Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 15:24
Static task
static1
Behavioral task
behavioral1
Sample
2a9b6e3f6ecad8c0f0593c668123f713_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2a9b6e3f6ecad8c0f0593c668123f713_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2a9b6e3f6ecad8c0f0593c668123f713_JaffaCakes118.html
-
Size
460KB
-
MD5
2a9b6e3f6ecad8c0f0593c668123f713
-
SHA1
0f72c1122fd33b902505f965a4c30ddd50cf7a6f
-
SHA256
2524f94b23bd0578ebdb3836b99bd890b7b6abc4dd15a68e65e015a6eb4b4f62
-
SHA512
0b2fea8d6cacbb954d8185cacacbc3264c91e0912ebdbf1f9c43c135d5c67b342689c39615a57489a9c9b45cfe8408c5d3e2f9d9c859876cdfb480275ce96895
-
SSDEEP
6144:SDsMYod+X3oI+YxsMYod+X3oI+YqsMYod+X3oI+YLsMYod+X3oI+YQ:Y5d+X3H5d+X3G5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000001ac25e10fbbd06fe5bc266ec15d4bd688d7a212272fbacec02b43d57bd48f8cc000000000e8000000002000020000000ab807408b7e7d3b1b3cac82e2fccd44be7a1b9ab62fd3ae23cbfe9d1e0f7235090000000d3d959a0e103d2a628ca8cc3d87621e42ec9bcdc941f28e4ed5d1b274f60f0158020b374221b7e859ea4a7a93ae2c95804fe9e8f3efa74e7efe5dcd14c326b9bd88647aeeb475ba936964755af448298053aecce6dbda850e5418261e3286d01cda835962737e5668ce9d5138d99e89c608eca4d0d3bb2742450283b5e7baf5914463664bb792c22204464086ac9b2d540000000d69a413962643b179741003a839c7f4b878e6e921a16e8fc5542284bbe478359082f1f020e1f4620a59e94e4f3fb6bd91badadddfa2d70722c755f7c3c8e345f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000eafa580580ee54a96f01376b162ebc5289f510dd16a7e6980c1e72275c6c59f1000000000e8000000002000020000000c4047339274b8acb111530735e0b18770531e721adda893778396eaad1c9169e20000000b616147da71ad9f8fec15697c7f2dfa0a7bf3612c0352f5547ba0b0e1a992e3440000000cdb5801e85fea9dd45f5bd196bb4c6a28222cfbfb04549bddeb84ae57a12b4b52883ff3120d8df8b437fad9781f64cc82e1291dba8fef7530641665c82a767c6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50832b0825a2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421430118" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2FA47E01-0E18-11EF-B082-427DDB91FD53} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2008 iexplore.exe 2008 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2700 2008 iexplore.exe 28 PID 2008 wrote to memory of 2700 2008 iexplore.exe 28 PID 2008 wrote to memory of 2700 2008 iexplore.exe 28 PID 2008 wrote to memory of 2700 2008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a9b6e3f6ecad8c0f0593c668123f713_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af01d226dca07e9871237ea75d2d90e9
SHA1ac87387bfa20c35bca9e0f022a2cf00fb8dc5f47
SHA256ab4bbb993e40012e18c423669ba3100838a078b7938b220417d7f7bff9e9e163
SHA5129fb40d746dfe513f02db8e3974204815f7eaee2cee7af0c1b91d9a765508d4c46298c197f75566696ad1be65d9ab26f261289b1653d8e15148d585fccb8abd6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf22c356e0aa1679a6dfbd919d88cb28
SHA1f790386ed34878e6002ad0dad44f3723ab8b2b7f
SHA2569ac20d3cf8b729f3d2bf886479b2ea43be2fc7ad6f82f38e9200dc6e8600ae1a
