Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 10:00
Static task
static1
Behavioral task
behavioral1
Sample
3ceacd97915d5f3cac09944736303ee9_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3ceacd97915d5f3cac09944736303ee9_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3ceacd97915d5f3cac09944736303ee9_JaffaCakes118.html
-
Size
15KB
-
MD5
3ceacd97915d5f3cac09944736303ee9
-
SHA1
e5bc22e870021d8120cc769026cff6e0ed481796
-
SHA256
98677097660780f311acb4e7b31830d1d58cda7c16df5c71ca35dd89794a172e
-
SHA512
f26a6504ab5d24a1a2e1e0ef5823bac7b856d30c56ccddfd85caf132495a84c7ab29be28918fb006fa360c4ddb0d0728cf1781ec78cf364fa6347848f9dcfc95
-
SSDEEP
192:Tugp/aEKRX5kh6S7ns7g72w6Gg+zBv1J97We//z4bhdX/6d+/WNF1NF1dtyEK1m9:5DsMSucup8jo
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e50c5c42d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426940279" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87821BB1-4035-11EF-AFD4-EE88FE214989} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000c3335e1731223889af6329daf1df51c150df334fd8c1244c4520594d12f60897000000000e800000000200002000000024d32f54c549b7ca007a63f390f8cf1a97b81882f307314118f84369ceb9841390000000037055826fe55ae3ca36ceb3b91d3086457176d6107c760f002480f1fa85510c4eae6e0197647b4bdb649fb31495e74bfdca145efedf3d7ea82687979238bf9abd5236fc34a9d67030fcda519d56363d8cfd3cbf2d0a31641663171dae7eae5fb3a994bb478facc61422c35cff0d713836c7b4b891533ce774085aee97a396a004709851d447f9378a294fa85aa1a2cd4000000099219f57902e5e3d035ad868a68a71bca7e5d6405515690943cd08780ec3f3407d087d57c9dd7b6967b03ea34079ff586ecb5a1930c122224d03a4e81270bfb8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000ede08dc218cd3a2c9a601a5cb831bf2b5d50541303fce9ffb0f018dad217353b000000000e8000000002000020000000dde458e4b5a727f0a342d0c38638c151691e6562e1152f6e4db7914ce05843b0200000009e8ecb65a9deb7b9c595eacf871a3d57a5080074aac0865bb3e8ddd550885ebf4000000049e1d5c656f7f150b2dbdb43aae8a197e17b562ef0a447c7a4d04816eca1a07ef1355d6221afc28153bf2552c70bbb0ab56e4f9b31c42719b86472a14ba93e31 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2516 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2516 iexplore.exe 2516 iexplore.exe 2160 IEXPLORE.EXE 2160 IEXPLORE.EXE 2160 IEXPLORE.EXE 2160 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2160 2516 iexplore.exe 30 PID 2516 wrote to memory of 2160 2516 iexplore.exe 30 PID 2516 wrote to memory of 2160 2516 iexplore.exe 30 PID 2516 wrote to memory of 2160 2516 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ceacd97915d5f3cac09944736303ee9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52088b3b7ec92eaf1f081f6bdbc1c8efe
SHA100022dd5bf159b4e3f334c199aa43a8cf6d21e4d
SHA2567ffac2a654b36681b5f005598eff38eb0395dcc4bba17ce20c1676ac5fd6c167
SHA51263eb6c0d8a683a836292e42d4172e2b0e1da4efe769334041d81d88d9e88263fc29fb8a719758ace4cbb9cbdb0619c792bca6132d73bc35933fcc1b2dcfddfe0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52238d9b67111491bc88e32e09d1deb3f
SHA196c75ad89a17e2137c66993e2e0a5e1773709598
