Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 05:52
Static task
static1
Behavioral task
behavioral1
Sample
ad113dfa85d9cd2f65ce19a75e3c6ee6_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ad113dfa85d9cd2f65ce19a75e3c6ee6_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
ad113dfa85d9cd2f65ce19a75e3c6ee6_JaffaCakes118.html
-
Size
461KB
-
MD5
ad113dfa85d9cd2f65ce19a75e3c6ee6
-
SHA1
70ed91611fd65290b1bb77d3510aba62ff7a39a7
-
SHA256
7c43f42a4ca2e2c2613e75f481ca1b94d65e67dab72d759c036b97d54a7ad72d
-
SHA512
7d79fa36081512f9439afa9857d8742e205c74dffed9f08f76a1607ea74bdcf0d2b2367ecbf44be9d4bdbadd02ab68ae9f31930059b84f0072af174ba5f09cc5
-
SSDEEP
6144:SAsMYod+X3oI+Y19QysMYod+X3oI+YvLsMYod+X3oI+YLsMYod+X3oI+YQ:95d+X3F5d+X3J5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c5894fe8beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000027b3ff306c17f48e0bcb5847766f802e876e1cccb6ee4c60e29106981b354193000000000e8000000002000020000000c81a3ea0a513e08355b39f86394f7d8d44e8204dca1b51b58d70f4192b9b0096900000004c2cd6f7a6d8923bf5cd15900090b625a410645057ac28af4a6b297f73b97feb444e22859c26ccbad5ed252e06b6e8297b564e7ef0394039a9524eff1949e9b86ef1a5e0cd6f599542b0bc7d907733f6614bc1d09d7bad80c8d95486699078b0d4bdef19cf90952ac61978888057ceaa2fa5984d16372246b3934035acd89977626188ce6a9ec5a7b630f4480ca178e3400000007e8cfb73eaa81ff0437d246e5be7f75cdde797b7bd940a2c8fb59f6d31925e5fd2167a45e641eeef3d5ce717db8ffe7496a321e73d261cc4a5ad42271ae92b8a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424592623" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77030DE1-2ADB-11EF-B93A-F6C75F509EE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000c511c2268e5af4932077a6873aeabf4559bbca20f8fff816cd7e5977b07ec064000000000e8000000002000020000000e500c796ffe5d9f1610f67cb3768191dcc2ba8227ab623c88f318908627d7d9f20000000dd788496d5fa1ef5c74fd81a0f0d2a723e38a450dd39119e296dd045d805d95b40000000bc176a5754af94b395aa4ac67802be2b8ae49df4127b93cd3224a9e5201cebb4b2edbd2beed7e23e502c1159424974ce1253d2f46474bd21582507d37a22354f iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 3060 2116 iexplore.exe 28 PID 2116 wrote to memory of 3060 2116 iexplore.exe 28 PID 2116 wrote to memory of 3060 2116 iexplore.exe 28 PID 2116 wrote to memory of 3060 2116 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad113dfa85d9cd2f65ce19a75e3c6ee6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dc3691cf585ce40639fe5656b01f39a
SHA106088ff476cb1b174712bd8a86a119000c2cfc79
SHA256102732be5a3bd03a143789a2eb30f15385308f5e55b311150b4f91e01044296c
SHA5128e6306425febf0a58ba3eedf641a2381de10a47d88909ea00a92090736a36e85e13029844bb21f1a761a755932559adf3406c948bef2814d6492188a0fbf2cd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53466f02355a53e7e545658b857517b0f
SHA1acb7343df497d0b5d2da638a9e8ee4c1bd7fbdfe
SHA256049e77885ec34273366cf31eff57883726d309847c55b4ce2442babb2b51cad5
