Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 06:54
Static task
static1
Behavioral task
behavioral1
Sample
7c14645209cfce6b3ee822fb50a951b5_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7c14645209cfce6b3ee822fb50a951b5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7c14645209cfce6b3ee822fb50a951b5_JaffaCakes118.html
-
Size
4KB
-
MD5
7c14645209cfce6b3ee822fb50a951b5
-
SHA1
ee0bedc18284d96f3e79cc819d9635c6583f6bec
-
SHA256
603effade3c272f1c888d33ea2af2929d9bf920697a8b07e800ba3dbb5a39122
-
SHA512
bfa523b251dbe629be570cca7c1692047f9b33df743fbcaaa6eda1751949cd35cfc46a1de9988d1c08529862ce1b180655fd25d03d7a2940f0d2b8ea4606acd2
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8otk+7wd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD7
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0344feacbb0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003d60996f2c16164bb4d146b9ed866b21000000000200000000001066000000010000200000005c6cbaf198f17c6136b2f83178959be2efa6b594e3db03569fa4a996e9992306000000000e8000000002000020000000b4f27b4f33b76084bf0b7e1644cfe1466d973725645b0a07f7e5b2c23e80760f20000000b1c557aa70f22fe26466e98c18acf5d8dc1b893ba13c5ca0f9d2194410623fb340000000699bd33a20a192f7dbea065cf724ceb4d373d220f2787b98ee54177a32d8b2817e3c90a24a1adb22064e2df0a66c50d912d689099c75ad6ef3d822500706845b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003d60996f2c16164bb4d146b9ed866b2100000000020000000000106600000001000020000000182ffb90b362c804fba06dfc284199556b26e0931ac2579cfd7ee5c587ef6ae1000000000e80000000020000200000004ab103b3687df52424208d4b0e242c2ba6c16f547fd292cce2ee2597823a58569000000072508d2df1b51b6442fb8e259bd7542a4c51aa74634cd3807f32d00b915027e82e7e3ad356f07d9be1dd89d967d966e9a78130e2a92a07f1486e86f6ee8fdb7d0d93c689e2c6127989222122e079d0c10e96b57b12e0e6decee47917b2e837e6635d29da4de68c89634aee70307f4bb38592691415dca2a635a53a117d92a1dcaf4631b1309a233df4797e161af792fa40000000498d7a33e43e3f7c8a3b75f5317ff99d727e84f47eed0c30cae2df1315f4cf8672ad4b1c3497e9050f369e70c00e4ccd61295debd4d84c3474fe082fbc224c07 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423041118" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15E26301-1CBF-11EF-82B1-CE167E742B8D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2480 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2480 iexplore.exe 2480 iexplore.exe 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2968 2480 iexplore.exe 28 PID 2480 wrote to memory of 2968 2480 iexplore.exe 28 PID 2480 wrote to memory of 2968 2480 iexplore.exe 28 PID 2480 wrote to memory of 2968 2480 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c14645209cfce6b3ee822fb50a951b5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4ca5dc02bdc24d205047f9244909d35
SHA149247675ca6cd2a3e34a438c4e24cad6f2cadd40
SHA25684916c587a4f0e5e65bcad0467fef3655cfb48d32e2e4b191ff072ae54f34d14
