Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 20:11
Static task
static1
Behavioral task
behavioral1
Sample
30d7828424d8d070f9987ec02cba5097_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
30d7828424d8d070f9987ec02cba5097_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
30d7828424d8d070f9987ec02cba5097_JaffaCakes118.html
-
Size
20KB
-
MD5
30d7828424d8d070f9987ec02cba5097
-
SHA1
9888bc137c505afcb4553ec7515e5b14bb37a42c
-
SHA256
548ef8a45d8847387858e335121263b363b7f5ffbb1a6931c83b856fd39d36d5
-
SHA512
79c731706df42c4e18cd89c0a2db314445e6aaeb70b163cac66733d1dc8656a659b4bf7638fc5a3a57f7a860bcdce82a88d2a33c42d1d047c9cfd5b7a3dcc3cc
-
SSDEEP
384:ziyK9XfVBD8c8Q3RtI1K2Q38bYY3bYEimTD4QAmccfIk9xheJlzVc9g2a:zirgcf3Tf1sbYcbYEimTOOIk9eJ9qgd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421533758" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e0de5116a3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D49F581-0F09-11EF-B195-DEECE6B0C1A4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000597ae47e91f790a18b5d16baea783e6366e4722715585e24d14bab8c72f4bf5d000000000e80000000020000200000004dcc257b3dc03cfc8ea7deec3c3e5fee26d6324c846b8ff0cfe8c19885801c1c200000009e6a974acc92f558a653038ca3c69ef0ddfc5959fcf9d2e2d32d847934c0f70e40000000724b34c47d7ed613e2b713f6ca1d08cc09447c2370f0408ab592666ecbacbe62514ce88677824b1ea2044980e9aa519dd280b410d77fd6c9573e7225fda75670 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000497d87f6307b1d77d386a8a05bc0523afb69ad262bae976f19923768c005da25000000000e8000000002000020000000529bb3c3b7390150ccd823ffe37bbfb259ee2752d3c138047e8ad31fa2359c1d90000000d7e631b7d04ce58b3a7843ac6c0fffbe6015aa5704e9883346eaf7ad6c8ab9ccadacf52cc8699c2b379813c53d2cef12256dc95412bdd4bd479ab4256624afd5f2275aa5e3550266a0d4c6fafcb17f45dd0d2c02c98e32127653416b52a868aeed4608628113f33e43bfbf21910044a303536d69a012eb8d85405202226ddf15e0c2a1a9c6fcb1e2528677643066880640000000f0c106cf52933c0c37df324b8a1c6c13ca8fee2be1a0278bead8445a92ab9d059468484ab524a0eba1015c8c055c5a72f8df4393a486b4303cd2be6ed474e1e2 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 620 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 620 iexplore.exe 620 iexplore.exe 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 620 wrote to memory of 1936 620 iexplore.exe 28 PID 620 wrote to memory of 1936 620 iexplore.exe 28 PID 620 wrote to memory of 1936 620 iexplore.exe 28 PID 620 wrote to memory of 1936 620 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30d7828424d8d070f9987ec02cba5097_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:620 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8a15c8a7b3d08a29d477a7350de1884
SHA16b1e9023d21aa0cebcf3bc14ebdba6de9f6a167e
SHA25653d1426c64b7585602d6fc48a1c9d8a57b057350ba27fc6ad920c2df19368edf
SHA51243d7fd12e5bc6bd42d7f5caa986627a5fa96f95a4a4529a55257f70c1abc09bd4b878010ea753b62609075de5482e4dcabe6a0940e74364f06797f3a7997c1cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5442c35bb3cca7c90bc712aa1847927d1
