Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
2c6ecc750e8c9b56c4d4fbf017d7efd8_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2c6ecc750e8c9b56c4d4fbf017d7efd8_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2c6ecc750e8c9b56c4d4fbf017d7efd8_JaffaCakes118.html
-
Size
6KB
-
MD5
2c6ecc750e8c9b56c4d4fbf017d7efd8
-
SHA1
581f7cd0977657deff018f658fffec022c2ae930
-
SHA256
956818f6e3cf55125c256481b38cac1c3c9f262d823bc366a379f86b1fb93a4a
-
SHA512
30e0f14011b930979d4dc0593fa990414ec51a2b11a8b28b5e3caf1accb5a2da86f1a79c23f7432e9de0a79be5332a2d7163a411698b3de11cbb72802cecd1df
-
SSDEEP
96:uzVs+ux7GRLLY1k9o84d12ef7CSTUFZcEZ7ru7f:csz7GRAYS/Ib76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16608001-3D6C-11EF-98DB-E29800E22076} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7086ebec78d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000003895fcfeb2aed4493777dfcc0bb2e030e3915e8c4c4fe251820a150ca5efecbb000000000e8000000002000020000000a69380a066ddba021d918e3d34aa5af944a6ec4ddfc3862fc77bbfe8922786bc20000000cc7accef0c608f09c47bf20e58a4bf109e0221f9a11aab9235d52f69f3de474c400000006e1753c76c35e82b1da279121e660e68ad1672bbbb706c8da7436babfa95ded00925d80b4c893dec894aa307451e3b155ef1b15622c771eb4707bfbb8c480256 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000001a7e272ae791a4d3610e36c2cc0f550a219c427b10bcac9977ec09cf6b36ad79000000000e800000000200002000000097d1e416b5bdd977431fe37e7215847bfd742f4346cf84a808eef747a109e39090000000be3a449f438a533895919b6c625554742bc6f969246634649b7ac6d30a7d70672331c5ac2dffaee864c67b295aa3af58b0dc37fe359bb03ec848b6c992c2182e8ad50e9f5f63f54e06bbcef939782c7fe050da77115820b2c51834995fdb80466f179cd141a5930c777707ae62eb75018b544fddc78d7f946e6f29829e606fbbbe5b2221dbad412942305bb147dd9e3e400000006714fbfb33778b3e5cdf9c0efc62f084180512dcdeb110b4b16d50168a71117941afb89ba787ae9996266dea0751657f705939a19e45aea98c6513eec5e118db iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426633858" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2032 iexplore.exe 2032 iexplore.exe 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1960 2032 iexplore.exe 30 PID 2032 wrote to memory of 1960 2032 iexplore.exe 30 PID 2032 wrote to memory of 1960 2032 iexplore.exe 30 PID 2032 wrote to memory of 1960 2032 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c6ecc750e8c9b56c4d4fbf017d7efd8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9e4fefee5759433e0b0bd6ed9316065
SHA1151ba61ed0a2650cb95b802d72a3b42aaa08fba0
SHA2566a09d276a39f288fbd234d71a06dcb4cc92cd36e7aec034cac508c3796a2c7ae
SHA512985efd52dd0c9cb89e36728408a66a64825d6f8eb6503d38fb4fc65efc7f5f92daa32f7827ca5aa837b55a6b6219b5cb669f252f5f066e84af8cf1c21edc604b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc6b3b673d99342a19ae9bd5599b3df4
SHA1554a4d14e54ecf984b08af31c7b8038ff17169af
SHA25606cea90e0b51ffa2a2199dfa09596beeb41d2eedce1b62389382a530cd2a2225
