Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 03:48
Static task
static1
Behavioral task
behavioral1
Sample
37989d899adfaa167d4beaed0f592d7d_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
37989d899adfaa167d4beaed0f592d7d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
37989d899adfaa167d4beaed0f592d7d_JaffaCakes118.html
-
Size
17KB
-
MD5
37989d899adfaa167d4beaed0f592d7d
-
SHA1
94e25406a2695a556d35aef7b47d6358b51eb771
-
SHA256
c69b62b059c2d08e713722ae33d91c3ef3a1cd00538ac5583da2c4d546414c67
-
SHA512
1bfa7981e6e71b77012b78faee791a35e1934b9e81184959ac23891164ea1b94f00f840fb948b3e1e35f47145dab870dc10f31076370d2c94473f38a490e90d2
-
SSDEEP
192:AemlIsrowEtG4PVGTHFKLDP0L0+xHN2x+txOFdeUuUaVr0y8k/w1wvqP1JauBuLZ:zmlIc8tG4PVGTHZba4Qy/gbJaguLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000055316563e4e69aea9207d461ac220988319332964f5a0f74932af8470f37c80b000000000e80000000020000200000007506fae79c926cb0cd76960ff0bc04bc024e72127a90825f2bce184aa8b0139f2000000049338d7f2a628a3befa7d6827feda814bbe1c752fbf166ac0c22596300fa07da400000008aa63267495ff4ccc70a9b096133ee7af7be4db60d99762f4b8424601b5226c161de1cf0cb038a494d089db3b16724c21a29a094043b2650112000639dc3c981 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d04e8545d3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000f6c32776162e31eb54afd46fd0a57fb1075b6b67afd3dd3b661214a473caf16a000000000e8000000002000020000000b776ee70578dff386d6137e14ee298a747a261ef499aa1f262645c7b56c1fc1f90000000eebc4d5c1708843bce06c43306fc58771abbfcbc8916ed6f31484e09b2eacb7940c4a5bc30f909f5f44ebc4b4754eb5e019994c314fc90241952139e21d881d81b6bb529b034fb982b76d819a841cfba83c2f896ef4baef83d3d29eb9d25eec3c7c51bb9bd4dae75becec550f2ba7c38c5763ce5625728ede37351a157eac87770b3bd34370545c8aba5edb32c10f18440000000b821053cd82c137c5ed1635da6dcb55fef1bfb1b9d16d95bce71410d23b1cd8e0ec631d10329092e1e23c3663717f3aeb848cd6ef3fb79d84fa83cb0de9378bc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426831611" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83E0E841-3F38-11EF-9478-46FE39DD2993} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 iexplore.exe 1936 iexplore.exe 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2104 1936 iexplore.exe 30 PID 1936 wrote to memory of 2104 1936 iexplore.exe 30 PID 1936 wrote to memory of 2104 1936 iexplore.exe 30 PID 1936 wrote to memory of 2104 1936 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37989d899adfaa167d4beaed0f592d7d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de4d998d681a7cbe5fea2cff8a2d6ef9
SHA11a07f830b539656f2022e09b5fa52f0586235195
SHA256f9914267a51f03b60579a3240aba4760cf5f2571851730fe56d46f336c2f9c3c
SHA512193ff2d43430a09d98699ef6a11597f9d6a7c22b9aa77ff50f4a8dea872dee8de70963126ebfcba344d4b71b9f7b5348a07af9af4094172ddb472e9b10154de3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50750be13c9b33dd8427201048ab0b1ad
SHA1984017d9dd9bae3071361b7fa213986e2c255b61
SHA2564ee4a573d628f1b83a23d70d8d56240f635bec6c08f923d5ff0800981af9b841
