Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 10:04
Static task
static1
Behavioral task
behavioral1
Sample
3ef26677726a4298e7816b9dfd7ea2c1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3ef26677726a4298e7816b9dfd7ea2c1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3ef26677726a4298e7816b9dfd7ea2c1_JaffaCakes118.html
-
Size
178KB
-
MD5
3ef26677726a4298e7816b9dfd7ea2c1
-
SHA1
3421fa37dcc31c5e6630e26973cd9ef359f7b70d
-
SHA256
ba97aa5ceb816cf1ab289c757065bede9c3b4a81f4980421aad323addf077ffe
-
SHA512
45ce68cabf9f8a6bb249d53f55872a3ed89026a549fb312c1f8e5e9492a0de501e9bce11d018da2a86196df884f5cbcac717e88032a98f5aba6b4b8bd028b5c7
-
SSDEEP
1536:EbA6Besou5Lu0sN+NOKAZEB+AJa00U0lGqpD+3OdrGNEMhj8ZxbijpjU9hezrve7:MA6Beso8LdsaAoB3Odr82ezrveS+2h2t
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22DA00A1-1110-11EF-B0F4-569FD5A164C1} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b775241da5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421756515" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000c526701e2ce388ef9ea8fcb1756cb83149a77c9d8ca583f238b9eb4577b36d9c000000000e800000000200002000000001c3cd55b1d83051cbbfe8ae660bdb4c5a91072e02880b8ca9f29618a64dc4b82000000080557d73b58acc30ca1b4b02ea48400ddf89f4dcd7e4fee15d640aa9214de273400000007187bf3c21d80c53d59c3e2e6974eb76ad4abc97e7ea9267c2fe5113d60f35d826606612c1bdd853c61804aa90411617c0b2f825d7ad5678119c90d63950c427 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000720e6ecfeebc89d1f356f76e1e1fb20be646b2d3a1935a20cadc4e716c68c83d000000000e800000000200002000000033a74d4d9ecb889360be0338c6c0d50d093dd035670362d563257e32774f7bb79000000060eb773b28908b00c1797577daf140035958be77798fa1954c06d701e53fe9ec4f64ca814f7cb6f81fb598174836782b76e5df7e620d719277beb3b9cada499fb0bd2f0a5214561f33414451dcc73b90df5a779f67ecc70d296e7bfbbb994777384cbbf15169623cad5d2b47a6aa65b5c41e6ec84f7f1067e2fb66be60368dd679a87ca7264d33a84b105e34b867d32940000000c605b57c75c64ae1721b40fe26051ff57ceb9a1a150c179c7ba2616337a436185dd4681f80b3c8b2b59f507ce176b82eb0ffebbdbe7bc33532510112e0d634eb iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3040 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2992 iexplore.exe 2992 iexplore.exe 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2992 wrote to memory of 3040 2992 iexplore.exe 28 PID 2992 wrote to memory of 3040 2992 iexplore.exe 28 PID 2992 wrote to memory of 3040 2992 iexplore.exe 28 PID 2992 wrote to memory of 3040 2992 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ef26677726a4298e7816b9dfd7ea2c1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac145d17b645745c82b8a1509da639b3
SHA135a6abd180b430c41bdc025490c8167fa552faf9
SHA25627a6221fdd7f5d0fd4bdf0c95c2a5caf4e72380f0fc340339e60a9190b9338aa
SHA5124e78d7ed2c54ea4e55e42249783963559fa8b4851227465acc1522db87db6a0903e530ab94402fa81313f10563bd2cc92798b3c16e18dbb662a6350f4045fbca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bb96dd4f7e1418471907c2d54f57dee
SHA1c33075567de0c1e81ed79672b2f9b6130f160b7f
SHA256e79444795752e9d38d9b54d53e54ad6b45730dbc705908e4120ed04871a251a3
SHA512a9c35e84f37640975b82c91ae4d1e25593ba40eaa8580d463fa63641084cb4fb7633224c67441c0f5a04447889c951c64a078f5798c2d777ae4b2c495dfca9d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53abda21f50b2060578d6c8a0a4f98f21
SHA1329b9aa88f503f7377ae60639c0b85002e31e8d8
SHA25639d79337838f6c962e9190614e1fff9fbfb28a96ff72f0157f8583e32d023139
SHA5128b3fb9b61f779e9ed508787619a06ca1031773d3418225938b11344f65e4ac91f25413d95aed3873b9dc486a20ff51772b3f9cab4450cab9f3adf69ac84e1b71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f456f2d3dde218aa9e1ec7485034171c
SHA139af0e1d3699dcc1e224843a226cc9ecc4f4c5d7
SHA256b3c25224ac038d65ed64c46532111bf63510cb4032ca7481e1d5e3c8742ca51e
SHA5124fd0c24ea8b2d78eb5f2dd67c1d5fd232a06a60aea53bd9780aef6bbe3ed9041f1803ef7941eb6017ead18e4e529a5af38b66446c8bf2c7ae2360bd229eef21f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a7fef8a4cea1b269200157a85554722
SHA1347d538a395bb9a7c15d38f4c182f47ce941df46
SHA2562d55f0214535211d6c8edc40019d3905950d90f8eb28b01d01f47ab28a75492f
SHA51216b899f3759b1f57ef92b22f8a16c072471c5a1f3c961cee6c1a287d213ad6899571c6d776087ff9ecb4dd71b69fe01546746ab174e3969806fff5b7a711358d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f206d36351827c192baaf22c65d6193a