SHA51200a8eb4885a413bc3124d74b173036efabdc7eec7c85d0f498f6a41618baaca3c1dfa3698569ac4e40046f36e33ce0d2b7ce33400c92706830a7121d592efdd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537f40d35783aa57b01b6c775cb86703d
SHA102ed126b3a8f4a4ee4418159cf02a3cdf164388a
SHA2560b8c20ff294a84766d674369fa851eb85fc870b5aa30a5bf1ca7fa4559d09a3c
SHA512d59fcc29775f34cea4a672c8fc53e1673c8c2c15892126ae2a32000f174f10ff3ba8ef8e2346760a51885e48170d4b6bfc9b107c1eab6fc1ba4f5c63db398fc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1e5eb3d0d943a8bb25fe4b2fcf3797b
SHA1088e12af965bc55bec4dde77e6e987a295492efe
SHA256d848134a3085bf75868b505940c45c5447569c1e4ae3353669372db0a4a230d6
SHA51275146828497f938fef4fade4682b55cca17fb4d5b33921b7ab43a4de498dca1fc0750c8874d6a8ab3cb2762f60522bd11ff3daee6ffcdc17b77faf96a6fdf2e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553783297e26d188d0e5bcbfce00dfc22
SHA1c18b95abd7dd7d7d51bc1aa214bb21eb3e187db3
SHA256625c528de0bdcb4cc42e42594f210a793974a6721aad721b59abf2407d9789fb
SHA512a5a38f5ab981025e9f0dc814cb5e14dc8c051ce0a1e9efbecba262dc4e5b71f62c1f7882154b3e39f9464eef7dcf90e7a9e73ac9eca8bb9558141d614e182ba5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5202f3f4612949f77044b393e7499c7ba
SHA1f18bc92861dddb4437969a52a40a8fbb6e838a82
SHA256b56765d78dacafe48028c200b6a7ca2da36edd4cf31c66a0c4f0d372116a3ee3
SHA512f74c7e40e3553a6efdc0ca664fdb4b2cf05ac18a3757741ea3d169dcab7b6b890d14cf6d3d38d8fa54a7bc1e5de22af3ed90efb99cab9f2a0af23852c28b4f3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec9a5706d0981963054059be31afef21
SHA1d5af7509939fc410b26417188ad926f71b57ca86
SHA256a9cc6c1ffc492288b74cdf50102b4c780be7415fcb6c6cace5d3f0b8c79f8a29
SHA51213257fe1158d4b40556a83ba3e64e760e0ceca98507b3906ec4e77fb599af89f7c16933a4d81653371c04c780dc378cf0416fb27f4af482655d7910e0f4ec233
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bb1f97bb36d6866324a20accb2acada
SHA12e05a7ebcc53cb16999a4a1340fec9d31956efcf
SHA256dfe764a47e1f63fb56cba13eebc0f3cb815072ed526442a545a63419a72c4389
SHA5129321f404188bf7ac1cf50270cfce200c210cd52a7340a9213e72fe7730a0ca5dcf6355cfe9625c7444e2fc3dc4522bc8465d379d67edee889bfe6f8232020ab4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53628b3743b0473764e61d078ddfb4068
SHA1c59f112549e1df13bd87a792406c3fc913be6bcb
SHA256a4d28d14d30a7c16a0e3a3df2f964afc6fdb5c5efbca199069263c1db1be5d79
SHA512df9bedc9e3f6d4cad836cdd8666a029fa3534668866e4d573f7d071c1ef0f05ee6caf5e2f3d0e829b91172caf340ef1c22d8335ea93ad16229cc4c71fbece754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5556957664c6ec8b95b08d592e6b3e25d
SHA13a55eb5fcd9488417b43ee995e03669a5db862e5
SHA256be6722a2534c6ae860b8a8f8fa3c221cf1207e0c727511fcfdff116dc1ccdeda
SHA512d8db39f1af153ca155ef6f9e1efa578e97b543d69c425dcc03bc3043e3ac1254d8a61af15ad5fb5dceafc50e5af08b74a8aec98ffa2e3970e4ddca361b28a4b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7349e19fdc2aca05e9bd27073496151
SHA1fd9dc6ad3e13f9cb4316da356d7429b5a188dcb7