SHA51281cf23e6d385b5a0fab4450a928175b45d7a149279e834759f56de7e6e25590de13978932d14cbdc75f8a24e5ff5d87c7ad676e645069de5964bab0ef83745ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d53edbf8e0ad5a41b33fc0566ba05c05
SHA19988bae27096eaea8558d7b98c0faf42abd37608
SHA256832d36df307d3c2067dd40c1441bc3236bb86f41f9dd9e675c539ef961805d91
SHA51246908787fd0c8c90429b10d37d2d71f6f3c5b0f5e80ab550cea154607203f1670483e16150470e588797f5a69c3de43cd5c10498c96a4a7f02e324a4cf21c782
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543bea54f297fa21077a7fb379e628f38
SHA1ee997adf2d47184d30e6cadb8d5b22a82753fff1
SHA256a9e60419ff8990c3f352b49f48994da04724ad9de128d213a878890aa04ecb1e
SHA5120662a8b82f22758bb2492d167ecb211a48d9c68fd3bc34dd67113151be65d8adacc7e2f817596be628ced81527455b70947e81cc69cc8fbca3ee4556b893217b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55236f1e743195539161d86c314b509bb
SHA1cf9017f350f24a60a06031d85d31ea1a62b42550
SHA2560b6c8ec03d520e75412a9524182d5c9d6fd3b74452dc33254c6ae57133b02c47
SHA512344dec9300457095f322062ffca8f9b3eeeac894b5df59df7f2a6cfd04ead387e2552914f803bb591f2e35e364f2ece519eda765fb6087175b34af4f83d1010a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a53c24d5ad77f744edbc7b1ce15c8e80
SHA107723273ec77120c7dd4fc0f6f66c27ba3bebef5
SHA2565a4fc6f21925db1005732f7e2aeaec1711765cae2370dad5e2de8990cb33eed1
SHA512a7fca5722abb5e5d8110511b1dc20ba6fe464ef1b698e9ed1b169c0a5457068d80fc70d748b0add2c3de2516c134f07696f836b27a410d669b7b7a47a1092c70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2516c98a33a761cc41825402feb4638
SHA14c0190269e10eeb2895b6fefa576c4a9a12e9772
SHA2566c6c546a1a56d5b9a5f3b93f9bf8d56f30cc1dfeefda52f3c43f64dd29b0b37e
SHA512448f75a4e051c708ef002f2793695fac0705b09d1bd2a32f875157b50be77b33531a0205742b7ffaa53e9ad2bfc3cda99199c162dabdec2fdd2dc9cd863677e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8a5f9a3eebaee5d378b5f0609c6d49f
SHA1acb2b17cde761d36a353249a6ae2582301b2e64e
SHA256240be757cc3c7e90b6985cf522cd60f4c28c1f3f61a0b1c8356b65eecf9f6901
SHA512d745203696817bf5b4aa294207a05282388a1874e901d030212a8d438030d2c52656a652be50da48e558537105ed7df6535dec3c2bdc333eed412c1e971621f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f14a83de969eb783b55bd3a3927789a7
SHA1f8c1ab0f02b3d2925e2cd4262ba2d3ac0cc130ea
SHA256749b4c069c0f9d7ef6dce1b696b9709e607adac20594e0476f8186facc2ec360
SHA51271eb6af6659b1132eab2d5361ea8e89cce1c3c21e5cb48a42a505eb680e8f5a34e0c8ca4f9bdd76c8bf1b0ee087ff2d239089c6bb2f14886c036371878566b3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dde9b46661468787b379944d477a7b4b
SHA13c0d92a990cf6a9f96d6477505554949ef4bf1b7
SHA256f44c1060d3526be033f8c5a5d37b5318c60b1d6cc4bbaf7fad3ffb66c98cea35
SHA512ca3b9ae58c79c0d08efb254078b122a606baf67bb18524bb8a529331c63b1fa67968e97cccfb8ca421c61ed256eff437d648fab24bcdaacf59ba492090d48abc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57db4f4e7f46c15595bd2b4c5975ceb20
SHA14ccbdab9eccc706ddd6cf2f11ea84315181b8970
