Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
286111026f798046f6cfab6c3154d8d9.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
286111026f798046f6cfab6c3154d8d9.html
Resource
win10v2004-20231215-en
General
-
Target
286111026f798046f6cfab6c3154d8d9.html
-
Size
3.5MB
-
MD5
286111026f798046f6cfab6c3154d8d9
-
SHA1
fe671fc1810d2159efd4ed846083a30660e9e9e8
-
SHA256
c226ad525b77a21f5e9d92af3a88830b696050809e98072a6ac0654fb514c34b
-
SHA512
ce951cc23f140242f54cac2d765e51dfc7b9cfddb94af8a60bc17b3324e7bbdb5ab3eda390280946406920825ad9a33597ec9ac91b01022d9131f3986e55a286
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nyn:jvpjte4tT6sn
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA6A1671-ABCD-11EE-AC1E-72D103486AAB} = "0" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 944 iexplore.exe 944 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 944 wrote to memory of 1712 944 iexplore.exe 17 PID 944 wrote to memory of 1712 944 iexplore.exe 17 PID 944 wrote to memory of 1712 944 iexplore.exe 17 PID 944 wrote to memory of 1712 944 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\286111026f798046f6cfab6c3154d8d9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:944 CREDAT:275457 /prefetch:22⤵PID:1712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
13KB
MD59148323922c0f67285bc08c6569a155b
SHA108fcbe1cac54e1b08fa66119dbbf6353b657fa1f
SHA25690406b6847a1c0a3af1882cca078f6988eaf451e1b00c933d7d5b9e8d78e7a77
SHA51263b70bb168000f962cafc804859da7ba0a2f704b5dca9643ff1a99846c2372c44d9ba9cb5a4f169a39432ffe1793a57cbbde91be292928bb1c5fd950b6f94622
-
Filesize
13KB
MD59ab51d83f8380060506657010a5e14e9
SHA121dd12812e8cb51672645bbbd94e889d752f3a52
SHA25601f1156a4fe7dee6a1dc9b7b44c7159d96c327f9ecae907ae9c08d9a01f2235c
SHA51237155a13abba4bf02d6b3ed29be218ad9c0516625eab4477929e399bdfa19e07a9db60bff2eb787dac8ee708209c96215b95e05adde4754d341252e635056ce3
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5a593835a0e4a2c28aae0d3aa4e8cb0b5
SHA1b2fb0d380d9ba5594e979c5f2d03681e4be25b30
SHA25601209a4bfc39c968e8a62cffc8e3f29eec27ca12bfc3cd1823324570ed6bd2d2
SHA512416be9de058980920f7dc58dbaf3c78f57b786f6ec765ef3e83321b16846a4d728f63de52921915113b310756623f89e8c8842b3eab45aee828c325bc98f94b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5450db445cb980cbac054439474406066
SHA1adb300153ca244a09ec0b1dd4490bbf98f282042
SHA256dc075e96f6fc4eab23a916de4458569150800629a7582b05951a223acac3c53a
SHA51223f75bb6dfba63df24c662f18a22f614b0cbb505788f6c86ad49b88a33e801a0c044b458432029850c9ebadda3ad498be785d0407d0322da08f0cb18cd087caa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526cc99b054c0504ae0f284bfe2b569c6
SHA13a79fbabda2f95c0a364c21c7c4c4d0b30648b97
SHA256ae2daf4c922998a489d909457dfaa034cdb4bdbffcbaf7dc43023263eaf14cea
SHA51271992aa64bef2a0a7647abc7a4e6fd56894dc149ad19bc3c1c0522c502932be559abc945334c5b22156505ff4a5bbc11f9dcfd2689277d2b41c9b516da52842d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591d12554f7731dde575d97e2e4110ff0
SHA1b666ca76d16b03c2bd163867e384d165d7ed1561
SHA2567936f82068d443e2acdc001c15a96c938ec8f86fc7afa0fd17ccf01f16d2bea4
SHA5122724eee3f3d9a5b91fd65a47c5ffa53849655b90723264ff2cfabd37a028828e6e742ae1f234d8f3c04da4485187d67733badb9e03710ec6b2a32d52cdd009ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a35a6c2f5f7eeb1f123ed910412a0ec
SHA1f0b0b433082cd8f81d2e030df6026dc139d42159
SHA2566b2cb5e3d618d27e751f202efe6399a8ce8cf3af891958a99a2ad1ffc354ef04
