Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
7e28859340e749d6bc22a67a0e643911_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7e28859340e749d6bc22a67a0e643911_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7e28859340e749d6bc22a67a0e643911_JaffaCakes118.html
-
Size
34KB
-
MD5
7e28859340e749d6bc22a67a0e643911
-
SHA1
d545657562e7e70f3ab2072803fc5214ee821a6d
-
SHA256
93d66e4546eb2a65ff000a53854602138d3d0b94a78a96c6e8b23ae883bef4d2
-
SHA512
c6b683d4c1687990e28ffd80914b7c0961c3d68e46576f15a94066bf6cf8789f357c81f63892429b658090788135302f8341db6426d242373165bb44f0b4553b
-
SSDEEP
768:vJT1jsX3517UoFciUMIeIhizCRCQCcCcCsCsCFCFCzCzCyH9Ns/VCE5THTlzq0dR:RT3oFciUMIeIEcx//HHYYmm5HCVCE5TD
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d0fa522eb8acf3ed66cf1671db3b7137ed5841d593561be9915344319bab1647000000000e8000000002000020000000735be344c1c2d13d2ccd2081e29c7e9f81ef914efda343cbececc9e9b4a4f2ae20000000dc22f02cd9df770e4c0ca1509f93a5b1009821e4e26db37117a82cd1b41eed5540000000fed3c70f30c2df02cd21252d14c306108a33a38ffe7cdcdd193edd269811cb570e3ca76ff18316067aee4962bb263332798d7f36318af0cea7b34c6572fc36cb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A405A11-1D2A-11EF-BADF-D62CE60191A1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c068431f37b1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000002f0da7be6a24c363e3be3bb2a42319f1b96c57c0bd2a4358a4d36f84c0115f9a000000000e80000000020000200000002d71b90bb6fcd1aba83568c2d36b038c5a80cb2910e0f312d33eda316a7516d790000000ce29027b30222b8f1c72e81ad8199ea0bdf2c5cfab5f9fceab6e272aefc2b49a1a98f9ac2755fc8fd00f23caf57e4349eba19c157ef817ccb7b70981b0bcc7923d435d37199ba5ebbede355b4776e2cac6ef655b37b2555e8b6331119973e1309070e924828301d2d94c3f108eeef08646cf07b5916d2abdd5e9333a0e00d144044e36f6cc375f2dbb98c46b1cffc7a0400000007ab2339edd594526d41e125749fc6dbc1e1779dccd1a7229f651e80dcb79566a2ded72afc052096c9ac27dd23e501ba2b5fde2850371a00418b5e1922c2a274d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423087161" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1284 iexplore.exe 1284 iexplore.exe 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1996 1284 iexplore.exe 28 PID 1284 wrote to memory of 1996 1284 iexplore.exe 28 PID 1284 wrote to memory of 1996 1284 iexplore.exe 28 PID 1284 wrote to memory of 1996 1284 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e28859340e749d6bc22a67a0e643911_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1d5e81d50dc4daa0f027ec1a879daba
SHA1411b2f346e52b4940c8728cc8079f6d5eb5e3854
SHA256469a43b4ec315c41b8d1b54f54f89a65ca66faa9f0db5431b52c58f2591d87a1
SHA512370629b4e8a6d7c283dac3e6888eac8c73852d02b8c49e65df457a16bce4411d36ae40b4e0f109a065c935b86b869805a35dde34b5b5abea539cc986480b31bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542a90d537620062a8994d082a69e6e36
SHA1f9a14d6b392dfd9b94fa68532d7236026eb57263
SHA2565b7c33c7ccd5308691bbcb3fe2e20970e96c263e0528dc1565b99d7169263fc0
