Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 12:42
Static task
static1
Behavioral task
behavioral1
Sample
7cfd80ef45b3d30ef90318d7a334e6e0_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7cfd80ef45b3d30ef90318d7a334e6e0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7cfd80ef45b3d30ef90318d7a334e6e0_JaffaCakes118.html
-
Size
462KB
-
MD5
7cfd80ef45b3d30ef90318d7a334e6e0
-
SHA1
a8719f9eaa13cc75291f8c2745589d6080771b68
-
SHA256
1bd683b705e8738592bee0be5ec0b9697cc5e76e0476847913083b3c97247151
-
SHA512
d900850ffcd0683e0dfb7635b3f67af3cb7cc60f34c18e4a4e26e687ac12403f1f01a62bbbd73c85cf4df18a42a3c3cb1aac0f9c874e38284efe45840f07735e
-
SSDEEP
6144:SbsMYod+X3oI+YsagLNQosMYod+X3oI+YH4sMYod+X3oI+YLsMYod+X3oI+YQ:A5d+X3S5d+X3Q5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b4c6a8fdb0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFA94341-1CF0-11EF-9371-CAFA5A0A62FD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423062475" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005b185e5bf409b940b7732c8b3532bc8f00000000020000000000106600000001000020000000260baa586af0b6bf817fb71e8ced75acf776ed8d7c3aed24024951a92349742d000000000e8000000002000020000000a2d9b6f894a2f8bcd2ae600b58d5a775b9a9c63be6529644160340ba641fd928900000003d6db7b8d2d5558a6372a6bd8ad2c3ed3491990431b894d630c85495562e7af19b2ebe253379e7245ecd43a0d6b79455db086b96aef643a3f4732df5c387d2822928249f6e15476f3f3d4bd45cef014a56fdba9efe282d1465092ab8ea7e594ec5108d23e875dfbd8097d3346482d3852c1c61661e10a39bb7ba53d8390cb24bd4e8cff676f74fbce0caded17d314ec340000000f4968a95e75363ee7987562f9e8f3aa45d9947c36e9fcdc0f501d7ec8c3bbffb1f614afa11cf2affcff1fb62512aecc025223a9735172b90d36ed33541c9b233 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005b185e5bf409b940b7732c8b3532bc8f00000000020000000000106600000001000020000000c7095dd9f26a53925f993bca60587e9104bbb99f6adc24eea309856d01b379aa000000000e8000000002000020000000fbc4618bb0482818b8ac1b341db49bcd43eb0cc10762a268088e42a58108a46f20000000186ebfcdae7327e4c62c0943e4a70bd14cdf6d1fcbc27d27031a0c4efd04cc3040000000eebfbf98e2ed4b106043787b08c4588546cb2277aa5453d01ca53636381900d26659eaf3e06d340ea53523bfc6fab7ed6b6731b7a3e97bc2665acf5909799599 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2100 iexplore.exe 2100 iexplore.exe 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2480 2100 iexplore.exe 28 PID 2100 wrote to memory of 2480 2100 iexplore.exe 28 PID 2100 wrote to memory of 2480 2100 iexplore.exe 28 PID 2100 wrote to memory of 2480 2100 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7cfd80ef45b3d30ef90318d7a334e6e0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2f865f9ce860f0ebaf473017a156660
SHA11636c5f3561adf2a791b501a0693d7705970142d
SHA2568f1f8d849f9856a2a093b53d7dbf324865edc5a58e98e3815b4de5f9e3389924
SHA5127a198c4acfcd5301db9f96320a072af7292af713d94c06d02ca2d59264af32eedf54e610e37eacba5fc7071560aded5adfa9d2aac9e9d81f5a9aa7f8fb8c9a45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518600ea72fb7d6024987be03897e69c7
