Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 10:16
Static task
static1
Behavioral task
behavioral1
Sample
1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe
-
Size
11.0MB
-
MD5
1245085f62bf86866aabda07b1571e66
-
SHA1
fd38a9466f2bccfd4dd4f369f8193dad7e98600a
-
SHA256
d7520ea2598f8f4c8e00c07b649c195aa811d47a471c47a971c692988180e892
-
SHA512
5a3aa6bbac27f596f58fee6f218f418bcb57f660721553199381d79b4fc863fab49a71a5ae3ec39264ed83f86bccda7bc1a41d7d61a52c547428ff2cb12d38d1
-
SSDEEP
196608:f9Grhc9G2hohbUyJanVj9taZeUFtpW6u7HSbZqktxr0zQc2wxUiBebgOvjl:FGrhyG2hohQyJiXtattpW6ubSbYkt5OE
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 3008 MsiExec.exe 3008 MsiExec.exe 3008 MsiExec.exe 3008 MsiExec.exe 3008 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\M: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\T: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\Q: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\S: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\Z: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\Y: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\K: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\X: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\V: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\O: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\R: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\U: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\L: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\N: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\P: 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2408 msiexec.exe Token: SeTakeOwnershipPrivilege 2408 msiexec.exe Token: SeSecurityPrivilege 2408 msiexec.exe Token: SeCreateTokenPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeLockMemoryPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeMachineAccountPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeTcbPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeSecurityPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeLoadDriverPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeSystemProfilePrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeSystemtimePrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeBackupPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeRestorePrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeShutdownPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeDebugPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeAuditPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeUndockPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeSyncAgentPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeEnableDelegationPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeManageVolumePrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeImpersonatePrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeCreateTokenPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeLockMemoryPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeMachineAccountPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeTcbPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeSecurityPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeLoadDriverPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeSystemProfilePrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeSystemtimePrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeBackupPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeRestorePrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeShutdownPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeDebugPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeAuditPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeUndockPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeSyncAgentPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeEnableDelegationPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeManageVolumePrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeImpersonatePrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeCreateTokenPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe Token: SeLockMemoryPrivilege 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3028 1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2408 wrote to memory of 3008 2408 msiexec.exe 29 PID 2408 wrote to memory of 3008 2408 msiexec.exe 29 PID 2408 wrote to memory of 3008 2408 msiexec.exe 29 PID 2408 wrote to memory of 3008 2408 msiexec.exe 29 PID 2408 wrote to memory of 3008 2408 msiexec.exe 29 PID 2408 wrote to memory of 3008 2408 msiexec.exe 29 PID 2408 wrote to memory of 3008 2408 msiexec.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1245085f62bf86866aabda07b1571e66_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3028
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 57D08CE98954DC5E8ADF7443DD99A7C0 C2⤵
- Loads dropped DLL
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
886KB
MD516833d30bb20361ee3a177e99ee63e88
SHA1420142ca317d757f8eb2e5cf09e57544d31474f6
SHA25618ec1de7a8191de24151d6517def4a45817e339b1cf485065abc0303073f00ba
SHA512753f08053f3c379c656ef0019ca5943d376b38e54c1ec5c24373ae7af6d677dc9a405e3b54ed14f656b2afc4a1ed48dd9a6dadea6f321f5c092ae3326bb74579
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
14KB
MD53f4243fd51a3d9dbaf81f4fc712a67ea
SHA1f0e86f29b54379810b40b61829fc20e674913eee
SHA256c60da07a8edc7d37234b1a7e6af21d88ef5302bdf8c33bd45cff6b15b0599ff5
SHA5122984e977fedaead6b164bfd77affa4607be22fa585dd1f8534d7f2548edc7efb0906cb40280b7f22f9a1688c2ed88c71c3a216b25c532589e330cb8cf5ee9222
-
Filesize
91KB
MD5e82cfcfc5b1e271bb0ea368ee0697cc7
SHA1d8904f05ae4447b6bbb23466d73186abc5ff4db0
SHA256adee901de613487edd9c80d199340875bd1faed7b999eee452e6b136865bca28
SHA512964738a62a85ef52e8cd16c54bfe85a8e24f614c26d4809ddc153276b2012de475e3011c98f59f5dd37e60f0f9e9da4c8b1df5c2c34224a9dc1bf714febd040c
-
Filesize
297KB
MD5510f289eef8c9f856466e58796553029
SHA1a1a7a7b96fa2b087b2e2152bffd0a84557b807e1
SHA256cf8d8ad4abe18a60292083867749793ea40d274664abd49d3acf2ba9a305e7a0
SHA512e66292583d165e68bb02a6fca55041d1079a5b18805ac357d749f4cc6f9a9cd2456866366b3d2dd297695db858c572789e6a73654d73a73caae047efc4b4fcf6
