Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 01:22
Static task
static1
Behavioral task
behavioral1
Sample
43f3800edc41a2f8fd110abbe0d4aaa9_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
43f3800edc41a2f8fd110abbe0d4aaa9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
43f3800edc41a2f8fd110abbe0d4aaa9_JaffaCakes118.html
-
Size
462KB
-
MD5
43f3800edc41a2f8fd110abbe0d4aaa9
-
SHA1
681431bec462a5a75fcdd912b1d7e368b2e3b7fe
-
SHA256
29e8f5afb66b4a72212bafc1108eb72d442ddbef92bc33f9e8a8019aa141caf5
-
SHA512
c36c08f1cdcad81a15925ec18975de047d0e4b78df0f7c95c7a9c7c86705cbeca5c1b0587030e2db33319b8e46807c01ab9055f6092dd2afb81afb77db42fb65
-
SSDEEP
6144:SusMYod+X3oI+YJsMYod+X3oI+Y45sMYod+X3oI+YLsMYod+X3oI+YQ:X5d+X3f5d+X3Q5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000069f200f7d2dba52f90d3ab03265bfe9a2b3e6a207f028a5291bd669fe72c6050000000000e80000000020000200000008f44397fab0789909fc33751392afd5fae3ec0c5e98707e024a8a28fe3b6d64b900000001f772f3c959476f2caf91665d20dcfb74626a25ee7778cdc6235cdac9885750d4f9491b9a959d8c74a485126de968f649652c654dd3b719052bdbdb578162a45b7f80a67da45b917ffaf07c2fae95c30527c4d70b3cdc7a1408412bd1e677fc79323e6e4a485fec75ba1baef67fafd3d81ecfb742bc9ae2a882265a9fa4872c42784de6ad55c3a21c15a0707cdecaa7940000000d23d40afe9f97c765c79987951c0ed2e4c51fadda0c85c5258ae27f202e8bbfa33ff4eb11d5ed508177695fb1c97a175e297dbb558c8947fd64c997553a5ed18 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421898044" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A94A9F61-1259-11EF-BADF-D62CE60191A1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000009ce17839410f5750cbe80a45a968d01cad614c72e26daf88761548f45b831cab000000000e8000000002000020000000ec227fcffd55f65fe314fd21231c68a65c8276d9b872efff97d6f6fa7ff0e63b20000000572e353e1350ea835536f20c4fed420f4ad353f2455916c2d0e95e465a34c4b14000000004a15ab099eabbffde072316520b7664359c7a765b074a6419e81cc9a4e49c48dc769dbd20110ceb929a0894803ecfe17d43cdf17563905180145d9411d3b14c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3048d68166a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1284 iexplore.exe 1284 iexplore.exe 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1996 1284 iexplore.exe 28 PID 1284 wrote to memory of 1996 1284 iexplore.exe 28 PID 1284 wrote to memory of 1996 1284 iexplore.exe 28 PID 1284 wrote to memory of 1996 1284 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43f3800edc41a2f8fd110abbe0d4aaa9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a17496126ae0f932d3b519686d8d1ee2
SHA1acb18f38e6ebf3a9e4b0d61a059bc1bddbbea675
SHA25693a5251ee63b27bd991b54f5348a84b1a31a985deb619cff2c742c1fac53ef69
SHA51214e66a3a02252a49d0578e5e226d1a646ec93343aa575ea1b8cb6baa0d89a7b47a6a3480b78edf0bbdbad79cdc66f3851cf858f7a88b64a0a6f5666e76e4053d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b83fe63e531143fc666631679e4b5f15
SHA122fb353fc6bddfea01beb17783275d1983a5d30e
SHA256998dd45b1df469de584c08b797a5b70a65a67fe2bd835934a015fb91d0f090f3