SHA1fffa361387b6edb1e45edf1fefa585a1e050a40b
SHA256b63cb0262a333879004af4e38b8a3ee688f64fc6d4fe716ea211a6ffcd8611bb
SHA512769124eb681458a0dd70342eafd4db3d9e800951bfb8e14755ec422888b946e99be88a69765144206fa68a384e157ce9eeb9978618ec5dd889b4ea5c47cbca6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59205996e5992998e9cd17d6f346335fc
SHA13f663cb8516c28a258cfdf2f22a611acf861b66a
SHA25683a025f3bca2c2a7a59c04c7612dceea979e964cae4d404a4c0af305e9582f7c
SHA512018469643e6bcfcf345b242eac90f1862344ae28df5056035365e573aebcda1fd88039de1a324c6af1f0c17c80c18bb25c68c426807c4fed4db77cfb919b9d1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f89b9a7e9460aa4171acd25484676512
SHA1b159f6a97cd186c47c711ea7e2e7aa5a70893ba7
SHA25673b7c0df24bae4c90606bfc5867525bd2e874c6c9aedb9e7640f0c814a1244fc
SHA5125eba272804943116a29d29e3d5b174b69dc49c77c930c3abc4d38a4f50f47135e53f21a551007a00108d3506f6e1ab8b0481dd7a992a65332d82dd992973ae6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5533faea0265aedf9828993cc9e148589
SHA129802c0258d852fb3ecad53b256913c4679d6626
SHA256e38f51737188838040527d82ac787e8295d58a08e0eb23c353e40b80ae1c6d75
SHA512b1e3a18e307ccc7f781e3cee635dace1f414c62873d52c7487cc37bb4f0ca535ef1cef62e7c2db79c0fa6d1fa8626c0dd5a7f18345c2250c7836508bf4c7b956
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580b135ac5af8a9d83f90412b883ce4ef
SHA178240c19fd06101a2fd0e518e4920e5804181914
SHA256085ca0310b38fe4399aca305dcb7903448c94ceda4221199c98162d05f525db5
SHA5126e61663fcb5014baaf10239f061385d2f3b5a30fc41a879e04aba47fa213d6de65cc57f0ca50b53962f16529f7540457ed63254913c55149a25e69b10d31b0ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56429db4f789e7c4b2b15f31dedfe8a26
SHA1a176ab42f6e913b9cdbea43bcdb8a178423ac87b
SHA256c83d9848055fdbba8ae224c448ae05a8918b036bf61b4036dd646f017604dd49
SHA512d7d0239ab000b904ddf5730fa1f71e9c268287e45a0e7a43f20685ec31d3d26ec0deb9a8a90c4d6bb44071ec0041910f032d4b6bed6b75fc1659aa04b48a713e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6911b1138b3a59d2d6d6ca7d41d7c7a
SHA112cd8a90cd48caf7f182da112696299a3953efc5
SHA256b6b2d78c30f15809dbe2fa6bf85b89f5fcdcf74bf160c9f7a2e16a9654c8dcd4
SHA51276c472362b1026a00edfb165e13e580ba8dd4cb32a1f15ef2740b60641ddde65e555d4ef591eb20323cb6d46bf29bb996026eb104b22e01904ad4744fad030c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6393cb4ec7dc1a70b11250a966a4297
SHA1f1f67f3a9b7debdc819dd145bcca3b272104f786
SHA256539f5a4d1fa2f4b6a84ffe580239296b35c55dfb30ed315d2ed15f68aa5306a6
SHA5120296d271725f7a595c757079b128e537cb609fd40b16b7ba48da5b3033ec5c97d173403b05687fbeb5ef7f711a1e79163311b74565382f587cc537de826f0e4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a9a8ae087f6b04ceaf7da6a9aefdf67
SHA1957d0392b1acc9dd0607757452dfcafa056078f5
SHA25668681b05e8a45383fdfc7a8e28bac57b838d98a2b1dffddf3c0ee71abae5b396
SHA5127f657fe141da0639e231295db0155f67f7341f5db77a60277f8776d6060fb6b86177e5d7f66faea8c3ceb2742053406ebdf58db4fbd14275015b361f54f6d145
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3f133a2ea6a47730f0054f39fb8dc77