SHA1184e1bd1a07c25c557c651a937128740a59355ba
SHA2567514e4a94d7d079bbbf2aac9ee51331c4ab33e1174bc68b592384901180015c2
SHA512910aed6f5f31622e80f2ebfca55290e01cabfbfea241bc933e889ce22caf861650b3b6c784e7816f6d548f487a55b383168e2ad56678c59807819aa729fdcb38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a72abae3f614cd113160e33253c06405
SHA1f36c566dc5e7f6d45827347ad6baf632880bf0c3
SHA25694dbd857be2e622697911a12dcc06e9e79b39fc8e99e093c783e4f20948579ce
SHA512975e54aad2f9a194c98af205f98500d33e8de3ba23111676e2d25c6578eb11bf615fdb417b99c2ca5567264922447062586a6513bc6f2c6ebe9de684eb36020a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c609bc2a923446985f016c996bae0207
SHA18680e627da7681ad29acca1368d625c488194e99
SHA256b2028558e07abfcf48aa550b50e04059e1b1e96d4de1c8e4a871b83d678e1e37
SHA5122231683262a978c64ee1c25ab283affb8865f2552eb67ef93dc6519d9ac64a70f4e21eaede4386fa13dfaeeef6f0aef88dbd519ddb74e86a025e50d50fff75c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3db1ec1232ca04a71e828d52a9571c0
SHA172e38b1dc4eb2fb6a203e2221118649d89be1822
SHA256ef416d488a2b3134b649ed3391702b3c1d936296f27dde51a02ebfde9d296293
SHA512da2bbec088ae71fb1e1af03e9b53526bda7e775ec5eda649b1212fbfe3eab17246c26354815e70cf2a893b5460c318032ef080e611aa1a6429ab7cca18e1b171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ff03864f17117757f2b54fd269a7225
SHA1cea82f6e4578a1d0e18e8bdfc8e4af94680ed1d6
SHA256aebfb6a994046a5d8603a85c91637bf8ae2728d9ee9daba59a59696bc60c4e82
SHA5128df42209c8caeb9ce4ec3fff2b2046cc810dc268bcfe90d04a285ea13f3cc5080dd1da772a22367fa2e48bd77d81a6d5c532dc370df1c599b68e3e28daa898be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bc7605dfe2500b82e64790a2c6eed15
SHA1592691d1e138de8a5fef8d524a1b8ba44f772e1b
SHA256a3d82183639d772058a64ac5e4c0201d208ff2acaece8461d1e739f8866cc53e
SHA5124ddfff8a88fb9290ae8c97ab225c6a39804cc10c4338621352d7cd8ce63f2c40a3c07cf35f26b356331b5ec925b582a5b57b1fac44edaeb64c2b1326b951dcf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54159c1af33838531eb7813b9cc5fba38
SHA1c1721ba625ded69618aeb52285dc3a52d43c5eb7
SHA256bc2d121813356e047b1e471c755f2e804a8d623506099a0bf16f88f16556e961
SHA512c595834eb78636590ea10ce8d4f2e761b2ad2b7e9f49176abd0866d862f1e4abadfd74ec4c2e4814b778c5a358217c97d39b26c284420a344bbf538242b7ca9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e59a1c7656d6d93c9a2333e1c205cfe
SHA1038a7aaeb6208fdb3d3c2aaecf936d97da7f2a83
SHA25649f90c68dcfffc77c497ec9d2b73c7f86e6e61e4c95cc8b731f7bcf8d3c8fa56
SHA5120a54ddd04942cbd3a92a071c93b33416d9766b9b32275bcdd6e3267700b754af3d8643cca95155802d840ee131eabc46fcf40af97418703ea41389216be417db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52473a71f5e3af8fb5e3eeb1aca81a3d3
SHA1d5f3b372281b4a1248c91492727d5fb777a2d451
SHA2569d84187ed9409f0945ce805e71bc957b6828d3145929dad0e0f2111485276301
SHA512bcfb1874122024617b8b49ae406f564829d260ca0ca20cc9e32b7710c95085f077e3ebdae4a06f653ca8f11ced30aa42e259afef73c12e32fb2ac5b6486e600b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c27680ebb26ded358e53c184ce487492
SHA1792ddb45f30772213fc4c6e59644da4080b7f47e
SHA25687f96eab6bf3714b0afc2d6ee0c861ed95a54d3722de81fcce9c922a0e34f700
SHA51204bb55a896627a083f4d92b0ab7f1c7ec376ee0666c84d459495711c5d557d480efe9444cd6321c9a17620d4f05288169ca1a3580e63ee3bbd912b94d65cc100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581800837649e6e672ae8ddb2aae68dcc
SHA1b2a02e92b81028c8db41096777249d1f0e758b38
SHA2565158e4d12508adbcc21424fefccb8875cbe25328d83be3162f2e3a8ad4830327
SHA51286801dbbc870c92facb98f1874447deaf9a38c97ce63fb731d7c582ac5a48d0a79a42de382c55d9202c89d06a18c910691907bc93d8c8f68cac51de2ba73cff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5917d43c112eb3ae8bba21843fd6de1d1
SHA1e690fcb2ad3caad67cdf7b801c7f623efd67517a
SHA256f0a2569da889508a336f6bddf040d268969ed8471d7efaf6b950b9a1170d9919
SHA5125847f0d4fba4e5a070e38ac1642268fe9e8827db0d8aa350939fb3aaba32111af7e94fab7399e6c9c73b3f61421cd47394475eae224664db1a3331b01b2a829f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5027618a69d95783c0e8529c7c9082829
SHA16bacf99d0ca0c4607953d0caa4c6bb7d721f6b04
SHA2568b81deb936dd4b8007ba318ac2683cefab8fafd383e3f125d8070fa7afd84ebc
SHA512394494e39eeb768522c1ef869b81577312a5b95af44cb7306fe67b70c55c392c7a1962f1712e5ff161e7f8927a607371bc75d7a0388945ebc867af2ecc37079b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a