SHA12b984a123f6e03a42ecb5ccf012bc6293b897b92
SHA256c9fb87c433571630944f55d4353498a8e4f9d74931e5157a88af41fc00988fba
SHA512bf5786fa51d442d9a83d4e08ea937cc282fa84cad2e8bd0a7f6985a119aa2eef16697710b0501853df5c1cda708e7af408d88ba33d08688b4de4975c7baeabad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a89d3b8872bfbfe89ca1adcb026983db
SHA1a0be900452b3cf21aaf8c4f9257d4259dfb68abd
SHA256e14c9a09a9780be3892075b0805932e763dd7d8fd7999f60d0bc9e4041381080
SHA512e0f88b1c3d87b15373ba11018219e58acdb955cb7a048d9bba80a8b4952d0d961340990b7776cd5699424b0a34bfe152bf8b405393dbb81ced9435a69623ef06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58396f2f60bf5b8d4d4a0b52f46517698
SHA1a7a807dd0100a832203e69f31c47bd249eb54e97
SHA256e65a3ebadd225315ef45b497c786e2b3f2afbfd3762d63cd9b439704fda058bc
SHA51205d8cd82000e1ae595184b73570c5f1bd358c4af998f0523ab87a853ef7d0e0aa204d825e0311995edd14a62c165867c8ba8e32086b30e3b49bb5f642d8bf2c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee9188e1b3ae9fc49b4f62eb26ec87de
SHA16d6acbe543e67c4d0942aa26cac6dbf902a56be9
SHA2567d66cb3f6e6c9f6b6b27eccb792aeb47e858891d3984c80ad60d2531cb978b74
SHA5129813e62196c980a1ad1906ab3dcd784a1900237afaa3dfa62c617e30e171012302463262e7e2d33690078221919bfb2b15ee84546ecd0be9561cf5bba81bbfb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffa8ba38e6b66e2a476957d66391dff3
SHA17232af130729b9a8814de49be5fd4e6ab8ec445a
SHA25645e0b52b83c442f52938dd09a4e6eee4146c4c5553605feeca38c4a8e1d7017b
SHA5129ca0f6693cb4fc36fc0f03d75b1d8b9f4eec6b2ba2b0700f78542f993996a0e91da3f27fb79139bf378948bfc02a8a77f0abeac0b7473e898ac0eee64845ad02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9249556eae1fda32d6c22d38a7e103f
SHA1f55de2038a2096e261a8239d8d4f1f9afa1a18d6
SHA2565f0587fb38bcb2e1d59a54e4d221aa28991c438199a30e2f3c30702bfe47a872
SHA5123b8fe55d57580add0fd7975cd63666a8de1ef4db2f5d4dd895cb837ceb2579004c5793d21dadd7727c2b3ad53cb918afddd63efa28fb2cf86af1bcfe3870a91c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b5581aad91048fd3368b65ca8a4b2da
SHA1d5dbec4ecc99caddba075a20cb633e1c83da5c63
SHA2566674952cfd5a226f1695f3ab9548479e28cfb1a4b667baddebffc1c4ffdbcff0
SHA512545cd5ac6b6f735bd67b0ca74b7b96db9fb5572640a8e5a3f69f34046c84f7eee3524eaabd848e6c28428798ae0cecd3b0126b73d0977e8f5e021601f1901517
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb62c2e21505b5a3fa0216542617ef7a
SHA19c8bc7d296b1ad32e94c1f87114e83a86f2f1081
SHA2565bacc53f131acff87bf7b563d0a12fa1751038f10b41e7bcb88582be5a24b3d5
SHA512d49246f786960e628aa7d86a4ef9355ffa100e5f2486a0c8f84fb27e6aba1e2f133617e926b67f9ab520a4531a40d7968f272c84d84e825a6f9dae6e5a8100d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506b29d932274b1aeb00e5d192347a639
SHA16cf35ffc34ed193e22907bdc8e079214de8bc30e
SHA2568a2051719f728b5612a67062f5fa061cf64ecb51e0b9250b288e0b6b57c4ef62