SHA512cb973e01e3564cc99db5e6ab2ca1426c7de5cddcd3db7f10c24314ef482c3db51dcf92527767b6b85027bedcbfc73c0b453bf662ebe797402945a83964fd4cb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5232662fff401ac64b4219ba9a0a31e71
SHA1a388d6843ce44572d897fec4252d4b3c30bbf990
SHA25695a4bb9b1bd2d1a4ff9938cb2300346b15081c4b61be3af52ae4ad99fb91fb91
SHA512f36799bf749005a98778a4e2d38b66a60f89de38c5826761b3bf6fc037249226d3032b9cf1e8f0473478183d5f5dfebdea5995ef810d656d092ad9c1ad5fdae6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee859f89ad5a457e94353dc5f2fcfa43
SHA1edca25ebc61fc7b44b67d89b330a75ed930cb498
SHA25611174373fc026edd8d752ecf67037eb2cbc119534cf3fecfe07afe776a898d31
SHA512a1948811a72072949d3e9affd0940c1f49d16a6f4b716aa6e84f9f97d55ff60a7fecc4428a6b9fc405b628ef295f54f80ed7e3db889b2c40d7ab77330552a290
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533957458ca8cbf14e6edc14a889c538f
SHA1c9a1f116741008d65396e323d63ef8e52d413d6b
SHA25675ec1b71a9f4e2103dae6cfcad103077a165f7b7e29ae7c0a3c2a2c4f5a5927b
SHA512796fcc33bc4fafc7e2537926f3760e1ffeb5b6eb774135e6d0bed085a014473bcf1c4960bed7f308dfe67a6a2010a75aeaec47438955844c7c02088afd4ad1ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1501bc29f0b110759a8d443f0d6b466
SHA131deb817eccbfb5694f96568d5b004816bcb6488
SHA2568ba3ceb9b24fff0b2a90b692e4f7f2403849dfad1f1ea7501ab6f609a64ba8af
SHA512b1b89855e6d5311a8a836f3f7b62117aa9f44a4dbd7b35f76fbe4e811aeb97360a70ebdf2940ebc02fe0e3fd3f498b0dd30e57eaa4373082d71fc10f3d1ff5e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564bcb8deb70d99c0707960b7164324eb
SHA19cf1e90624944842ff202567f9e3a2e8819709a3
SHA256fa3cdea8cae61c88b4db2cfcb46755f3e3ae3b17bc5758164770d5c1dd9ae61e
SHA5125490a197230c573b3305c1f86e10c4ddbcc5d64b2ca67d9240b3627077bb356b894f0cb5e0a76ed2a1082443f17dce1ddd446be446664e0919182547f29da64f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e970d125e1eecdf82bd8048226b5d2e
SHA1ca385e9270eaa3704562b089a5e9071c4e569582
SHA25689d2956c9ef6f13223f56a3086d9e92c44c59c182271517232bd33556674c9c2
SHA5126153ee79367ee9c6fab04705241ea6bfb4b0820280718abb59200cb58e5f2d3a8aaf27659d08b34a953492feaa5dc7a2d38ec0257b09bd1703210ff1968c93ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7e0f8cc1a1382de4c3755c77b8b9370
SHA16645cc10f4ed5d86471f679530916e98ef8fafb8
SHA256e5358ac470fb08e40529b34ef2cc0e753038b14299bd976dd5365fedf2307b0f
SHA512a9991b9f65f91c019f972afc26807ee8a412aa899387c54faf670b03b1b1ea9acd5fe5b75430643894325514e7db2e9876e55bd2eed74a4f38de3529109a23f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56abc105eb29e1579b44009f75436158b
SHA18566716a2de1f629af926173c3d192f40753324e
SHA256d5c5dcf81a43f9649cad74ab0b309b51fdc87b7e345811b2cfa2bf085e9bd260
SHA5120849eb9acb8c14a87428801dd34d9c4472c34cdda4641996554e5c9cfbaccd48e10a49add818aed4a8e8a011ce0aaf63ca15d35ef48325dc82d445dea7916a52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5206921b3724fc7bd563565d2f6b26f2b
SHA19a7c17f8c2b38af1e4c8240ac16263902b882c67
SHA2564bdd4b745b5d8773f148107064c6e9eeabd5be840cddfcc847f929af669bc7df
SHA5122277740b82aff716a29424bc42905de954cbd7ba112e594f2b89c2217138abf958e9290601ee54d4b367e294d8e20581fc4bed49e25074e0bfc6634a0f848546
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd354b74937497e7f5a7f1a54a3930dd
SHA19089db38c6a031d698731c62d3a42f320fb571a3
SHA25678d5044327b15c1ec5b5e55bbf090a5b52ab32968fecc4707906d6371605fbd4
SHA5124f1927eb1799721132001133064d9bcb160c9aa9c066b2f5865da5c37eb1c7ff606a77b0d5ae2cd4c2ddf99a6f22d1cf3f7f963bb485ac4399788286e5c845e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbac6cf01f8c56e94d42e6584af11678