SHA512f2228a1e0c251560f6cf29cea23b6546ece759b3abb0b8cdd0f8adbf714e9a0346872536108ec299f6b3bd9e56c4a2b067e377591bfe3d1320642d165dca328b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b129eae70d2d1fd27d945a7759bc3564
SHA143b3b1bef86378b27a1c56bc4e3823c8a12950ee
SHA25670555c94329ab61a5122c3a0cced70b2a21814851c7c1b3d844e884706cee01e
SHA5128a5b5225d3236f1b0fc4127d23a57d2465fddd0f5231488f8e70ff6205fac03eb6a538ea2e6bbbd97cc5958fc6a59154155730b1830f4c6b9ec175c4c79904db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5656aa25c798ab53e0cdb8873aaec16bb
SHA1a397b1b44e6009519133557c379aea923049c0fb
SHA256cccd8669e51d344404445e328bb17fde04388c41dbc94f4fcae081a6b83eaf07
SHA512f045aaf45767faa2134ad0a51a1973991fdcaa02f621e5397e5810c7b774daff90a46784b55abd602f36bba7ec869f07e5f79b6cf97a0170b654c39684739a8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e8c258afc8b5d3183abff0298ee911d
SHA1305d412590ad55334a064ddec65a9c71d92766e6
SHA256449f8a5f90bd7fad112d301ce3b3d33aa86919488db1eca86131db1109e75224
SHA51210c8831854a122b4a1aa2fbe61b8dcbfa2c7285ed0d7992ab6cbb34091dcadd7c5320f14807e08ed2fb922c655153167fb51dd0641be5948357d667113ba5b93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cce6c1293a60979f6835f7eb33b185e8
SHA13b514318e299b1db3d480828bfba841037127fe6
SHA256bb63e7dbb6ebc297684e4db4eb995da055b1106d2af2fefc578a0219793e2256
SHA512f761cd5c8cdeda08d492c88d1dd9f59ff9146f23f93548c0dddb0e5cfd33316e2a9b0b9b24a928e6b092062d143a0112a86d39b284db97c46dba85af7673210a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd7041fff80b4bb5e857b54c8ef6a1ad
SHA1d70e3eda3bc2bdaf6d02349486a736c9d0b49525
SHA256758616f8891b5e8391bf7d4f85959e7602cc7e73b13fcd3c58e5bd92839b708c
SHA5129450f82a354f4450c49ea8efe7297ddd730687a964357c5937c81f5bd48b7b4deb3ef668e679a557d5c8c4ae4e03a4a830bb77c8b2ab00b73ef7afd335b8924a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9d4cd265a7a0fc67900d9c96e986890
SHA15004e26264ac1b236adad40db7b4ac0167e3c6a1
SHA256860b4a8c23fa1ae9754cc7d168a8855315534d9659a9c9d39213a917538ad94c
SHA51255f2b68160a898e8bb5bc110651feef08116f06ed8f29e3d89195f3f7750861c76e2d74a27910d11ab388ea39a59db65af7c944027851ffaf643c70850431137
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e00a227750cb79309324a137a1686d68
SHA1ab0006b04e30af5a85f79784ff200d7d0e38f570
SHA25612c69c7a5b2ce5a0e5cd4f799bccf46d3057b58de3df1b5aabf5dd2784407d6f
SHA512fb1d14676d723e3474204bae3f2ae2b73d0055895677eff608c1ded8d9de2d43ee3e4b427c51ecdd66fa4f4b6b064b99fe38390ab9897b5742f8f110eeeafe6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f595b861cbb6d48d84efc032c4ce521
SHA1d6aef6be7da8b01b6334ddf8f216ad386e338e49
SHA25612c412dea38fa4678b0c0bb277e720d7ad3c581af76bb3857ab340ab433f646a
SHA512c1f2e9fd9d1f82ae86dbe3e17bab13c74468fdbb89b53f56a4be29cdfce4af367b05c28e21dbfef8cd88e20624a7bb5b5c7d15308eab09086837110850fa91e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cba0acc2ec268d8c793102b83115874e
SHA126c68e332a98d72a34ac3324e04dfb0c7a524e6e
