Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
74c904ec5827d28abf49304214defa05_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
74c904ec5827d28abf49304214defa05_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
74c904ec5827d28abf49304214defa05_JaffaCakes118.html
-
Size
3KB
-
MD5
74c904ec5827d28abf49304214defa05
-
SHA1
411512fc052fde432633de43cabe2420be69893f
-
SHA256
01dd244d7fb43cab57952abd5a7715b382f689e15d68f89ad760132a8a29b494
-
SHA512
6aad5e449db5c6f3b16e48b3eeed17f43bdfe1e9663bd0fbcd0e8d71e0f5378f2d5451480bcfa4e1a4ea20f0d6a6b2420a2431009a458ef9f60386aaa3a9115a
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ad70f940afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000acf9a89f8fe45becd76c25afa78792b9ad15839e0e2da5c223c85ceaeccfd257000000000e80000000020000200000005bf51272e7ad1690e5df62a0805e6b778f242751f51d29975f6cc96d1bf2bff8200000005c5ab22de7659a9d63e653f6e49fa813a45bb5fddf2d578241c362576d9d65d240000000281cdd2e998aa252dfb904a8a26a83d6926b1da3d88782e341f5916737a1db7aa9a760baffc135758a1e9646e119773c57362bc2d71247790f8baf7c9d1da573 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24E92821-1B34-11EF-BADF-D62CE60191A1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000077886e069b95834bd8b251655e9e56265de65c01496c56b6a180bdf20af06dfb000000000e8000000002000020000000673f2be7bfe4dc58296a21a8dbc6758b392d8360f113f3a1ae27fee852bdb0b9900000009b836c35b456fb9dde1525b3019053c9ba95e5882aeee540e3a29122ca443b1ca287f92e38812904826adf576e1474c54581ea8d1b34cb5cdf89188bd2e2a66dde99ff591cf0873b846a2b1fa62b5f4e6b8b281f28e4efe05a3bdc01e0b3692549825e9c56f5629cc2d3a1260456d9f93c101d88de7a18d7704e0516eb80652f3fe480e02691a215d6ccc0557f2fe72e400000005b018159cda515c1ac0d01159242fafa973cf33549fcb19ece51da11a1c55ead5b8ba682ed717d82627ad12e551f95d2deff5167f996be88512b904bd789a42e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422871491" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2340 3056 iexplore.exe 28 PID 3056 wrote to memory of 2340 3056 iexplore.exe 28 PID 3056 wrote to memory of 2340 3056 iexplore.exe 28 PID 3056 wrote to memory of 2340 3056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74c904ec5827d28abf49304214defa05_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5682d2b71e50fc1743924a548e7347f74
SHA1cfe3232651f7aaf8d6acf75ca1cf0e6e0c031282
SHA256068f92c24aa3937e8654f43e1135fe7fbf9ea547372b28ba600362be09488744
SHA512289d5d675460ef833ed42420f0b31dd91bcd50f6d9a36f2afd97ff137030e3ef4b8f0ddc7d5cf96e22871f8c25b2f16d20b08051bcd0d5d863eecbfaad88b747
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f331062936b22017bf3499fdadb261b
SHA1a6dd68cee0f541ca4f236c681a8fa618b31a86f1
SHA2563fd675768d0c488fda34872b68e72e9f03054ac2f95017c9c440596b26ad518d
SHA51254e2bff752f83517beaaa204785e2f96f5282cbadcf7e550fcc10b28fe15176415628f009543842360a928536c9691137045a87b21059655b35af3f7d1ea01d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b4fbce4bcebc1960c3049d856c6cae9
SHA132973d5976b307b8bf4be8e8f55fa4053545828b
SHA2569e3a01dbb0628b85ed237b4011cb046dfad77117f6756ad454f9ab7c37e1fa64
SHA512975262afafed03214cf180de5a49d5fd0302f9a28b32118f2c8ef422f09360eee538c6c2bde9c320f4cd4844da43aff1495843ea1a931e1e92fc25ed3600937d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e9732c18cc0d9d4c2bd8da7781d7247
SHA1d69927040b8076215f44cd0189a04e64af3b0cb7
SHA256644d097c875992462eef310668f4d9199edd6901cc62ba67281c6c9c2af940e5
SHA512f605b66563f1e2217c7a5ccb3d71b709ae3b33efb759bb14132b046bad0df2ce22a7e0a61295360b95e5a7edd4095e95bfbba372334943a1ecbc1dd1b2c44f5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b7ebd0bbd8625dd6e7cf0f34e81f8ee
SHA1365f06ee5aa836731af025341ccd9248ec33f214
SHA256388e4661adab86123b877e72b63061794309fed86bf2dde943093efee5001202
SHA51210fe63af7f44a7b63200bac134793dbd405583ded8346f52803c2f3d47f05df432676cb90f6caa83bafa2141eddac0eca41ec9ed9f8e82be34a3bb132c128c48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5948973a427e458351e73b827e5fa27cd
SHA13935ecee3fd80f4b5b79f0a0b9b94adb3c6a9e9f
SHA2568a82fa60534112d7f24029e1678d038b3e3712074883cdf1d7fb93c3019e34c5
SHA512c76a66a9180782d01d6e99991add14107bb36daa04aef09b21f3d31941a58b7df27b7b07dfbc688e97f1811b8732c75e73d69eb9d3f5f36620cd7b23cfc0b607