SHA2567d77f3ab6f12b65087cb3dc311d2033fdf5b9e9e1443064fb56dd69d7b30a24b
SHA512c6799325706a409116bf2febcaf646020e87ee1ce72feda8e4ac33b44369269f36804e678cbad720c99a8370a0c251c1240bbe2a5b81b7ba7ebc968b34cfdfb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc8d1f923d59e57f151894a3ea7f8317
SHA1efa44e9b722714828fd0a9c546fbf66a630e8254
SHA2566732b7318f91beeae8eaecbe61e8629be13fcf1b4fd0ade52d7f470434818fc7
SHA5121eef9c78925690e72425f141211ee523329c17676c5c016e79dfb6a990fd2a6fefef379e28ef0aae6c15f09380b9e7367590e50c6b0004481da9646163ccfd4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e80314f1a1a2583fe8e42b404f38fbb2
SHA115b7bf7deb890f31e658ad72f60f14748ea3ca2b
SHA256936cce15388afbdb6b395d22595f092f3c37cd36d59b48ff0483808f7610a545
SHA51224064dce505845626f5d0d3679ff2aa9aaf863484007e5d5e0a96e7d1558aedddbeddc3371fcda0886ebaf81f3a41d0cec939a64c860b60a1194584c1fda6d47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562aa2f2815c13f42f4564db1dcc065de
SHA1ab87e2121955bc88f521b11d141e16b6e93adfd7
SHA2567a25d40302214a3c555871903c190f8d0242179647b94b5f04606c144efcc7ac
SHA5123c60c9b98a2a7abb905248c55a920dfbd2ae3fcd1ec29596753f1685ff64940637cdbec4c70acccd413eedcede522570ea7c684878f7f3ed84d5255c9296ba1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e236c0f95895394e5797faee3a22840d
SHA180b9411e451601b237ffac716aaf788b3cad7db2
SHA2566f18ab066d9db3b339e3c843dab215688fc4fca63c3fe69f7ce6a63fc5a70ff7
SHA512c153cb5ed61e00a5a2811037be3241cecf6b7453056fe41718712e3a5927286aa91e0502dc2bd0ce8033fd4e28befb7806f51c92db79c7d6589d9559cabd6a2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5668aa863f9b22f4ec1605bde64cbeaa9
SHA16734c5accb2ff0ef419ae4c55c275cb1e4def7ff
SHA256e1c432b9bd3d5a87e4181b03c68c97faf0bd10575f34db89ffe34c4cd6181a1a
SHA5129777af3ef1acdcd64b15715bd743fbd1ed7cd9e085c0e882873c81712de6e50515849acf491bd8ca7436b70f4dadf60e056827f8c2900dfb172213569dcb282c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ff98db1561439c4a08accd59afc41a0
SHA178c1a50eae39c5b5e455369fffa67d9ee5be7814
SHA256a228d29dbb54c1b1d8b3e5d167afe0f8139db7b234cbf8520cc2e69bee991ef2
SHA5123a7cedd25cdaa893619fc433da68c5b5ce90badccf70d9a571385f19a4653952a7ad9b968001052e03aaddcca7ce58f8f29ffde8966c328abcd28eb8f45d2a3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585650c3784277455b9f6ce4d14a2f9fa
SHA14cfc645cfb92855f12c456469223924517c335a8
SHA25686245fdc99b7ccc1aea1f0d226d21246e2bb2d5bf7ffe833d59b8813faa59d6b
SHA5126f184439b9cd1754f2d0cdb80ccec66c1741190c1e15153cb165118c68b68a64348a919d35dec687e9d40cc6b2349aa2b2c5668934c7aa499065a17c602a0382
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e0e9be72e8198c743d5eaf5eeb3f160
SHA18a2b108fccb990d419f4686571ef87c78c843fe4
SHA256700eed8998de262871c95677487efc9ec7e5f0a1ca645e4aab45c0bccb69ad4a
SHA512f996e3a97f4c8ba0751de356eb3a5a79316f30104ab1bed041466f805352e0e7091985a8e199ddc32a1f35ed7d3bc33b88e23892b06766a143e3db46cfcd2797
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b