SHA2562b4a08d93f13f9cf69e8b0818da4317cd89ef5bbb6ecf463ffb2a446ce260927
SHA512387f74348d2fa87564a8bf14394fdc7595ebc9c200324b6f7483c5145f00d0ee68f927e0d227fc0d8351ff43f2a1e58c4a685fbf07be14a8165b175ad355f70b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ff83ad6fb279b4791d7bc478759eb50
SHA13f77ae15caeeb574039d0125b0b152e1ba225867
SHA25694896783fc6238b2ab9218320ad87a8c11c783e8068c29de5d9a819ba5dd6832
SHA512ba8c2d19a93216811197c0f4d0bd1e33b7888964d3811d5f67436c77e9d513778fed4a2793ec2d8607bdc51f94bb9550ffab65b33f05888ac9a4df02e01eba71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591b322af69420f4d5e9a448de7c6ad7d
SHA1d471ca63788beec2f1de5bee4b0e8f517cb1bbaf
SHA256210e6f5d033479f8ceca96a380f5742db7edd8d69d9b8ea1e66dc83807b12989
SHA5127b4705ba57bb8c43565ecb204654e9d054bdb9d680ed4c8560bcb0f9f9c3000049a838044f2e125bea7567633dd21f752070229fa8b4519d4de4a2b82393b7ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eed2cef870996d08cf2685cc4f4317b9
SHA194094e4914ca9b5c682872c3ecd463d535705e44
SHA256f9bf7c75db1e1e8494ecf3afff9bf39ec1fcc3cdd393b2a0cbdff59f40520fc8
SHA5127bef2fde8e16800ff86a3153cc5a2c79b3ba53f1b726460651fe499c9ddb208ffd2acc62dc5b17abfaf9d6cc559225475fdc67fb60dc247c7d3f1d21d169f743
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52aaa53db50b2f7e4d81009005a13a09a
SHA14bd87d335694e02ddcefb99f2a652d074e30bf30
SHA2565ec1f3f17f559e734ce38c8af8a8d4cee3b9baff74fd77c54554cce1a46d20cb
SHA51257cfceab5dd3d43e7bc2bb0699b2c7c6fd0dc9fd01eab8641773f4372e63969c1f18f87102fcbded53ef487b77e4d68cee17c404be94e62ef7d73e0d31942ad7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aee6f523cc6910d2a302f5da5a8ddfd5
SHA114d63facef1ef6d9353b83e2142d6d8a8c2a34df
SHA256f8771b6989090e0f6701e85698d9e99f961aac5ba62e75cadff0c677f7a5eb74
SHA5122710770e7b2bfa68c7c7e23cfb4f07a94bf1185929fdb1001ba10b600a0e2e33c301d9c73a476bc5b198c87dd4015b240ac446f43b04c96b3d6e2b4e45ccf7de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591e0dd67efa37cf9d63b250568c7b977
SHA19999c740ee1018d4280ecbc4c70e0d2bc641c589
SHA256d50883be7df5c4746921e31b68c49649c2ed23cde90ca377fdc1e2bb95066d1c
SHA512ddc15088e8ffe294032dae9b5c19216be996db02e7291835021831105f299e7094fdd4dffd12028887b6b4481fca029a84874343b7595095afdc24809be68537
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d49dcd64feb1dfd6971290399aba227
SHA14b4bd001502a14bc8bece078bb5810b0782c8309
SHA256a73dde00043ceffaae36a6b1d5d8262b26dbf7cb1f5a4105d881233f1e08fdea
SHA512b5572b314c0020868322d7b7d945791910e14b9089bd21795851f93b677f9820dcb2696c1461e8db2d5d6ada22b951dcb85d8f8e9bfc93e2bcb3bd45ca562bab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a844d0497d7f22a8dd17892f255c0c6c
SHA13e6053ae2a8837d7b1b60428a586a5650cfcf90e
SHA256ba4a272b8346e9fb0246b298359f9d4c1860be959811c312e3d398003036629e
SHA5126441b6a5e56e4f4148538817c4c5770e4e7b8a0946f5c69e6ce0376ca76eb8e311ce5b63e54baf5266d7b3661dd046834729be67462702dd425853140ac12b89
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a