Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 00:45
Static task
static1
Behavioral task
behavioral1
Sample
ea4767a1e6323ab592e8e3491e62373a_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea4767a1e6323ab592e8e3491e62373a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ea4767a1e6323ab592e8e3491e62373a_JaffaCakes118.html
-
Size
1KB
-
MD5
ea4767a1e6323ab592e8e3491e62373a
-
SHA1
7ea7e372335df3af16b017c16469e2624881b3e3
-
SHA256
1dcc9f54dc504ba5ee53bdd73be812245f1087fadf07737abfd708bcf4b5fb6f
-
SHA512
899740891b5766a7fde66821aa8794d53ebccba113a68f5d56ddc5fe977489643ee85b38f4ce954a6d6047371ac10f958ede02d24729174ca80820b0e6a3684c
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402da15a2d0adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83C612D1-7620-11EF-A073-FA59FB4FA467} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432868617" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc500000000002000000000010660000000100002000000014f7d303a3ea906a8d9bef59c4e66007dcee638bc99f390f9dc02f42dc50ac5b000000000e80000000020000200000006fb218e21479d23cc2a3def3c882b10964dfd05cf8a1b6b5c38cd9bde9380d1120000000acc398693a64d07b649b5919e54cc58fa2d004e7675d2a5cd826695551d20b6340000000cd7d957d3b2a208e0ad4d17df06cdc21e3e7e79914b70d1b190e5c6ebffbd8cec9a0c8e05c987d2ecdef926778a713889e0f6b2eedaf67499efe60d251c1ff73 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000002558d375a8a6d9c3542f48616a116df12f0d4e568fa31bb23b70c1094143a10a000000000e8000000002000020000000bd5548401c96987857abf86861ffe725c52e5b4fa0d7209df2de1c068038dfa19000000024a90cfc3d16064e214a4103f69c7c06893f7dd8f2a50dc04e14ec0a7eccc21f180caf5827d00daca21bc19f218c470df7fd6bf9dbf9a28da0a4085463083c7e65c3355b7916b802502052564eb3f299a770f3c01dd5aaf99dec68eb25f63e7496475b656bdf3fc37e7d0616f0b05e140829fab92272fb9503ecf34c7984851ce28433ee00e9dc225a6acd3ed89b4006400000008f0e1b0350f7858d1d83f5ed6ce13c9591a3085c518f6885f4103bb536a362fbe51017380a1c6fa1019cbdbd6ba5d95d64ebe602c4cf3c2afa29e5082b583e53 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3044 iexplore.exe 3044 iexplore.exe 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2332 3044 iexplore.exe 30 PID 3044 wrote to memory of 2332 3044 iexplore.exe 30 PID 3044 wrote to memory of 2332 3044 iexplore.exe 30 PID 3044 wrote to memory of 2332 3044 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea4767a1e6323ab592e8e3491e62373a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5922885a7a6b0259ebd13e47462defa70
SHA1042b08c1c9d839cab767a8c0d43b5878af3d9014
SHA2568c4b305fa02bf2312d674b7ddb36686f1f206dc7cc890ce978a126751649b4dc
SHA5121762b31b5331a79c176bdb836ed8b4bf35c1a99201c08c71c588456d7614477651e3a887c43e26cb80afe1ef320f80e16204188ae1e4c607c3c10be5dd39cca4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e6d8ed1a6fe2441fc078c5b1a80a4ee
SHA19b2b790b6beadc569cb79beb8f377dc678ec4fce
SHA2563f2364f415d8b7976ded5f6985815256621174c2b9f6747d03fa0b194817f473