SHA51276fee8cb3e2097cab89fd2ea559581264bee6d1b722cad6bc1866f3db510b44ae4bcba0c64ca66bf4f387aa9df1c689b2fdcc1cd05884d16470ac4c8864a07ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fa34da4965a28c522963304a8071286
SHA1e800905bfef5047c95404208dca1dac52e876ec0
SHA25616c50b8a1494e7b872be9478d7371ee030f4da56b557591f50168e1c94a09bf9
SHA51289d3d6c93b53b9741d514191b7f83cc6a4aa85ab298415e22bf5bd37930645d11d4bf621c8871df8eba547b4ae79dbaae3f3f6258afc8a0b1f0056936100f119
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a32c879dcb3b2f7845322a01a4ea60f
SHA1f01078fbabb7c61431e1e817468fd2745d800957
SHA256a07c8750af662623982fe81bcb5ae4b418655acd00f3673f939cad92281151ad
SHA512c4d58f77f5befeb6626f444b89be162bc3148175e8f76290dad087f4c0fe999f84bceaf2cfa4da4aaa732e20a754aca9490da8ca181ef3f5e53dec5058028e36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520d1f847a203a867a5b523719b82d696
SHA1e1bbbf5a06b92357b726b7e7d9abc83c2866ed38
SHA256dd5bb49e61b40d3fc54250147e26c2d67f087d4cced1198cd2c52fb5e2aadb96
SHA51279d0f23ec574ebd9570db764ad4b56f046de91d4b7a2db659f9bfa95fdb7f0a562f324d0293cb24a6f27efb0efb0c36ac7c25f226edb80cc022cd85f44683304
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb9d685b868e27da1cb68391e4c7974a
SHA1f5e6025ab177c74e7ac7110a86e8d3f284ba7c00
SHA256d4afa4dcdda74e3f3930e38ccedaf1a95c427a835914a26f3c459a4e4ed7c63f
SHA512dde51e8c8f6e528fbd9a988452989509fb2f2facbbc6e8930d28d35851a3bbbcf36ba233a58a37913fd89454cd5f9e0847aea3be790f87bfa330e7260b433e54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ee03795ce1996eca9ba732d87af0f58
SHA1ec5b9479806e944644fbbe07050d05278e5202ea
SHA25687adddc9fc012b44a5570e8451b95189fc21a5644ba34202e39afa3ccbb8d0c5
SHA5123b84a0eef12df8c30b6e81cae8bb4c3581deb3ac73d1985af78882ae3c909c03998397d7fd110cc6baf6236e483a6296dc34e965926cb88742dbccccebae37e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5706ee0a378dc87d157bf9936f07ba6c6
SHA19bfc30758b893c8dc794a3d6c1b69a8f42a76ab1
SHA2566e36b66abf6d1a8e7ed38dbcc8f7d042d1b519df978e0bde14be62214109273a
SHA51254ea9673ab6e3898f01a96c188f68412775808ed135e775c58e48391ec3bbdc8cd0fbac4ca876c6cb790851fb41fef1218cbf560c4bc89b531ce00c0c0aac961
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e72d2c3b038a5942496c792b8e589025
SHA15d2f4f76e2925de7fdd004a9f2a3f0e35dccf860
SHA256ba53e9e5966056a892607bb14b7c7374d446e0315aa76f9359115e6fc2a47b07
SHA512abc37f34c2a5bf55664d9539676cd64a73429b9a19142e6f8285541c8d1b6cc8752df88419e26bd7b84118623875182be30a9b8bf7d77cbf9926ba802a0a927f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bf8cc75633aa85fa10dacd97e5db3fc
SHA16f357212c16b413610095255d4fcd788fbb1c5fb
SHA2568be0e235196a22d4f5d0f18c902e9704b4ea80e6ee7b34799317b4511f311f5e
SHA51214a6ca0ba7137c95dfa8ba5b8e8b7ce8c1538abbe9a2df6e445c349e22f1676565387cc763cc1e31df5823b7bf617386d9d6e24ded3cfda8e2e260a2cb8f1891
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53eb141874dbcaeb4b26feec292a8148e
SHA1fef6dea66eb11c893f1e51aea99bc067256755fe
