Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 18:40
Static task
static1
Behavioral task
behavioral1
Sample
7a1fbd1383ec98b20b8f7a33fc0b955d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7a1fbd1383ec98b20b8f7a33fc0b955d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7a1fbd1383ec98b20b8f7a33fc0b955d_JaffaCakes118.html
-
Size
4KB
-
MD5
7a1fbd1383ec98b20b8f7a33fc0b955d
-
SHA1
ad87b1f67a4f8731c91a8f4968e164f41496e860
-
SHA256
af13723caa394214743f492d52c572d24b6537565ffb737605c23a225ac00583
-
SHA512
cf56c4c794cd7636cacc9b3784cbbc29a023957c9d6bd834dacd00d240e80f0620557fa455cca3a12c1c783e529abe655c4ff6aae0c25a1261cbe409c495d332
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oqyOmdsd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDp
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300e536865b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422997091" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d4701da4875779612b76e62e5e54998a2d38550b71c11a84b1941bdbae22caf7000000000e800000000200002000000068d30d5f7b1f8b2e93fe9ff2f6da85d81097ef0159ad901ef2e63a50a0edc49220000000ebe38e1183fc8ebed5521fa8251ada43bf4f44be059ea96519923df9600aabeb40000000babded08bb41110d044b0158bdd04305cd0b9c105d862100636248e80112a61857f587413635bc70aaf48b28a85ac225560e64a8fd8aa8e2903fd7fe41afc234 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{93C696E1-1C58-11EF-BA28-C2931B856BB4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008bc6ac1842cc9e2cc0a26946c088ce9295e3dfd82605592ca2e283110c1dd96b000000000e8000000002000020000000f83cf02af3cafb691ac3878f4183134fc945e4d6601b1d9a689930704248b6a190000000f459142b52110cbe650d77c62eed286800ecbcddf1534cf3e8ddf4cacabf1bc7946529c8135927fdec4d2f4f1a6e62a1b6768ca368e89c2699365a39a808254a5d62483e7115f548657734ce1d99f96dd6b10b7a7010f08460f1f83e05a3aa20b99d168cef98d0a115b9a3bfdbe17d1184dd4bd66f981ec45d27b6d5ebdb11293e3f49463c5760749efb1547b63ea48b4000000006ccf2a6adeb0df4bfa66f83ec246df04105489fff410ba28d9ec0371bb0e00d613327f914a879258085709ab2bba62a496207610de6c86e32bec5f99cd0f3c9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1700 iexplore.exe 1700 iexplore.exe 1596 IEXPLORE.EXE 1596 IEXPLORE.EXE 1596 IEXPLORE.EXE 1596 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 1596 1700 iexplore.exe 29 PID 1700 wrote to memory of 1596 1700 iexplore.exe 29 PID 1700 wrote to memory of 1596 1700 iexplore.exe 29 PID 1700 wrote to memory of 1596 1700 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a1fbd1383ec98b20b8f7a33fc0b955d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1596
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b201c597b42c4c468966ade816e3f666
SHA1723886ddc4e10d4109902d1001b0953bcca86340
SHA256fa87345c5d0495880d73fdea4c8bc9edb84aea6ecae76fb68c336f02d52a9b78
SHA5127e5f0c88b34309d3deab08ea21687c0e0a3671d575429c2cd35d80a05ab86f91e0ab66666b0c69a98b4ef22cef695946bb86e0f9d375bb3feb5d08d3ba8ee401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c80cc0d3fd5f35c74746ac8aa6a5b50d