SHA5127bbbad3e8c9c47a4dd93ca5c0f62b04537b6059efb31b57b30ab9ffd4947e4b6f22c321419ac31c57f83fc1c20360582fb67f62183d7b5e3eec1043adb5e5bd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598c3bdca90ccabe17c7957d4538e3b32
SHA1bc85afbcbc0125439c6277cdb4fc15466c040d82
SHA2566cf6d119ad134b5d61361d78b2dca2c9107705bfa088e32d94dedb738b1d03fd
SHA512b977099236d7c068113526fdfa7eeb2f2e4d1e25eee067bf21b8df04279286bbc92d41a77cf92d23a523e0e8f921735c543a4c05c987c3a4f6bf9fa21bdbdfbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e8bd52c17639949373b8658a0fad3cb
SHA19e0fa083369c25212a1cc93ae3ccef8f6aaf84d7
SHA2560dd66929e00c15749851788b118ccffc4e94b6d82e8879e31e675b4cf221960c
SHA5127c4cbeef1812080743594e460e48f51a832c595790bdfbc58fc4dfb56a73016ef244cf7ea915fbcd8594f1906bbbe69929ac02fc43ecb287ee4d7574a8e89da8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55dc68d4e0d4954145d954e852e74012f
SHA1e4d5dd7b5e76fa8bef6ea3e912fa8aed7c9d2ffb
SHA2567b2b82bcf9328c5aa52087666407cbcce08b4d3de43b5338a27fbcd6ad3fd287
SHA51299614fe8ecee0709a5469994e271b9b026163db70b659328d18a27e613764e2f11de3bf6814c8e62b597ca68a43e09cd75918b75a3fee39da9c7f41cd21410d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51fb7c23d1861f48a64cd05b8675881d3
SHA1d98b72d92b39483f85c4c66a49e8b9e807fe6b48
SHA2565daa8f1004d6f359178eadb88da86e4e58b98a012c43a445f3f43cd1369c2ad5
SHA512f7ddac88af862373d4cb449176014d38e77dcb14ba9c96b5486fb708edbc2ceb84b2135a7191adfb131703c916767b94e49f4d6e407f626b8d18ac31eef1304f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5880e7c2329d4c46254ff5eb8e4a4e217
SHA1586bac80032a3fde1b9dd480325252d71384176f
SHA2560f7eb5f7174b226bf5b85560e050bc0707e2c946ea0483c01decd2ce52bd7f3d
SHA512b8631626a477f80479b8c597b227b453a2753ff5236c6bf918fc3137e98eee3c5ee031f2440fd047a2036e6ccfc8407dcf7d0a4a98e32666f12c68f26d28e074
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf57b937abb26b9cec0fe53e880becc9
SHA1e333c969d3445a07be8ecf93d733bbe2c02e6a8b
SHA25659ae451047c8f0ecf9083a56fd46e55913eacd2877fdc6b49209296ca147d08c
SHA512678bf28e94775d3fcd8cadb1c2d10ece7e6af5c464e0bfd620d049c699af267547b9a2d9238f3a222f6082a0b89265523f5ecec045b5c7c49110c7103a26fde0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5709c384e69647094f4ce1c3cd87f1051
SHA17890778e1ded8864400c018cc12bb22b687d95ce
SHA25634fdb1569e1ff9e7e6f6293dc38dacbf2ddce537305b761805df848301f7a506
SHA512f777996b33fe534bdd2249fda094363d144ad1762eb7ee9355e8b485b68a9e1770a5de9194b85dacf404885d7eb28d77da79fa1ace7cf861d8f2f64998169e9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55406d248de5b761027975f38966a3748
SHA1067b2fe12e37dbd8dc9598792a458c6a88ee97af
SHA25631699321192193a1382ab3d90f0232188147202688691a275b4f0bd6799023eb
SHA5120803473ec5ea7aa5175768229d7ec2ed63ba6c17351ef1a3473d1f923627bf245ded4d750afd877ac39494778ca08d3caab36dec62101d5602c1d5136281ae1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55149124acac882f7031b677d809a7548
SHA19675d78abe19d17b684d18d23f3b25a2c8606fee