SHA2568232e922f638cfd5572edd0b8ae3c89dd8473abee0f6e798123b2f8412b095f7
SHA51207cf0e844c529e5226c1ac84744ce7fb3db43d05e3d57875f70531b3fc5df5bdd2cfe7d88e6d6c0e74dd53d5801479f705608808bb3894c6d37d6aaa66f73b8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db0b3c26a965ffcd869ca47028db6a69
SHA13b0e5e6371332e835367cba0742640257f319efd
SHA256f1fe90d38a33f7839830312073380608a4a7ab0531b2b5c796b30d935e6e1123
SHA512b580ad97b1f632819372fb310fe279c6952692d5072e39fe2d19fdd9ab6110a5c016a80d1d361542bb7dcee1e03d012b5dd32475a74defb97e539fc764194e89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55542e7c5973a82ffce86689349e0d293
SHA1f27082a0a38c2cbbfacca99800e96a93606f4a2b
SHA25606ebfcfce4bbf55037209873e4f28a9be31d9ed03d664c28f8ae72d5ca90fb77
SHA5128bf83f05a238d84e1e40aa45eac438884f3c1f2d59b6c25cde8ebd573fbb588aef46ed4661017c7a6d5a1fc164d90d8339c1f59ae648975cc0d55d0414407423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f180f9e0612fbbebe59cb22fd983d2d0
SHA10a4d611b4a2dcf4fa6a6ae32ac3a16489b626a34
SHA2562727ef0878d7927648b6efe8833453f5771c84e1a22d7a702a6aa31790a79aba
SHA51201c0ea47906d8935e2cef3641597faae261f545e3b88c2b37463e03101c5d9717fcac666589815c38a9c3c1dcd9a7000025f5ddd7a476efc1fead7f2673c7033
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aee45458c109ae48466f37399a50f462
SHA1370c3bd08ee0b0693bbccac56b92d5cdf78db7c5
SHA25654a24db5d2aedf7308381210cbcb8da0c242ad2e2cd9a0a762bbc38110a3032e
SHA5124243043b76695dff6470104f96177ea800c6433c185a594014aaad7e499ddc2e7e8914fdc6c8b458b3c8ad39b021e71e1a1f2b5beba0c887736673eb5379e887
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe2c434276d76c06e09cc45b44b0a6de
SHA1fc680fd1bcdec799ef1b4eb1fe429573815fb743
SHA256f8e8eb5b77d55545c12808bd037dfe23399314dc4cb3f9c320ea17900f5f1cb0
SHA512e724e7d685e540e7474754623ec4513d9e282f356d5be7f5e677782d42483f166a64f50cd3da542ca48494dbd8a7eb4bd68306fe11f69840183afb4979a8cefb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e12951be94deeb54db32fb87152eb30
SHA176f6d7cfba8a4778b43fd625d9c77d49351ed218
SHA2567f349197464b717b9f110f44e948085de99c08586e0041fa4366b0b85bc6c65e
SHA512a5f10e4c6214e10cfc956bcb073bb464fcce4143a6d89f2bf8a84192dbcfdeb507bf5886cf8a2e364f59b80401355033f5cbe6e953025269d205a37e9b14f829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556680cba4c5bd0d39ce417930a7b0653
SHA158e0979ad990b320d35e2699622ace4190108a81
SHA25689c944b8b2cd15a8c0fea78206ffd0dec99e83e3487404152800c96f8c2bb0ff
SHA512ddb66b6ec85cfaa0691cbf36cd25d094033f943f24b7dbedab02156638b20485401be579a14408f1282d1058f60fe320e6cd4c71b5e81e1fa40c34f4e4daa2e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5532de6ec3e2fd5a87054542892196e02
SHA1a2a4f92a8d10e3cd33106273eca821fa09087856
SHA256b5c1dae54ba5dd6d8441f51317d07c2a754faaf7ae861921264021f4d119f6a6
SHA512de38bf492e2895cbbafb14ed1ed9671e9d243fd83bb319e00aa69265c445967885e036532b29cdffdb197cf995a47f3600fcc15f07c326aba05f7d09f9eb870f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50211ef462ad6321086404de1c2271893