SHA162a11bfe7531c2659d2d36c4844a60f0b90a7b04
SHA256971a4dc1ed4f1c49faeaa01c1dbaccf32efec8dfbbaee9daceb011e20480c65e
SHA5128a1a05fd511e59c29f45721d956fad199de0b4acac2862f077607ec680fdc768110ba50515aab17bd150b90b54bd4646951765be9d55af70d9324a146697488b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bc50882682616405d8ec77088af145c
SHA1a5468c9832132b144253909167cb58b0a00a716d
SHA256d1836749c2ca9be43a491cc3a10f3008ab24caa5bf173040de0ab231ab634e3c
SHA512884361de23f9bba5cc884c6382be9ddf220ef7b4ec10abc028e7eabdfa2c393a42538d32fe25a930d097b6e687f6a1c66febd44197c346e9046baa8fced91af6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51502e1ce37b48cda2506babc6cdc2720
SHA1724afee36281c0bd311cda0ce244fd1503421579
SHA256d2f3c3515a0f5c920629e649caf708d411a5ee1512db824618d2f3eb54fff3bc
SHA512ca35cfae13946507f019ad2d9808e6f93b4f785e78c0ba3746c8eb604468eab5888fb9e6223fcfab47043509e11bb0a446fca1143e2b9097f3df58cad0506f37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51311f16fe1102973f0d939babcc52cd9
SHA18d5ac368317d13d99bdf5501e1b1a13539fc6b33
SHA256be2bfa98cc9029bc9def5f2c601e5c6442d1043edbf1bff5b0f1530cf24aab90
SHA512be01417620879be35523d5e3f367a6c21a06af074a899ab3bbad26345e0d4336e060d3a4f1fef3e2e9c26a25756ff29770d5208a5b88e342b124ef77934b0402
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5baa6fa7173149d9a2ed6eea644517329
SHA15936845d743c4188cc906d7990e7bdf7de2ebbdf
SHA256ab802d61517e2c688c3c28626f326a0a6b256021759a45f2beeb9dd4b4cf55b9
SHA51263869d41ff35a9bc752b5c77150078c48a72552d7bf09d7c0fe83913dc3d8769320dd82a268946697730135ace53ca698370c1727ba378a10be55ee9a7906785
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f73b87290e34d0a0036679116f34272e
SHA1ad87a70cfc8209d225a892e42608ab28f21fc9e5
SHA2563e602c4b6c9119b4323a4f4599de531f15236b75afa046e9856512f3fa811f56
SHA512eb92ae199822119fe18a35252daf7ca2a25d7535e821863d631d36f6f925de5a5a68a2840fb5069a182236142e59fd0f0880f620c7c37f12511b303c7c280dda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5718123ba3555c984dcf36c2ba5da7ba7
SHA15f5761f56ec764991ea3f0f7881ac02ba3726ebb
SHA256191c279d7f097cbe919dfe6dcdb63cdf765c81bda4a1615503b1d336f4d2be0c
SHA5128e0ed39f90264d0cc7e77a2be3397b77da5fbb27165911fcc5a9646239f6187bb0ada58d49083a3b28eab81dc1454bfce565ee9f0cad65411bc0961727d03a25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa10a31c89054beaf0fbf82dcd729818
SHA12afce520e66318aed9c30c02a0053bfa0df0add3
SHA256dace109fb6572ff24f35bc1c67d8b56e42192b0e76df4a5828577eb06c215613
SHA512aeaad7b99030e9c4e6f77cefc53b81fc6250906a291ad6d6921c0cd4860e92aec31e6b041a9329979db67c1a9246da4d67260d95937d4c47189b131054e7873e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5e500a2c379ba0c37473de52a6383d0
SHA1de48d0ca5e14141069d114a74edb9cb2abb1fd30
SHA25604d0560f048170b3ed7259b83ebf534242f5e071e22f33ceab42c84ca4ee5440
SHA51223a3d811c9e967885d175a0a405d5c09e2308be27fdb89d355e0bf7e746925f540c56ce970c4a9f77b19fa595d9402608c9dad500ce0c29857892dc3cb02584a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54aa1cb6b5c84ba67327d687bdef93529