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54eeeea492817ec6f33b5dfe1410e47ab
SHA13961943c6bf03f2ac5d1ef31fdc9b78cc2be1c1d
SHA256378c570a37b240a5dfc31076970d632a55991b8c8b3fff60e5bf492b650b222f
SHA5124b06ea892819d1455e693d21d2d70193a804976556d53972cb974e2b2f3783cd4c0052a6953768eb54727274c4c366bebdf6bed4924d761db8f07b33ddf2e1ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f010f90c763e8c475db2b8e6ef10287
SHA1c97c0ccb3946d948bff89363b4d5043a38756267
SHA2562ff6a45fd6e28fc7526000481310b4fb729bfa980ba0487e41b19ab0cb151709
SHA512b05cc36f4407534d576f653f9a73df3429db8cd82a89501610cb3cc689b9c94517b7c16a738c30795abedeaec6d70c98ab41e201c047cdd0d72ef4927e5e22de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0dc0b5a6aad6be903697d8fd90373aa
SHA17dcbb93cc16ef9dcdd9e3fc2de8b60e6ca8f0348
SHA256f2c612d307ae5909c817dee1a3ba935c036780a13f842e0ad95cff8443b888d6
SHA5122290034de280c96d275e9b1ee20d04fc411bdc72cb548414c6268e50975d8960aa3c55f4d0b148b8ee9b4820ca27ca7d2eaed634c49d45f4ca4000755e2efe75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c7550854adf33d97f57eab0fec89b80
SHA108685565c7ab9ca03b64071f982800eac17f8e4c
SHA2560e08e93d04386d3ebffff57e60b4f22d3662db3a1c524cc01222df51d84c5576
SHA512673bf785212e589b0325044d5269f0a7327952eb0e13907fd68b6395a35747d850361e8343b0cfc3076ac6d302735e819533cd79a0fbef070f5af77e0ae7b1e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5d7dd5512a1b0945eb7e5cdffca47ee
SHA1ab0768a85d765085bc4b53701535d35d47420dfe
SHA2560d0062751aa9351d081832a027345597763eaecf1a9302583366eec6345e580e
SHA5124a4cd3915e0351b289fef3f8839a7fff663c4be842045b94ecceee0ae00a86c3f666e0554b1db5a408b63c3176ee5473514fe39c2de332d3683f5b07b58e934b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2063a03654cfeb59d7cea85cefc4965
SHA1bec6d79b132c873868672596ab183387af47f68f
SHA2568d0b7e347f0313226bf8e8a88e7a27d3a962635b1b80c94ac6056981d2283b75
SHA51228aa9b481b6f0e692bffaa45f277552dfe3fe1a3989aefaaef79bb249339d2c191b10828202644ede445b2dbcc3b5589228ffad789e3a62dc00af6a33ae9199f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c53e54e6ed31c9d6b5cfd708db56aa00
SHA1cbb0b70fff95865d07f87a7684c1b319e273428c
SHA25666c1c9089f0790e5cebc8a1695a41fe9ff29c6a4ec91c5bf22456bd329517e62
SHA512988b150b4968bb2cf6edcb899c3f56c37f28ad323eb989c10a3dc661620bbe560a16d5d82dd6f19d9293c29009f70fe7cab812fdd2c2fcc8402be54e66077109
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da1323e5afd4066ff395b16678f73b84
SHA1818a429011dd58a85354691ae2279a16f865b727
SHA256e24cd60d196b0b27021bfb30416caf05620d97516d8f0d5ce3ae8f81bd28a4af
SHA512ccfcf7a8626a172b8e0e11f9089b689584d43d25c6b4366ddaed5c1fdd527e5f06595f64ac4ef23c48672783149a648ced5e57565837df9d46a4f3ce8a704c14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501e324e96e73addbbca62abd6bf81f2a
SHA1259572eea30689e59b8a33b452d91978917e1c3a
SHA25629140cb51940b62a8fbe15c3480f15e882294640daa095ca8d4aa3eff4fa6aa8
SHA512678a379e0932773a599ee77f47ec29baeda4719799a2893ddf75cf789f4d09eccf66cee733102f9b205fa56745da99c3960458e2079a0e5f63a992945cebc217
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a542fbb3bc48f7b44b6df59e3ff89f8
SHA117444ba68c325b83cb9b80ab38682c2682d5694d
SHA2568a3bbdc85f63c7dc90a086ed6ce130f6bd76dcfcfd1242b16dd37266f914f608
SHA5120cf859c4fa4e8149f3d7f58001e4316e3f0a60afe920624d974805e592b45897c2325e81c94b366af7ac5a5c3aeb9854592d4896f10dcb3450558150092e72d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb1261189840631e8980f10f1ca77009
SHA1e1e3f031cf3e25661c3e93bc6c5812010d53a2de
SHA25648811304e870618b259631cd53a92d46cbf4c5cd94b78349785ba513b2a50a71
SHA512b3a9d019f78f9e8519bf4fe8feac67195f4b34052436afb1d58e1939a81743315fe29008ecac613dc7580601660389c9cd0d2c924aeafccad1a1c899084d79b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5042937aebca8e672fc576ebe5d1c3ee9
SHA1fa8396cf3e1c283ccf8f379d131f3cd8b6cb1b7f
SHA256cc917c94fceb746180b1e7b269f09fbba25f112f5bef2f686a232fa4d856177d
SHA51277ada6e49718a3c21a607c7534fbfe6fcfa734a3c12a02dcbd863c57a8b59febe346fd5d3926a57385ff3359b97a0155e7f73c74e6cb0cb69000e79c219ebe4a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a