SHA512a064004de9c914df699456492bed088d74a20d1299e6d1e91598068ec7d6a46a770afdc90108e5a8a639a2faadeaf7d92e86b1f01859013caad15db4e841f063
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbb0ec84e4f4f61fd4f84be39ca018ba
SHA11811b222a04629b793ed8a6b4c6dcafc127e2259
SHA2569ff53d6ed95a8150a3385d30be392889f8a017d23f97020cd04a9e92c39cb6ac
SHA512124d858fadc07fac9f87d45149b249fd530d8b44c2e74c37320b788328ea8435eb35f63e666ab70486c8f0f6c856cf6f38d3a2471cd34c7bf34efb0b7f24967b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5730de173db209a3195d5cbd087fb1969
SHA193053182ca5e92357444b483f9a2dba076712b61
SHA2568036c202814a6bf09d753b54718f27e8b6a06736fae723ad041fa8acd658966c
SHA5128bc91a33652374963bcc57c19fa0fe645d88c12b80911e3689b04ea00eb4ec4608172b6dbf5c669cd92ac5d3a165df21af5fcb385c36c3463c8b82b336b7ceb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1cbe0c630f00e254d903914d6f95a27
SHA1107427be8ba3cf3d2a2674a3b224c2331c6db1a5
SHA256c52fa060d100146a518c4eb6ce54bb8323756925bf37c1390797ef65779a2058
SHA51207bb49a81fef6800f4c6d432976d1542840911ea41534567e39061cabfc485d144c9dff4d2392ff6c313b898e4f87469d31a3d531005fa5fdb0bdcb7e3f21cbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516896dd1c06cd9db1acb2fe7ef8beb8d
SHA11a19b9df29c0e253bf068de458dd707a34c64175
SHA2564a7c38b403d0b80becfbf69cbaf17004569b26e2c8940dbb9bcbd93752fac28d
SHA5123631c9074282d9855ba1987c9eec82e7449b8bea27374426dcc667e4a26daef09d2ab0cf5ac0e89a127bafa2a388d38c35e17b421176c58cecedd16fec2a3a4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ccd89e81e702829f3bc7e724ec9e0ba
SHA1c2b515ead917aa3780bbfa6ed8b68076628d8998
SHA25650cd18e7319d67884fd2927abd9b1db1994ac37f694bf4b4c7f58dc6a11883a4
SHA512193c63837962ff28bfd960627664289b192c427501dfe60b2d6e497681ead4778cd146f5371b6c7b5c26932b38c3e63705fd9807fd15d12a7b9e0146d928e340
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526becc38cea396623045d8834eae4306
SHA1c5b3f1af181a139d19f5a655e2e2dd03bd78c397
SHA2564507bdf036901125eb4e17da38f1b8be4a004c172ed0ec6bdd6eb62289f3474a
SHA512099520e272efb9bcb62034ef3ffeb6b118232eefae848d42c913c0e61121c28a7b77f2c31199c28b1d32eccc6ace3010ff06e9fb4e494e1aae07a715b275312a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c4beb41ee707842a31f978cdd40e0a4
SHA1d20a41aa62e7a6709102058b6bef571764b7275c
SHA25634f22d118373a34279b5cadec008af30aca1d89d7cf7cb18b7f33c924e27d323
SHA51276479c31d3108a761f93224dbc8840de584628fb6474e5e5e43a4464336eda42572cf820d4a90ca50103a3f1ffe7dc247b3a62614c65af24844efb575e9ac5cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e78a9f65dcd7ae337595f5d645a637e
SHA1c8e7aa5d2438e328fbe3a99a1a8e3c41a2905023
SHA2560ea955a926c527822898ef7ef5f9013e18ee4458c6985cfe543ccd508cbc8b17
SHA5122fc2f06e630bff78dcb9eaea82738d2d5c46cf0e8e5168c19d5daaa7c7f0ac5dc535744ebb1a430cda4e430ac1f68850b7e22e829c8846ff86af29b9a31d90e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581a39b6627e38753c12f51d033b13aa5
SHA1a2fde96a782a9ff7b68931612cfd553887a5c916