SHA1fef4b40a7e90ce0967c6dc85008d4052ab3f0130
SHA2564454e590e35a4ba99249e5f4b9c40d02ad9d1bf4187b938f053eca2e1fe53455
SHA51200667ef9c2dc6b1aebfba2acf3ac29de8b6848c9718f01863ac9159aa31fb799bd77ce78fffd6b8f350bd1d63e375a830d178ccb4176ff862108102fd24b703e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2ea84e4fb1b6746f2a4ce6c8845ac40
SHA17fbf4a72b0a554958a97ece5dfa29e6572ddfd07
SHA256cbd1c3d8eed7d1a5b7d89dcfa1f4310422b699eec6b8db9c3da39920c3e233dc
SHA5124bcf68e28eb0fd225995e617af17de9cb1500e974d4f7440af0025eb68ddd89cf1e3e2c3f46e661f042ea49752ff6ad97d61a71d0cc0ddefc428a55461c18e06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a26532ec0974355e88c6acb2dd7510a9
SHA1cf77f80b5aefe2d0c65abc3bdb0f05db2456622a
SHA25663b8a24dc2af4491a421e1cde016d50b948b7741aa0e78f26ee6c5c678b6a0ff
SHA512d23d3d918204c00a3d951a51da90d54ab068735efae154cbdf41f8cfc335ad47ce2e3e3d0b4e94d369fad3eb4da10be0db17ec7b830ddc2d6e7ce4df432d9855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cddddf6c15026144472db87f796ccddb
SHA1e011b14016de157e314176f7e5b594013a6d7f47
SHA256a28ab1d6f3e74bca20679df9c140b88c8ae15b9d75c8581f6a5489b25317339c
SHA51273e77bd892bdcc7d63be25b74ba75c7c1e3cdbc4840481866e7a40ed5f4dbae42b7d80bda49684bf35bb91b43ba71c37127d78aaf0044ff5c274ac72ab7d64f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b4119e72d400b7892a2e93dcb59ed25
SHA1d2c9385ecef2fdb46adb6ab8d45a77e53fa815a8
SHA256c16a617d2c61b389d2f20ee65cdf85b38a74aecb12867527364348de02a287ee
SHA51285fe406565d31e416e04707b51c0be6468f5108c399991b4dbab4f13822ca20bd544fc1f46ea4e9f1ad4b3609807db05906789034929ca449fd238621af04014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53170625f8221e6e7ad77a4011811c296
SHA1e42aa9db603e5ed014d31ac3e12192b03d31c2bf
SHA2562ae9b0e7a943e90bbf8aa87dbf13d7423a3c17e0783781ad19e9376a936371c3
SHA512997d416e481d5a99f99269e8b6fbba19d542c568925661fa2e224a6652a0ca88656fcfcb102cff8e881a81cb51a772dfbd7d1767daa149cf18b296908adc81fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59626d3e53a32053d53cfc0a09aa3db95
SHA187ec6e9bf084d939bacace1d5c2567d5ddc5526b
SHA2562738f74e41330c0400421f738c9f7637087aa7118eeb28fb1053416279ce4c20
SHA5129004aebd0f4af1050c77b602e42a6c256a986cb14a18a63a3c00486f6bfdd746e33b4ffce88da88a323ed8e151b234d31f09e82ad00e2d2758770b5da5622ca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dae74cfc1b66756a665264a63ec93598
SHA15c079bb785e42fbc43ad0a8a8259b6cced60c89b
SHA256f37da911541fa8553018b4f8a2752262f22e6ed4d9a5b41fee51854338ab32e0
SHA512da798add2dcdd4f7ca508d2150c24c802fad433a55e63d7605fd3902ea479cebe173bc0d30eb2c7d06b572ace8d64053b9191389d321df17f47513c8e187baa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdbb0e15d69584c8b853e3e299ca222d
SHA19cb790ba2a0c99b074659fd7e375c9eb7d0e04af
SHA25640c5a8ab9e632bc1b31d631d3b83d0c9ad88d6dcfe2a308678d1962f3525a166
SHA5127648c50c4b47a398ae1814238f56ee43570bbc69f0d25e2fb6100f1fcf713a567394efb66ffb2acb5e34336cff185bec7d93b54b6e7cd216b6cba4aac5646b5e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a