SHA2568b6be6fc52b9eca49ecef0a7466361c57ea74ce55059a4aa90607d261452bb1c
SHA512153a9f224f1ca7875eee61049c5b83a54f6af418116b239299ee25e9d8d6b0f52da37ac96750579e39a1853640e380cac00a7c3df5c1a7d90b950ea8d032cd63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544cfe8824dc8e72c9fe4568d03d42244
SHA126f34599115db4430d0f6fdc6a55e7b8b942c724
SHA256a555ecf282c0728eb630f8e5a7d82ec68eeabc43222f822526200cd434bbfe80
SHA5123e4e4eefb9dd4a0eab5cb56bdfe5c575f98b0de96c527f2f1a1ea3af193db43deec0600f11221ceb6863feb1167f208f8513e84fa8bf7f5f3a695053352a69e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5752db6873c7724bea9d0414cec2ce69c
SHA113a2980176248e59b0da3153fe142acc9858df6f
SHA2563ef2d67ac4a6e9cf88e5dd58b19477ecfa7495333218f1f5edff6a0a22d9b039
SHA512892481c5b63b93bb1d2c2111be8c3ddc86bac371cf4db7d81759e40c13646798665661a45870b480cbba8848872a5700864c06663dcf177ca1f0970983c9d630
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf7be8249c940e32d239ea2b4d500dd7
SHA1a109586156a915df21c303650b40bb39a719de2d
SHA256bf094af6a263b0ae37017f0190d50e3651d083b19cc0a614d774231de5a49c67
SHA512815ecb796645b2377f28258974b1acb1dc6d94842f08129ed5ec9120d024bdbbfc9119fe03f862a1b0d93793f290f47f5b12979771b03c52b061c6354632a094
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552206d58b86d042c0151e12aaf946d71
SHA124f0e2218efbdddb36564176584ffca3fbb6466a
SHA25689e63c88f3f212b8e343450f0f20a9f246cee2f07dcdfb4f76246366a9403a48
SHA5128d2da469b4ed5974a2599037988d9b42d01dd91de5627618a114de172f190ca29cc223fddde7069dfa593381c5d73cc592ccd3c1ce1c9673de14b3435fea3745
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540a4b8dcddbfe79beb2350c3f95ad217
SHA13d33b0493994dbec7846f086ac7d167bbad73f1f
SHA2562d473b3586054f7c919193fb10cf1a401bfbda2fa67208d090a20ce6b4316b0c
SHA51258caae08393e387f073d6cc9d88019c0b5a4eb2ff804999aa1de8009daefc5bd702b84c03eb9caac7f7cb17daac373df305a63e5a400e7526109dd7ca5165548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5619a95348a8e56c572d0e18a2863a788
SHA12fc325670d4e9bdee658d6ba3b9ad3d14139aaf8
SHA2569388f74b249f80420c442d2798380b78008d06a4e623c7883e3813775bf2b6bc
SHA5126bb977dbb2788c0c597673f3271bd14278a544055932cc161ba9f1bc048c973bce476d14b9211fe6cf99f75c4e30aace227f4eea60dd3192c8746782a194cf5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a0481aaf8f0a1c2c5de0edbc12a88e1
SHA1a421c3d8813294e09a6fae5b19b218aefaa5479e
SHA256a8fdb2bf0a60bacbdcad60ee23b704679ccee85ada4711f8e063070f3854f612
SHA512edfe3949c6a81394237756a16bde0fd64ee2a1a917aab66b2b811a3b5eab822f0e2f11020d4a0b6e1708579f88678107997f694ce3d062dbc5f5afb56e9c12ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52aee6f14abfaec435ce51d22b22a843b
SHA15522cebc133e63fd8840cd1b52681c0f4f793aba
SHA2565bc1c75fd4c1dbfd67a68fbc72822a440876aa1499d44db0bc33fecec4a8bbfd
SHA512dee58c6b8ef8081c9a941763466aa50c164c6efc84000d08a1bae761aab44cc9982d524f97bee4d3cbe94ab6453921075a58552bd4bd4bb32a53fee2571f50ec
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b