SHA512648f9109cf08292551208e5846dfcd8c5e11a06e77b40f0e767eecd485aa76d2117fe6442be262450bcf6598a705901f557bd4671a0975def96b7609fce5939d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b67829fa6462cae2cb98ddc4ac25320
SHA11ec524f335ecc8f35a236b1c16279417b1197a7f
SHA256ebbf0176ff98a411e36583b34624865fa8c8a144c1db8e7ae41b6f7fc18520f2
SHA512eb0a4f8777a3f11c176d83b2e3d1f7f1b35920c2048b2156fbdc2363ca6a8ec5172da21c6caf996edf2bc17ed04d564f205c661dc2872d1a51839b85435c7387
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598855be86e380217362ee9382388af50
SHA159cfc52c1d707f6d3d5b4ac0258026c04446a753
SHA2564e8a0d419fac71752997b2f48a0d3ca3980fd6995c904e98813029a75d28380c
SHA512e46cff76b2858ab32c85a5f4586e6efde3e28097ec5f4b6f8bab4fd2af985e89e30b3e3de4301dfa00a12955e9c88451971f5f81ee6938417453a81856cc6eaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d86cf70af0c193c3c834d485471092d
SHA11fa3dede68d9f7c9a39bb48beefadb11cec9f402
SHA256f9935cde5e76307b893ad638f6ce6e728c1840d9fc81712ea8eca9788bdfb1de
SHA512f039f73bca8bc2b125f5216926fab46de34e62707eef60558987e2fe267c7c7aa8d9552212f3afbf2f69e93d8ebe925ce6109f0932f3c5d11b8aa48782f6c9c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a615e69b31824c69210a2d4f62c89b9
SHA1323832be88b465c606a2d0a836ee97b73d38ba32
SHA256981a8a1079df40311eaca054d663ae6a63acaedea87d34f33f718203b3eb8756
SHA5122b3e338b33f190ea2a62642fd21b3d550a6a28bf33c280b07d7c25eee9bdf08dd070833d956faaccfcc94cd69177acdf56e68dbbcdf1256492d165cce8102eac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598d4c2a4043aa0db5eb6cd9f20105b53
SHA15d54c2bb2a4f23bf39d494a848f505eb975b76b0
SHA2560ead69163224b4fa004a9d969092ec70a28feff1692ffd4d85b3f1bf94f453af
SHA512dcc96dcc404404f7870ecad2e8e7d44c6e1f66b9b24fe313036d22cc6c309eee9cacfacebac51228e2dd0d849d896ff80bda8f55c3e66be72ba4f60605f8ca31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cd538d84fe678be59b34eb6a4c87c84
SHA1fa52c5020ae4941399789e07d82b180fd5695323
SHA256e8883b52268109e1566a9ad0596c857baf156bf6fd1e28a71b872fa1e18d8659
SHA5125ba1cdaf1d3f9a91073fd1e82d9eb5bf1f235981dae9aa45237050e14ae1ade266619f82df66c32c7130e8bfc35ebd1b2b518c6b55837345aaa43958da391a45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556e2d2add3925de36d3127868cd0f846
SHA1b5ec26c8d3a5da40ede8bc4ae9d9b62a03eb240d
SHA256754f86714e660a41906ab5c428b88ce664ffc9ab021c2056d1f5c915aa1b5b9b
SHA512805d95b762501039ea51597c0cc09a4a8baa89249eeef7f9b0bbe6b14ace4446c4009eded5932bb1419ec48b870bf6f2f7d0ef31826bee62b2202ef67da60619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b6f4d91770c4d55eaa82944751fa601
SHA1a366180b324932ae04a456bb72873457752f1da6
SHA256cbe8da1dd9b6af73c9e6c8e2b8900510c81b414b304d1bd27f6377c47f407889
SHA5124a04036a7533033465792e97ec266157e18477622bb98c229efa73b4f175dbf3cd37ae858ce74c180cef1fd81b406cd17d2f4e69bf24e61fc9392707b314cf39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528eb84bf7ce68289b517e41c147562df
SHA11d855e2d5a790cc1d22011ff8620935ae5c06b48