SHA2569d7d3f2059515b634906ef7e1ff90ec4e66192a1b611a87db4df26c15b8227e8
SHA512786b5e43913268173e073f4359d067e3ff73a4de8baea334128a986e3a4879b665d17d6047573e6b1fb573361151e5e790cc389db3bac194082117dfdccebbf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5546fef271033cd3ffa8e9c0280061c7b
SHA19bb3466fff3d7ed3dbf9edd20d3b393916f16960
SHA256325df627ffc5eeb6961c5e353818383177d76ebc17b06e772db1feec982af699
SHA512754a468ece473e708fc533b3b3204d37ef28af7522386845fbd82c1e1ae4c9744f0396781fa7b436acddf5ae1559a740cfb85638bec5f2fafa3ca2050cfc640e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a17d996f70970f4b885a6c051b10e1c2
SHA17b41ecbe2dcdf190bc38b070dc418667ce53f2e4
SHA2564dfbad2e338bca2e6fe3b3898e86a1d2937d43f871641f771854a771e6a1cf2f
SHA5128a8f83b099ac59b7de7176933e73b25cc56f08606edd70cb8b407463d386cfbaa2769a9cf2fd5e87d3ba6a4fde801eb7107ad846c0a3414fb4b2ed47aa4dc6a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d553a3c81577f5a593fbd3d0e310f3a
SHA19f1f137a35a91350de504305f97a30746fa95fa4
SHA25600353542d2f8e58069dd432e8d2ad31f016ece6a6ae5f0f1bd06f12c7c47a97a
SHA512f3ec45b12da18165678f730c2b69c9161c2ca8f2ecd6511048304f275c3f504c1815599230dc4007dcc2b08e8b8c4935a69e61951ef78be805858027d38a78ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5daab708f15f35d994e1d9c4497d25072
SHA15fe3748349336f05ff340a1afaf640dd18371b7e
SHA25654a06bcffc44ea8ff7c357f61ec9a5c40231dbc591ad1a507e6cf54d099c153c
SHA512af9d2f656b214d3ca116e4d4f7b8f6fb811095edbe00c2e2145dd032f93723fdab3028104832d0b5b2d60b58cbdef9a8bbc78f7dec7ad6cf197106ffd102a566
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a70df23bbe3f3efdf67d3cf960d30331
SHA1512ba668d1de8e45fd04e812399e99edfc18bf69
SHA2568eb024c403928cc26a3231d6002a305badd1a9c8ee4e1a1a72ff8b703a4ccab0
SHA5129680699b42d6507ee2e24ae0b719824edf020925b5f75264f44bd873cc1ac2a63ed311f89d78623f4d66d1b815f0d33454978fedf320a4c8bb954b28f90e9b75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517d0d08e22bac2bd6555e80a5bcdaeb4
SHA1efd876fc641790d773d3a152d93bc5ca1c756f20
SHA256428bb9aab373db748bf973bf17347a1fc570d6585de479512b63f5ba84bf6ce6
SHA512de248764c5be418d32d579b8ae1a4a257262578687ed593669d1f7ae63692cc574573086d46af33181c4c2b2f93d829b6b42c1327dea5628acba2a06025a6664
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3ad5f57c6fd44a8cabf8880692f065a
SHA1738003a0375555b95dbeebfbe9b066ac945fa56a
SHA256f1f21461717deddb9e7957222b60cbdff4d28005c0bd1b93892aed2fc0044a1e
SHA5120a7e537ac193bb4f37ec0d46863992cb3ac4125ae2b9daeb479a97a9c42106931464a9ad3a5bf5d10d2a09367e0fae69ba703883c57bd63f801d90328ae0a1d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfc8f0438044c162cb2a2285855aceb8
SHA171c0f7bd1d523e272b51de7a1242ee483ab857ed
SHA256ac163e9389d3fd1688889dee4909b6a850ac621c6677ba7aca68d9c7aa89135f
SHA5124e0735ace5e172f587ced3ad7d6b2f87deaad391debcb6a945c7dcead07ffd7b301ddef44c8e102d5b8a23f783004c9cf656b1aaccc26fdb143677b05f9f3334
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a