SHA256d154c9107c742f4a9d12d73b9b7719d7978b751c86702baef2827f853d246f52
SHA51291532b9053c74e5f1e4afba74b3237837ff68952a54fa934db959d7a0d6fb60d28f3a93dbcd0179603ba2bbbff122e57a2d008804b48bea10a70b1e8c7c7e001
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56896f54604a9451d0aba2eaeb26e6b9f
SHA1aceae8e8a548f993f679f3fad82c5205f3b92f10
SHA25633a068be2b1050cb649b7264417b9aee2b950ff6abfd6d0112b237fa589370cd
SHA512a573dabfeddce77e13df2ce2bf2459ed31fc815fb97e4f2f1b34b6d76e47cca5a6d437afdea341e4b6c499d730441f1e3bbeef39b1748152bc53dcebcf554bc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524713c987946ff3739e5020e2d76eb7e
SHA1d7f50fab25fdbe8237cf72b195fce12e2a8a97b4
SHA2564bf6100be1c7951e548342cf2848dca3dba3009f88941f9690a0a215e8ccb8a5
SHA51295e976b905a5188ca68bb1562add3ae3251f073f35d036fbf3d774447f08294c7bad1068457efadaa8bd2f3d8adffbdc9e012c9945bb17bf8f3a649c305fd5f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e50e2d51a8c7488a8dd66a7504c78722
SHA19448c4f0caba359430b3696d4ee635d4270266a1
SHA256442b6e82990be3784be4dd3f4f10ddb3d3ca305ff53d81494e4ee19427d4956d
SHA5126decea42725f32fb26c5ad44d6470835f7fe4f745c7a9ebbe5fab966a39d247515b25e7d05f17f9055f2c78c355354804d28200615e895e4f86fe4f0625493a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570f521be542bdbfd7ee1a0050b3da5de
SHA17575e003458fc130607f6215e3f663e8baba7711
SHA256137c04d2ed55f1d35213e2006e94d730b07a90eb0301bf001642c9f0decf3a52
SHA51280143f7343d5b6cbcbaaea6d23d8abcbe8da1979223a99ececad81b4bdc6533600f13c858ce4f818fa6155359f715f7bbf72ba5485a6de12baae24dea6c36edb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7d3affd05be8383d59d6d06ca0f87ad
SHA1cd34313c6f3b33b666c2b82dbe889cecf8026f33
SHA256ce1ae7cec0bda50d6862dd7912c40b989e4bafb80e70b7c53967cd0e039fde1e
SHA512bbf504ef9eb5a76d6a8fd071ab14343cf1d9d8ed00e9083775465b6315d042cf3139c6ccbe9894480b3788cda65c331785575e80ee2cf1e29762a86b442a5244
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4c056caa8111e9d9a01f192267582d8
SHA1068e872d7ec257ec996892e2b1e5e97854bb49aa
SHA256920baea2074996701be99235f1bdc3eaabba9798400fe19d3056a0c481a9a6ac
SHA5123e2f958fdf97ed3439c6dc149d4d12c3b5d5b95410dd2566d87da1c200bd9a4435ab2f235a03fb663b278922bedfa7dce4eda783a6501197416ef8ae94e9a2eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe875b97cd123b7ffe27ab6c73d1dcd4
SHA1706a17a83d4e360c9db50b6f8057f9e9feee4dda
SHA256872ad673092f08c6b2f6f359ba0a264301d7a0b03599b19c328b6d75ff62b83e
SHA512f4f6299783fd200b7c9ee594e5bf5e9c318b77f5101f26230b6527d93652858df1a5d19345a0fd4e4c30ec70785748ceb2296d822dde559f2e22caaa48d11484
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588e24d9c4c905afe0bc4244ff96c9919
SHA161881bd063e3153dfced2b0095aa925d542bcee9
SHA2562ebf14cb5170bdf6d2001fe6f143ba1ef3753586472f9744a39068e01c183a88
SHA512c65daecb8af93a2eab221508b8b084e0df4609c7615bab636f323e1b77e699b76273693aa9ad4a0c0ca62d5414b0fc14f3562dee511e594c0d53b2d6d26a39cc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b