SHA256f433ebaa111a2a5eb29fea88ba4bb2742d6ab9340e77124c59df779b5b7a36c8
SHA5129a95a17f226a905b7ef425b6e3b2a282f30175ec93bb0f616acdf0265fb65d4da9aa96d2e29e25002c8f3c6c3ac9f393b0446cb7b6877ade2af92879ae4b7ce9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5413a6907df233b1dfbc7563f1f04959e
SHA17250f35bde65fb438bd2da3f3d4d0dac2c8ae5c8
SHA256ec4f1ba437b989a2816c51fab4038159e87f8da6a58fa45ccbb8f6172fdf738c
SHA51244e4d56dbe1d32f32ced10e6ab359bd2ab3f4b7fcc273973ba42dcd1dd6e28e2c8ad2a70bcd5d3400a387541bc783c6dcdc30015fd3ed816a18cecd9db12111d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e268fc4d57ae5c63e63175b372aab10
SHA1e6376165871080ccdbe6eb30394d877f4743ad3f
SHA256bc5c9172e0057011971ee00899cd4374906e75b64bc989fee5ffbb71edec1669
SHA5121f36fd8445b975f647e681f15260f391086d1e8a6fd7d719d02823e456e465c6f28f1ab871a52c4ffd992caced3860613a39684dc965cbbbc34066b1d0256656
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d48f07282bf6259473fa6d14dc21a86
SHA14201b27f4d77917b73dad10c52ec52891a84506a
SHA256b98e575df829fa90986b3373cec5ac722bbff8d5db5eca6af5e452fc0643a47a
SHA512696bba8069547796356f9474bd75bf49fe521c913bb1de9def45f0d083d8cbbfb8fd0c082487c5274b2451e1820bd944c2878f1653f07d13df83bc658a369516
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5693c8553c8a7a1d9a9ee6e0ce0177864
SHA1527124f4e5cdb4ef60fd8d26b4b9708f6330fa5e
SHA256d10a97e7c918ad0dea27691e944bab8941bdb89c16236139d269a9f6743252fd
SHA512416e28ef058a1d76147e2d5856ddc78a3c3c9a3e9eb91128193880a0cab13768ca58c517016df7017b8292657a92671f2ad8e4c145f086925960dc17e5e1730f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d14447e8cbecac23f702fa011e12df91
SHA1a5dc24ff5e3c61e32e681da3402e7f4550d5cc30
SHA2563d46f0140ecc6e9f2e2232c8e7e0c1dcc305cde848dcbfd836fc3f1780861927
SHA51231b45e71a16844f4a9f5f9c903a98c2fb0de9ccd8f98125d95e927c9e9e3d998afa13ca33332849cf8a4e702f6ac5dddb228a5f8b7e69c93bd81f4555dc1f713
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511fbb7fcb5c402500e46165984c71a75
SHA11c4cb98ab44943e3da63463ee44f286c723e3764
SHA256515491994e12dbf3cbb273221d5b5c09eb5ead0cecb7e8d674c686b3da127aba
SHA512897592c9d33034f58f4d444ae9bbcd056b086c82a48017bc0f591bf08818d8b3755d06c2621bb3237d8b00e151cc88b00e9f8caa98cf361424cdaa36cf6ac80e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52de13f7c1e711e0ff101b42f5d841d86
SHA125a6754aed06834c7d565eb7bd06578cfdce155d
SHA2560e0e2486d8957f625c20ef10f8c35d666ad97a284b06bcc33865bf7c869a7bbf
SHA51212607beaa0d5e5b416fb929e3b37c4291f48d80a0f89dc424ebe13644e7641af5163997d48ea5d9dfc91513e4097d113d9f437bee4f91552c86db24d8bf73236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e98c5282180dbb60dbf1bf940be3fed3
SHA1be0bd26abe04bb163434e4c2bbc8df7089c048ef
SHA2568bdc9163bfea7ed27d3de08232d3ee3a1481ed4fbbab82ad38a58cd4f8dcc7b1
SHA512e1428543aafd23572b4b0b486bebdfe684c0b3205f526a0b0f32ce858039222fbde803f803d17269c540bb02c2fc971216855d35a3ba4451fb7e5a44b6c735a1
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a