SHA512d1048076a412da36a34da2bc96c728f52707818956227cff8ee43b246af850ba686cb4c869d55ad8089fc80595d0e52e7eb459816a71210ce2c94530d295fc94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca90171a53dd97688c74c7e2cfa3fedb
SHA1be7aff4c9c9a68557e6e1f5cc16c0fa4a09181de
SHA2561eef6db86c6d0980b421092b1dbc5588f5e1455791fcaa709d91cf7cf736405e
SHA5124cf07eeee8b444bb9ec36a7dddcb5e6e7b1059509f4b5bb9d5f6e43c056b24a7c60e03825de917bf60a1b68a3f49694ebcdda6318f02d3716ac32d8b0f4f0c2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5121a40615c1b2b23b26aac388cd6d294
SHA12160bd27759bb16a5706298ff8a4acf113c6bd44
SHA25644b12c0b50ab1cbd467b952b542c4d1ddbaa00215e70a0ce8c385258d4cd82b9
SHA512c17bcde582002944060d07a7d230768cde5a65ace2d19bd285a0da7b65351658d206338d365e94a4cd09b61c26bbf87075f4f06ea9cbb1861bc9b0e7217ce02e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5569e594e0b2a0050788c542ce5dd1475
SHA111c8d18e95c2f115590bffa2a3da3cba724503cb
SHA2566d2d12ef8cf38b5a66112832e29c3065508ba4c2665e288c8d3ba470b969e412
SHA51238a7ad315df467c75bdfcf5f7b7991c5f885ebbfcd38511aa16d7ad3364e1b7dd8fe5c0e0b7f453763364263b29ca75a2eecb14119749adfcf8eea57da966696
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f30b029948ff6bbabfb1696fc62873a
SHA1eb8989113e5d9f44caac5aa5ff7d01cd4daa77eb
SHA2564cc282647df1eab482a20a661b525d027fd5bb03cf3e5877b1d2173aeaa03213
SHA51291ebd8b181d6760385c102a7a79a7ba9c07533cbcd6302bc203063b9b217cffc55243dc6fbae574ade9c0414c5d4a225cd4202aebdee3467e12286f29ac49d2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0563562f56ef10139b4748c536d0938
SHA1f53ba7e5e46ef02737818d960865e481c2f312b6
SHA2561dd8fb73cf14ce3777fe105442450089fc20fec2eadd04b467a30d9d49c0e114
SHA5126af0f3820489d3c5e697d419134d26da87800b5fb6946658cc40714aab7e038415c3a439723c6f3769af167238ddf9e8a6e1341c297e178e3864bba9d8824b0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557450ae7a6ada40ffae0155624f6f452
SHA10a4a1f5600cd90cf52fb0f3df8e759a2b6f4943a
SHA2560a0c8bf9a39eecc2dc741a7f46c4df1ce084807f9e00e5c980a942a1d0b40604
SHA51240b3c2f166b9e9cff0bcba799c9a5ea347e3b89fe1a82bf7d83f1ef394b1975e29879d24c1f3380eabd06653ce1dcde70881a294944f641ebc3b802d166c79b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b072c1175a72b60536ce394f046cb10
SHA1177580e1e8491e22b9c1b578e3ed31029aa5a4aa
SHA256801b3cb16bc218ecccf385e646b0c147c09b74becb001cc41584f2718cd374a7
SHA512e58a487c2e5f7def73fda4e2437fa03846870d893f2b8d7f086d2fe95a990e56533408596f8df193744b0073071db1664b07aee74a9932f873288f41a29593bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd702855a775cc5ac62698e981b1b665
SHA1c6a482d10d36f80f0b82f3186de208207dee58cc
SHA256c171e14dca8d4f580d735b640b519ea88aa310387e66b15f093af4db30b863de
SHA512b4c4f728be31ad625267e745a1b3c8178d1918b8f6aa89519d008694df3b33bb0d94e80469a8d32a26c34c2446d10b49e91d3ebe1de240c0d4d6bd2c12f04961
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f07d259c8bc03e4f50619c634d0793c0
SHA11bc7f136b284fc7dbfb7f4b8ba35ecfafcc25143
