Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
4cc7472bec43445c510cea31b15f4b35_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4cc7472bec43445c510cea31b15f4b35_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4cc7472bec43445c510cea31b15f4b35_JaffaCakes118.html
-
Size
506KB
-
MD5
4cc7472bec43445c510cea31b15f4b35
-
SHA1
4fd04929b3b89dccb622122bba4a0e85f2f6a169
-
SHA256
4b0c03ad03f3eadfb8dab53493a71a0bf34ba297841421bbbd9e1efe687e3f96
-
SHA512
4eb75b6fde774393ffc430dbbd214a5527e4500b17feb693a601e0e5cdb8fb7ea7cfdd7e06a3f17d1dac96fa375a83d6f66532a9c01b438ee7887dd15bd6267a
-
SSDEEP
3072:wG+IpBxYUVR9zfs49PwVeL5AfPTmBcM2mq519:wG+IpBxS4tLuj
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422051046" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E467F6A1-13BD-11EF-B2C4-6A55B5C6A64E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2836 2208 iexplore.exe 28 PID 2208 wrote to memory of 2836 2208 iexplore.exe 28 PID 2208 wrote to memory of 2836 2208 iexplore.exe 28 PID 2208 wrote to memory of 2836 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4cc7472bec43445c510cea31b15f4b35_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5c385b784ab9ca816e84a497ed6ae04cc
SHA1ebf2dba7c1f1425116a8ff8b73eab06fc4e47a7a
SHA2568b1eaa18dd169f3513c85869aca04c1a469ce3351e81bb54ea0fde5c80396566
SHA51219bf0214112ce18c9f804d386a9d306b5e77479cb863dfd9eb90ce16ab7eab9dd2aa490e82b99df81ddcde41525eff5c4997c912ea0d85db589c2121e3db0718
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_F82FCC341F124F6AC9D153F6ECE89FFA
Filesize472B
MD5aac1cb21b008d9123d20af0b7780af9e
SHA103ebe1acbdba8cf3f338cae923180b3fa6f0d3eb
SHA2569d8867434f5b5ded7bca965106fe1d6acec871ce25e0a08a567f1c87c530dc68
SHA5122bd393a31c3ba2986677ab931e21e458a5bc5b3d803aa7c5a34d34b6112dccbe335b11a6444c2ecae850dea767e99b32ed3417e85d900fc6d40a5dcb41773b49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5d0d76ff6d40e76f83f0d3462c655e000
SHA1e119311e71ddbdcaeea0c24d853f06d079d5f3fd
SHA2567b2a697c470191a51b5a956e6f24b8ff7aa96afccff829817b7c5a35dacf786b
SHA5120309fd98259460cd4907f337b1b5d0e81d6877adb21a2a25e8abcdd4bab010e6c7eeb270a533b97d3f8f585a84f1e0978069b5bd8ef8f5ef18589d257e0c6542
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD597e38463e7d68064207fb1c251c1b782
SHA15458d09aa64e9647041da21fad7497d558137146
SHA256c12b37d8335494126e347b80edf62d0e4012431cf22b2eff44e4a81b81918491
SHA512a2885b0044f063b0cac2fd8e247bd31918c8b1821b2a4bb788a7c90bf889b46afef2d1d62b21a0ec0b10958f19848f0c36482c354b59935de423d82d79637b81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e1cb39216031d9acf62bca2b405fb8c
SHA18cc549a5e726f321f9fb10eef9f1e6e46d392230
SHA256cb422351ecf01d326a9ae7bb25ce1640ade68b8f6c9ed253cd8452d3bec6935d
SHA51250d7fa5a8f49e9920015cbde7b873280f62a59532b280383e8b01809717fa6daf6d5c4ecf7a26b4edfeee9cbf71112af5c9376037d387729d63ff9fc87a716e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a2c07beacb87e950534bec1f81ba465
SHA1d1a1ec8035b3b8152557912e6db82907d3d14b96
SHA25617f4b9fee199c6d4dce14abd52c2ccc88640060a40603e7ae66ff06564498732
SHA512c08ba7258a589317c8b7f7f889bd96df6245b2ab01bb64eaa3e4e61cd3e2c0767fe79147695c95f12fc5d4a8df68f5f4d38aa355edcc9691cccce383597f8a00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dad9c3e75f99d94d539db88a9463fdb
SHA1f0ef1b5c83c89c0ec02bede344d6041cb3e4e656
SHA2568079bb3c03691906eef3c3fc88643fc87bda4b0e9ef7ae432e17c9633336ca5a
SHA51284dfde437639bb999b2d40819244f1d0f610d731ed2dbf2067ba8603513bce9401210d47d9b426a5b3c1abfd1c8750e7012731313f1fa2ed7dbfc3233e006b11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b990f3e568e1f005e379faef69739735
SHA1c7151fca8e73586ac8bd650fd63521ffae8795b3
SHA2560c11967c2041925dca71e0eaa39e6aa807fb5c3067033dcb44061ee228b1eeca
SHA512ef132f0557bba204a18fae4c658ef01a56daa40dc78b6a03230b23889ff5902bd5fc45bd2d79266a0dbd712734fe09834720a146e0cd3f7a55053cb219e9ed39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521e89a29f57564f6e00701b54acac170
SHA1bbe087eb52c686179a2373ee6b44796643c14439
SHA25667e9325272048c8372e0a9b9e2f2ca72374b5191cec1e612de1444e76fbbefa7