SHA1dc5156e6bf21c2d2fd0f4493a36a1f93ce4b3256
SHA25625a57c5ae894f55c5ea5461b01178fa40bd715a2bb8c50b8302a6af136c3e80b
SHA51216a58a4e3497fe8d75fa0b0f9c0021ababb50c2165effd8a4c926c59d7934b7715c95d90a2da947b523978e5cd415112a83bb1bc048ae0bb107fa4c395669080
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ae3e04fef7b3e893536df058cdb7a42
SHA1d11b2d13502abf9246e894a2f14f8124a2fd10cf
SHA256053d0e059b67512a9613fb1e07bc1256f7aec810e14073fd48b200669364fd1e
SHA512714638b29995b72c3648763a543d632425396dbdda87341b302984159a450ad6d076fd8deee00c1a9f8662af9c523a1090a9704a8ac52063aa757ed981e7483e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3f670a1f4e66c4c9efecf9cd680d883
SHA101058adfe2dcb670fa534fddf23d907ef051981f
SHA256e25279bb1b6f155b381dcedba3a3c5a1b2574824eec1d96b3e7709dfca2afd7b
SHA512e505d17b1b95b334026af9d95ce51b580ecd3c1cd78d00caeed6b02d87205c2c738d8e0482f256775df20b9f51435383f8baaf4ec980e6cb71258bc12a8246e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531dc0c97733f1a09ca1477b59ba51b36
SHA1e7f0b815b82728c9193828abe381b4aaba42cdc8
SHA25632a89d94755dc21c2991bcd1308a9d27eae72185227fd91bf7f0dd79b25ff7db
SHA5127d29c8074964994010f04a68210a9fe18332899dc29eee8d5335c8ee351d42b8d923d387fe294dba6b0e86a856ff5fe43a28d598b10ce6b8fdf36a9b0912bb6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b74f25ef1d8e723df24970db124a21c
SHA1eb0018ac330d60167ae5ef3d78e4415f20d0d290
SHA2568b37099bfa3bcb79fcf48dcd6c0ed6d50f714ac4b23480bfd90d77bca8e6beb7
SHA512548e664d640b6e28f439d25f79ecc0d11bfae8410155f7017782ac5aae1234e1dd2450ee89353a5fe7de229e79415daac45473232dd9e0fc8cad72b3d941116f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54354df863647ef66e5078820967bb9ee
SHA14de3b28217d7ea7b90dd6f9c3e44af9e0cc6c74d
SHA25603053979522d62a853e94120198eb75ab179232d59cbe7a82681263dc8e2c421
SHA512ed71cc2ca0056809540e5c0ec6ae0ce0f42e5e05b4b5455c7d38faad78caaf33610d1bdb60e7c65faaf2616f1832f7554e99db514d27c8212ef5d74cb8b494bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD579b9f918097fa851810f2abb9e44c269
SHA185ce6d5f908e10ddcd7439ac1d7a0adc151d2522
SHA256d3a4268bc49ee84fee9e97fcf79a94c5153c078d2d739643e702d053a8a60b34
SHA5123ada7ad31c67b0ed690d0fff4413f7e76fc456dbb5e2a53c3bb7c3e097fd5f3661f2386b079d86a140d5a8c5b14d9b3e11e3ab3066d4f345ad10c6134efb9014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EU4KMMH3\jquery.min[1].js
Filesize43KB
MD5494cd8bbabe55d67866729e310ae41dd
SHA1a3310fb7a600b054344c5e4cec51460bbf3c856f
SHA25696ce41e15ed37cf88868b76b8a0f28211be8a08d551bb9f4a54a19db8c92dd9e
SHA51205a5a604fc8ff6564487c889013b7e644d0f4e062a45dcba81b70e90329063e44e5bdf16fc3c2d47c3491ed411813f49c40ff2667983ad99b593e6d9ff8ef884
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FJVRNF57\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HX2Z38KS\jquery-3.1.1.min[1].js
Filesize51KB
MD52f22f31938c0bd2f3e3a76ecf46d1100
SHA1015e76a39d76047166e03eb993dadb1f65363e2f
SHA25676dd52302521d98a0bcfbbd8dd16ab0cec39b9be68968969083be91e498b4065
SHA512d292feaaaf14f4c875283dafe20f27facb255ee688086ec9408e9d52b757a71dad4d091282c94fe7a6ca9fba0f30903ff2909db966b4fadeb3c4e702e3669eb2
-
Filesize
41KB
MD557027d652f06ab7f4d6e602ae3a384bd
SHA1209db651d460e0a1a203703086d2c2d0e6d918e0
SHA2561ac6bae0c93b65a81c3a96c72316a66fc6f3cf9bfb3c66ee1be39f58825c2efb
SHA512ad1197ba5a486405a521e30b5aa0009309fe8d0badae56bcbc50acfa199e2dca1cdc09154222ffaec3157d7047dec81d80b2a8038862ff587531ac41eb97e3e3