SHA16071317010645f7670e6d5fcd9acb00021b3cf62
SHA2569a71eb5589111fb70bae3f78362cc56739b169c05e40781305ed832930a01200
SHA51250cea6c68c210ef47dc11beed150bd8c103480f3b7af1fa77c1c0466e590722fd4f646c2ecd1015697b02949fa9fc8eaedda2b216e86634f930d374717eb8a9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2275896662e408f6604390133b7e1f6
SHA10da2086e75235c429964347c841b263c99637c73
SHA2568a76d5b78591407507e736f94de6b8b2bb264d06a9ceb83e0759e699cfe0f5df
SHA512fbf9af4cc44c39aade38745753c748e7c37f828899f5c7fdb3d3b3c35ebe55e17b93fca7fb1ac615c59867c24b000ffbbafab0c1d6f8709a161e9be207b0f6f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6e5ba06c7e8c445c3a5796f30a406ef
SHA1b51d6d24a445a9f8f52bea8dfd0224856c5f2a27
SHA256d402a458b3b2d0556c3d4121fb53554d6675bcf6058bfe21c167a18dbe64b681
SHA51293f6e45a6816f43f661bfe81c6eda848bf8b79dee02005fba7a874203a487c730cd16ebf9a878cacc524ef02d62c6cd3093e194b3ad8c07b6a91d6cee8a05b1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b80d87f252354b005c04cdc6b2704f7
SHA1f082051cf5e749d4bc7a444447f1f0acdb85512e
SHA256b2f9b3940b7790f10a03bb779cd87d86ac5cd82a11bb6a8454495a8bb5a5fa85
SHA512f6200de64438c1eb8c344bae618bb4bd800bbfb5cb2868856fc5f3c18758465ac396ed229a8fb02d3f7a6b09335081620df5d7480512ba987c2d9b03f5282967
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553e47e7e73413e0ec2970bafd40bb407
SHA1c5da23c7cf9e64297ba0e2f247fd09112e6f9ab8
SHA2562b1c2d14fa06cb35ca9d0b72b8e50dde70b35c342b2036abebb04d3a576eb6ae
SHA512dde81ac659bd63301303b7605891b164be49402d11ad9bb880406e2aa8ef933c9844596a1a8633e853b60a48b3121577f2b3ad5ac6109785934177175ce18e29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588068248e78a7b7687cb24102ae9df7b
SHA1ca18fd27dfcbb8083fa6775f582f6cb2583429fa
SHA256bd249334797b24a3e3cf51a09dcfe106e672d776391d8c15186212983d10bdb4
SHA51295357c592481c25ce1051b0da316cd8fdae0d3cc40a953c0f8ca4e4ba8c07aa480d09f6f6ec8a977c7c347be175a521f688e3412b6715d1f4b9149875b33c506
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ff16e1ed7b5c5797eeff876ce79d675
SHA15654ba3de49a3dd35f5e1124fd686214ac3a6449
SHA25607975dd64c40e4f772a19d56e42b6800dcf75d11af8c3f930782c7222e48f2b3
SHA512692be01ca9c3c25f68fdd227fdda34271d3a3b493fd7e566a2922610c2d30c61da1167ee5f13cbc75426f2d73783bdd9cf98792ff8c6e72eb531d2256b97defd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590a88b5cc97256f2435c1f897f76f4fc
SHA1893ef76309d75d25c3990312b277f1c70ab25eb4
SHA2567e1ad2e0b215e211960f8a961ddaba896e87949241e65c17320159bfb437981a
SHA512ed586cd43e84528cec3e56a70b1244c2dc3cd2177a9c82f8b74171cbaacdd4eea7aac78e2eec2f1b80bac225495c43d9a1e9b33db9b1a2c8e62d5a4f55b19a31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebdb828c3cf30711f452e1c4bbf97e27
SHA1b8a6c2b6dcf969079f07b0bc48d7caee937f3a15
SHA2562af88992b920806d4a95c243df96640a5172c30c8330fea88439ffbb1de4fa5c
SHA51215f48048c97fe87d509c8232bddda2110e702bc3e09474462c403228486a19c3374c44652f5e8ec93ad778216faff55bcfabea7fb65bf1441b67af4d559f334c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b