SHA512a586f9d5a28dfb327b5045361531b214970484ff5d2d41074c061086a4a3877a343576fb9c85cf288f90b4edb11b4ef5e55a5a03c9a2b756495d78720986e237
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53dfa73e8ef73848715348a95a0539954
SHA1abd5f2e8a0ab21a9b59eedc74c9b987cbc286ead
SHA256844e64f6a3767d2b9da91d98c593d87292a537f00c57608b1f82ecf00a3703df
SHA51292119d1b939c8a3a81c32ad0bf6f48588a6fce465885a4ab6c363a92fbf6682be46a8720ac9baf3f9cd97867aca1877384d4eb6e608cef55c032b041f2437de8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc9cd1d2fb68dc2313bb037d2eeaffb4
SHA194c7e0d72791da106c48753404c36660b7c4c6ae
SHA256a10bdb0246f14cbcd0c54d8713668743da3ef1a03bf5e01bfa9919b26d397572
SHA512f35a828f50a8acc9a8b44e6fe61cdc1513f291a711811acc98b4227f6870a6c1b216ef7e86cefb147ed7f8e95e75aa8eddf7a8a3a1b4b4f509d25c42d288b8ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a95ee522c590ad42e697752a8cffa56
SHA176ec44ef5179c06dad048d59d6184d7534aa5f35
SHA256489e684a963a960f01e9ebab13d66b8faeb034f2c89c6a92edfd08e922f801d6
SHA51246f7870ca546e7abb72136dcfa8a837ef73a8de8100b29b28de8d03b37f1c80bd9644907abe7e8e0e5e0e2a8f4faae649e920c97a416003e0f69ae38c859855c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f0d4420c1c2c8783c04fa9de4ef085b
SHA1678506d6b90fd9a18949063825e7e83406c15add
SHA25669349721bbb71f8bfed08e4a996425d1f3b253daf6b3290c5a2acbb792c1cb53
SHA512c5b300a92318e18ac35c768115894ec07f90b8ae13d6c08d5f2a676ed3b450d80ccd7252c650f29951fb7687f5b84894d7822545c1f7d1abdd5e95cce58f8d98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a067e7f08af5868d83becb0efae5cd3b
SHA143c1307057f21ce0447036d365325904e0276736
SHA25676fdd79cbb8590272fcf7389b01d57d04c748228922bb2baf6b86f25009d4b8e
SHA5126daf12959b0957d3913e44803bd79a574058b591ca58199a327a02b08ac9305d5005c24dd3d60855bd00aa81ff18d4c250cb19939d68dc58fa88a2e85e3c030c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc6b34c8d8940642b0260d9ca14c5d78
SHA1fcbae8bd051d78d09f1b1f2d4b3f07ee0fb4cb73
SHA256f1d831cb89db4b37b4b4c389e7834d71e613e35a7edf3b81f93ea79f954634ac
SHA5128f39bb0070c2726ea54587a8042a8fe89cec4b1acd54bb70b9dff37c2cfc951a6228d97a2a96cd9a9376d97fba62df3d1db4cf7168a2543f7121e2786c89e364
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c8ce66d9025d2cf080ff40b3a53c52f
SHA16ab950631af95f9a1bedbb56f6b1e10e9b80e239
SHA256d2907c54b53054cd21013366c226e853519d4d44ae81c0d5f45c26a191999a3c
SHA512c2bd9f1b7cb1fd265c37781ef21fa7f101bde185ffbb90413c97359a40e5a8bc4ef7edc662ab29569591225e4073778d05fe4cb4889bc96988ca0ea4291b641f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51274fd5c125f1d25826f223ffb481ba2
SHA1b9edf1ed3b51eaabb1d9dd88cf5d0d250e6f8784
SHA256c22f2dacbb1c3db8b75b41cdab93517b07be77f7548b74fe0367e6c5ce846ea6
SHA512eb38764e8fddb8e820679c4b6216f7403656a092f818ac6b37c88de5ee81a05a15404d91e80a05eb4ca33e33e49dea17f859ef35fa87735165678cb8af9cf714
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a