SHA256de5bc128ce2be7313cb1e45609a6c3611729809a94095855d167ccec672782ba
SHA5120cdb32f81bae9b8dcee3a2c56bc1af82d423f9444173c9ffab5dfe091ade3aac7d730e42341de6a1736b74c1c5e90326418b15361708e186b615a8b6a7c9e82a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51467bcd5f6ee1293fe87d65ed5f31e59
SHA112ef6aa4c4dbdf48ff32b9aeff857dc857ed08bb
SHA25659cc2f1d048524bd67396aefe3ee5debdb8c80e68305ebf7b2628fbbc1e482bf
SHA512b5c67de5b190478f1dafefb54a69da554aee1cc95fc942c0ac7d14285db2e21db36c308702d7e5e24e534daf9b124d520bc0ec9a6acc9d3b1403574fa6fe9cb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b2485a44e8f69f1a2804ecb58ffd7b5
SHA19a7d49f101c3b29241e57ef646a88e1dd41b8fa8
SHA256763ac83181be27968f95140065cf61b3aa7a895f8590588ab577d4a0c41d40d7
SHA512bb26ce821a6cef2e383a683ea15b47fda9d0fe3bce030aa2c93ff4a210bbe2d5043e7db1cc8dfbfbf7639ceda6da0d2979bcecd86d4b513a7fbebd5f4f2e2184
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52248f00d40e00b3b972c5fd3d33ae0df
SHA19d6680e6a738d6c486d460a06338044896662aaf
SHA256e685ca06f8e1278142753a3a124c484876229bf37f714efb41e2bc582435b3ed
SHA512c6c2034945304334cff61fc44758b3e57ed59c18851380b36332da355554fc075d2f9f148c91481236cd787f5ec387220af0098cd1bd4876fa37e88fa3fdaf0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fce2e88cd0f16e9dc76bf1b87182625
SHA1b3b170c89ac9fcb223d47ef03c27e6e1ce438045
SHA256af345003ae597136717315781dbd79dd670cd14ff7d78de3cfe8b5de3f3ee637
SHA51273d426f28ad7cb536d081cb4ceded143ae9aa54eebc868396185e0656a820d3a776e4ca60b2a26af4579648f79497c3604042384d29d81f3ce5493ef712bc26a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501f3518622cb82e3aeda8b691cbc555a
SHA1af5c27418aca7ee3cdd26491017b3e76eb85a51d
SHA256825a3d5388706cacedbeeda1e044a7cfd484a52b31002847da7d98d2ee1f97a4
SHA51215c041156a12ca5007d576a3fd994906c82cd3a3a151d054d481d46c998fadbd287673404206e9db51f2ce75e2efb55893d417ece408dc0f58be836e56d3561c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568444efd4e39f304309604da11e6970c
SHA121206c8ee3937b45420457a5e10a2cf42285e237
SHA256faac0ac4841a91b7f1d347be86fdc10289edaae48f5f18cd3634893c0b65d626
SHA512e077df902145be423d375e3e77b0194cfeb14a97f83ff58abeb4906bdfca4bdc05e5603e3b1608e70cc7f85a0d04d99440502e467a30127636d82d008498bede
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51240e46b7b7c43495dd65b77ac796446
SHA157f40ef773086fb1c0b0cb15b9fcf87294c89e72
SHA25624a91602f17e392d407743437415f0edc67421e2a1dbef3b46cac7da3d980bf8
SHA5121edd854da6149846ed287ba12212eec045764c105e2f0c35b05026fb0f033d170fbd35aae25c9a41d7cb913b70e1be1301739daf489b46f7b1b087caff8f3687
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ce77655590861c44d8a53aa1e500249
SHA17d117ce44331826c0af6c5ae1994c6199e88ad58
SHA256c17a158b586e6fac684dd0a9fa36432825174ff169b2be795ce5d943d615b45f
SHA51297816a82357276764abcc9627735a884ab00d49239d380ee0e009bf7e417ac80ed508f5c846f56b3e900c80daab2632a6a9dc877ad2871eaa87ed9a2af5f50fb
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a