SHA1b14c01c5b9904fc72bbc7342e072d2d29e454a8e
SHA2560405b04c5e45cd248753513f371178b0dcf588d69897615048ec3eb3e4e9f6d0
SHA5128a6263f7ef6f97e3f6dcd8cf2a3e74a8095a7b322d70783b376717f067cbef8b3e48c8e19dcf23c1b1df7e8c768993e95fcaef5b9cb57b23d80121df342052af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3562841dff5dda6c5505ee7f8aefd55
SHA10b669ade4273cc6dfe96823b95a9a269fc6c1f3f
SHA25655921d152d2fece21762658b20c5471064d4d5ecfc86209f02cf1e7fd9609107
SHA512c54b133b08a45065d9046d0660977b153797a1d501902a7ee204743a8aa101c703e066bf777ff4ce1ee34187eee741d8af0173cb3759d1b1004b4e8d78ecd9b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53462c2aa201b24a217331095242ecbdf
SHA1fbbcb32e1a897d32cd6e4b98d5eddd2e23c40acc
SHA256fd6b5084eff7074bb05d1199ad889c416a2674e81ba82b675500bcb0fc871d92
SHA512a20f732dfa741698cabbfb57066a4e4d8aace0155e502831b4c9f8f5dca046690e4ebc482549d9b476b513ab4a4259779bb279beb5b069b2cddd27fa78d6ad37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51068826fcb379909c27bc3d36c75df44
SHA12040086f84be80934881c7d0bbd24262e9e4ac7c
SHA256669b9d65f9cd316d5e5d7dd6d8fefc06c75401024cc74872a75f628d2fc531b0
SHA5125e0d1ad46258ca3311f0ef7e9be5bcc42bc1419ac96ef3541303bc85d0987bc5ba16b1a3d66a9f75b1ea5a439b390e3e6db6979328bbe0339e3b0f9b0b5af212
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538696d172833f6eb0056ebfba52bd266
SHA19e5b0dd105526b501c54fead8a26dac5ff2e1d7c
SHA256c9fc93c270c010dd0de4c32f90f2f6317d5c8b5ef0d4d9b64cc2fcdc609b534c
SHA51232a2592b4496ffdfb2a383c93158e20fdb0a85c187800e2c3e5668208b211682bb4486c90d1ce160849fafd7b396e67f9f7f1d891790c3ba1fd08d90fb8af96c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b26159a836d68b5fdf39d24fee6f45c
SHA10b6e636acc55eeb51610851f0bc71d14ec24c766
SHA2561204d31ef9522ecc13d4eb4b06cf2ab4fe55a856070ab87d1b71a9bf5da87ea9
SHA512c2694fdebb420733c6455fec613b7a474fe9b5616cf66a047f90bafa90ed19c5a9679b13f4b90b801267bedbea2491fad50f09d7864057991a0d80e1a9267267
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9257d4de40f8cb5dbf658cb748b06b6
SHA116ece62ec592c8921b89a518988a9445d5f79d8c
SHA25626d4d86a439c8f60e981cd42a663b86f38e2091923bd5da904e3c0b1e114b6f5
SHA512257d6bbbf11406c23df9d0aa0979fb2f227871b701bda12fbd831a50d05ef1e6d947d26fb4981b466c744c950384a4966553c29a9d3a74abe1ee78b26d3ada74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5593e60ca62c3813dc8bb2f656ace4a7c
SHA153536fa107d7fd49a46ca2c3f218537ea707d1a5
SHA256458ba28e38c34a922fcdefe33035f900adc90f71e5b997b53783a9241b6da96e
SHA51211901340b0ee21380522430ce6fc0d494b56ac3375387466257eacdb679312765b3097b15b221ab1767b7d9f441c9ad1e02298c4d15283224aae1d3c489253cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58830034dba8a25b85d7a29946615972e
SHA197fd5005833c1609068ee7b599dae621c931d5e8
SHA25653624d0a305ae971f7e9e603b8ecef9cced1fc59f841f2a912a4bc93a7451562
SHA512e57d51ba543e716c95ca2c66806078325ddf04499b9142025745e4c338710251fa7654cd060a7ee1a165588f4425d52585c4b307211b3e366e7464b86b97238a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a