SHA512b412fa053164148fa1c05ff59878f80ddb81f1bb16a9609dc7d472d23b042a3883116bd7d2e6d70cef248e32a88c166a39e91e59401563bcef77b3133e5ea4d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567d037402147ed8de24e80c92de9aa3d
SHA1ec068b5b5e29ae05c8464e5dd58083b2efbed85d
SHA256fa267da0a2d1953972b706dca8242908d87a9bea08be1b1776bdf70ad0b31521
SHA5127843346920de9767fc7e122df5c394dcc7423226d4c1ad311ce5ad6a009837a6b750dda78395a164cc3b30c8e5ba07a1c448c871f9b10c9005414b26a40aadbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f99b98e932217bb5bab0b6f4fc302aed
SHA103f94a83c08910c38e3838750840dad57d1d4a30
SHA256a8baaa5599a8007ba1e468fc03333d71c1aebc68b3dbd8e3b42be75b2037d94d
SHA51219d62ea60a44eb3b7b4bf8ef4f12fa2110b442bd656de443c295611edbb707824247933f477dff17422a290b153abbefb2fe41cbc4d8a69a1ed79f67dbc4ed34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2ca9d9a9ce9e9ba9ce629c01413e19d
SHA16c55e4367d451aa83d3150f3611eeb5d747c95a2
SHA256332664ec2c2facc64a30a0ede13772e3ed3d5afb2309c61090ea7b918c7c48a8
SHA51208437eb71b8f49a380be8871a1bc416815d2e4d3519a953d47ce9a507be43be25264001341d46ba5491ff5a38252b04e6f5bdd0d0105b35113643a63bdbeb0fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb67b914edcd6d76a88180e9ec87615c
SHA1e1267e3c8c5b4dd7a73b715f16d8241c03af4267
SHA256c9e10f80d77a9f106d19081e21c86a730402a6ec9d7c49985fc149fe00ac197e
SHA512a39cbbe2b2867d3627b4c104ced788c9b194f86c96a4d66b476153675eaf891d3830e901ab7ccb48eab91f1048fbde3cdc096cb8732a4ee5046ae597eaab15b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9887196cfca9238e8ac5321e42d1587
SHA1390917e994f07d68f090780bfd2124dedabc0315
SHA2568611d9b7af2e64a8bbae53c0ec66eb1ceb73a513c0fcfbdcc4c01c19bbab6b90
SHA512036264c46343a6288272dbd6edf63eab5f61f90440f906e9057a41f90c4d6f77c11f0e3636ab7c43b9a8a0b96f1b7b50fab52df6f43c815cf5c160657162fb23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50928a8016962846f256974532b99b191
SHA1c7b2a2200d45c323a449b963a696183ae6e93f7a
SHA256c72bafd64c7f41a7fea5c0f6db467daa1663e83cfff290f83bfc092145ad65aa
SHA5122cf4dfe053a18d69f6125f459480da8f5afe767e9aba7e3d9885cf46af945a00930ca2e04cf55221fe9c6fbe7557f03c12b0955c2d05612cc343c04bb7615357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d37232db807143030ef86f65f8426ef1
SHA1dcfb6154ee8678517a0952c95282f0a29ec539b6
SHA2560671025530c122381703f7ef6736f28d1b17e777f9b1f8a1cfa6204962fba14f
SHA5125080a083375b9d43fe728c3c936d6e53eba131a1c886e2f2b892c85ef685f662ce24a877e89766008469d735e44005a93d54cf5796525bbe52edf404e265adf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_F82FCC341F124F6AC9D153F6ECE89FFA
Filesize406B
MD55957efd2e55ecd52a2dd8bdbc85aec00
SHA1d767a0560267dcf498d9a9d15f3546ae36592a01
SHA256874b1b8269a07d19fbf3a6c01d21c64b4527040bbaa680991acdbd9ac49e4c01
SHA512fb0b7bbf062601e16511ec9a1844d612590b6087f16130540cf7d122ca5d1368e4c73507f8359ad06c9053c73db0fd7a0d2c5a61ecc50717cdbdb94da4986108
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD517073473090bf7ab4129b1757f831489
SHA19e0d5520fe91565d25cea272127f43c4d3757045
SHA2567c3b40dbaba2871f6047639bf038d9398f59081cfcca8512c258ae67bf69f0b0
SHA512085b7826b568aa92c4b64c3c794a152404e63786de04ed2f27a35bc2937490db52a66c043cb63445112f67351d4127da470329130bec59e59279929bebeca04b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5b43179ae24657797b526a57aa0a23eaf
SHA114f5c80f8966da9eab23a35984a3c34b29645175
SHA256024508c58944b8c8e26491b0e2fbc0a406db2bb733133d7269edb4b0dd1cb3f4
SHA5125975438a9f5315f06e0c395f1b30c294061b7a13077bffb033d75da20536f480e95c428275afdf9f7ab93e688ecabc5a19cd8f2b70da19a03ac21bd245a2c145
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JZQ5QLK\platform_gapi.iframes.style.common[1].js
Filesize54KB
MD57ef4bc18139bcdbdd14c5b58b0955a67
SHA1afe44fd9a877f81a3c36f571c0fc934324c6cbd7
SHA256192bc707852c5986f930528442d88a79e5bcf4513aacc2b722a3c5e964501838
SHA5126c2920e80e4d5059588a32f75bc2b5dcc19f8d68224c0935d74f9fbf49476ca5b1ce43c279768f3d36871dfcec39f36db3fcad559c2f93cc540154cdbb04dec2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\cb=gapi[1].js
Filesize133KB
MD54d1bd282f5a3799d4e2880cf69af9269
SHA12ede61be138a7beaa7d6214aa278479dce258adb
SHA2565e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693
SHA512615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a