SHA2565b2b7e880ecac2e02d6f4068ad311bdd9216af9146d044e335699a661846dda4
SHA512dbd6ac643fb216326bae3dfedd591dccf7ae5569bf70658076d23ceccc96d84d98194d69289fa50cb8594a8754ac3523d4987287763cf407fb24c6d7b0c2c730
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea778601f4b0427de59538b86b52faac
SHA1ff48de88522b45cbe5da52aaebff4d00adf3f0c6
SHA256d70a7f6a4172c8458bd5e79b55736ae0551432cd8ce06544d86da9132a6722dc
SHA51205ca16fa7655205682c5d1db2bbbc6c181e0ef5c606755aa9adafc3d5b8e696744a0b4e8b1ee7703a2c8c6ce80a9d19e1efd7c40e51978ab0b47cb9cf36a02c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500d4bc50bb0575d41ec7b53575c75650
SHA1d385a7958811ba14d7b52e61e04132bc5486f104
SHA256d45c4afc15fc615f2b6e87430a1fcc56b458dd8b5543c4cadc7a871e26ba110e
SHA512fd74467df44dd09157b9a0b154ec5809ddc08e907f72c34f1e1c65ed9bb4e0976bc79416b4f296be534060616127dd2508d24a7e63e8c4bd782647dcbfcda141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5528796a89ebdd55606cb47eba11be96d
SHA197bdaa385210e0b9f8fa23eda5359deb44b377a0
SHA256197fc2981d6a239a6a8fc2f4161883f2f6b20f8eeeba9a89fc8d43cb874f777c
SHA512a93fba10bfe4e191d95dc5d270973c8754ae53e7f389d0b6b6b69f6b076788f2ff6c68341d5ba44e2cd4492dc8a77f547f967d26806c0f36d1b8ad86680862a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594455be31d214ceace89f3d081d9fa23
SHA1b627d8142165cc9e12aadabac105bf40f235b7aa
SHA256dbee4a83b48b370b24ef679bcf18188dd0be7732be224ba391555973a1ede41d
SHA5128962d9ba3eab588833e627adf9ce86a53106e6d62f1011a891b29a97ce6417e0349297d0d0da021040edc2c935184ab190eee3ea8ef8906dd4bba4fdbcfb655c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53372e65176182a12006c479d0e462ca9
SHA12d365c96dd2624f8c677c9735a4e009635a28e2d
SHA25643ceb2c29bb2b9c3c8f91a3d086d9c5702ef1723c621ebfefee8c8f766be2026
SHA512d12522c431956aa3cdbc54a22c5511c541b0df243eae9120a3e01949f3a061b732041969e61ab39bfda6ad356bffeb8a9ac6d19d09739f2227a6b7370a7ddba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573bec9160e5102fc8c6c7b9e8a282fa6
SHA17acb5afb1e345dde2f21fb5d4e407124d1a2c452
SHA2568bf7f9fdbc9e9b379809573d8be8f0fab6a670467424324e7be5197994a44f99
SHA5124b49fbfd0633dac7309948792c724ef66b31df5ebe75196ace6ed78bf0ecbe67c6aa10c803ef915411d633c95210ed693503688127ab56983aedd53057de2307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e16ebfdf6faf593aee2b0eaa2e63e718
SHA1e3d8f67cd2e51645a4374685d22c5255e02dd99f
SHA256ee8c2a5457f91b0b479c9f8525b295b843768f852362d975257eebf109e11031
SHA5126d0c6bd99cbbd25be5e69de85e42a8b04030bcffdc9c33b4db10e84c2a70083d5c65729305102eaf64eef8e93a735f990cc5a56ee99fba3182285c9f0ac22e35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5420639c431b736ef0ac775c8d5910c78
SHA1b441dbd33cf361ce557e92bd436f421e53d78c25
SHA256c0cf5b036dbc71f364917529cea99d29407d7104757f9d66bfac02cf9c9e7a76
SHA512d2b1cb2a97b839397cf9b4a1759cd5af48180ddcb72aa9e0875c67a834a8698640c28a42223df925c7c5bef93f62c2e4fa57eab9680e9ab435eb30f98eaa2760
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b