616fa41e38192
SHA512d23b0af485c3841f8ab696f9f7f290a3c237e312642965c372fd04a4863d4107b69d6652e02f9d73fdef0348bde5b9acb2d066f2e48955901aa3755ff3297a44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500b4f3ca9f5181ffe027ec094ee49c5c
SHA1a770c5ba3ef1857d08958081d3f626e3576e5d61
SHA256531e46d0c92618149914c01e9971da9ba69bb917b76ffecabfedbb0587fcc18f
SHA512ec23ef4d8a6fa534666f49e6896c9946af7dc25e5d15d4f7d4a157f875d32677620e67c7083c3067544af831c00599f6b2589fb60251b0f0cfd350151ba63f4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2386f757889a9f1671c01f71a94b5d7
SHA14f462815d129e489c714304ee07ba9016151ca70
SHA256684fc2e35246467a0b075aea631ac970bf606c5e38d25c789ad7e55ef8cdea28
SHA5124854f4895ee57e4dc2e855c75151d5baf006bd6a7c42bf296977dcaf894d22182ebf8edc29e53f75112de97d461f8897b7f1e8ba301c1c8269c0e405a38db249
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a