Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 06:39
Static task
static1
Behavioral task
behavioral1
Sample
5dac71bff1f2a28ccabcdfd9d927d1d8_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5dac71bff1f2a28ccabcdfd9d927d1d8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5dac71bff1f2a28ccabcdfd9d927d1d8_JaffaCakes118.html
-
Size
17KB
-
MD5
5dac71bff1f2a28ccabcdfd9d927d1d8
-
SHA1
844526e4e16fe933bc7e88d867bc4a0ac03dca7a
-
SHA256
c73bbe9d9471154074bf6f839e486f043acb8411e416b11950475bdbef442e7d
-
SHA512
1844807710270ee5749fc01547cc7747f649905293b5a50956c355c709b0403a43872780ac00b473da009d6429c1beb26e299b27ebebf8e11f75e248d70acdb2
-
SSDEEP
384:WizkiTOvAc3KZx6T1m+QJFQ0zhJnl+VPVwEuRh7F4NpKxKDc:WbiSAx+d0VpOPVw5Rh7usKo
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8060058180aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000caa2015de46f89ce57abee00c9e250bd1aa04fa6628fa64b5d20e36a74e39b9e000000000e8000000002000020000000a128005c63cf2d1d8a351e87c6ef838c43f23c0ce1d001b0185751fe29ca758a90000000e6cc44dbc7879a6bb1380d3b0945600d625db072186cebdc0b939705e20be655f8febb7a22e1c7e07cddaefb9621d97702182f245cb144132638f703abd053221feac2873dc2d2eaf2e6aedf788fb62578592f5532327468755d6b5c3356a2d9199488a7ac17ac5df2589273bfdaad8c1efa51e32698846042a9556be90ae10560bbae67e8088d71c6c72ffc02bc9bbf40000000c217586b29704db5684d2c1d67bf0ac62f70d1c7a28e82ebd05ce994d0261e6b796bed3ff5824f8712115498ce7a173647de918d351e74fb88904599ae60088e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC84F721-1673-11EF-B393-E64BF8A7A69F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422349021" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000ab7453b1ba296788e8b1c7b28246e165f59a2e53010a3b82429567a1a5c5dff3000000000e800000000200002000000088e3f29e7d28e1aa25cccdd271c3d0be4d86492faf7eecce75b275820d02ad172000000091614a4a60a8febe2a7e14d8304a7b10c4756da31771fbfd4fda9ee8301aef48400000005290b1a972f21fccfffdacaee26e71061c97428040edae0272fd7cd8e003c7f3a76f2eec0a332159c2c38d0d439f8b4e442004594578fd87e6b2c5545430cf2b iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2916 iexplore.exe 2916 iexplore.exe 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2916 wrote to memory of 1092 2916 iexplore.exe 28 PID 2916 wrote to memory of 1092 2916 iexplore.exe 28 PID 2916 wrote to memory of 1092 2916 iexplore.exe 28 PID 2916 wrote to memory of 1092 2916 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5dac71bff1f2a28ccabcdfd9d927d1d8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d410ef0ea44ef45a3d2c07476ac5e078
SHA16990b311953bd761314cbded539b226bb96b1152
SHA25638ed832add169069cfec645d50412ba779ad7e7bc15ce5e1ee5856ed719a3684
SHA51265e0a1e89c281f216653545df4ba09a4cfe2214e6d0fea082d115c1e1fc6aacb46a9edba8cf84386d041296a9155c274d50cb92c8d195f6c7b129e0b68f6426c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e2a6c612752298a897132189b197b6d
SHA1ac369a96efb720870da3386440e4a5efb428b740
SHA25669e2e5f0be7b74c12ba252a283a4cfdc8b4e73e9c0574b7adc6a1028a79f4a15
SHA51276e2eae7f145c904d5e022be2452f84936c6f12eff33957658ed3d5f06ca51685631b59fff2cf500d88a11ac2c916b77cb12e08eeaebd0ed90ab34a656f30bfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54731ad77cf5d6d8b2939d36f51b00d69
SHA1b0a1739be48313e02ed937995b808d7881918079
SHA256a90b8d75fde5c30200e7f877b2deaccbc3232e32c7399a4672863e56cd565377
SHA512c336bb78b0f06b15913ff7b55c1a296a371ef1ea12b9615d9bdf427e65fce042f4cdaa0a69216352898abcc9128474fb7e1a79056fdf01355c9b56eab22242f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560b2c7289e531a9a858be9ff2510761b
SHA149c5ce885b50b2b1149ea0892c14df6dae4cc10a
SHA2568f6c4c5e6b87a076d3ede3b6d34b2fdb85bb97db1bf8466933c57157a5d69f6f
SHA512a4a3066b73802b7c1a36bb5cdb9d241fe279bf66703336b0e9b7d139b9c11e8e26ae2a937c089e47d1b29f8565c67f3b58f67c0d6b71941574b778fa9bacc3c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a4e9e458609b63fc6b5d4d1a03c292d
SHA1417ccce76e9bf4e2428f0feb18b9719e6eed74d3
SHA25640ed23e4eaadcfc48060350f5584766d443e139808527b328def3513d75c0d64
SHA512a944110dad7d1f79c62454d290b10f8991cc489d1118966df14da350300439123c6edb0e9f306196e7f6803d792ef6a005587a81d4729370b52a4f7e7aa58570
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d6cb23790a103f1c5484729f9354a4d
SHA1b8973fa28431604eddda37d086f29c4134c47dfa
SHA256272a97419957f82bfd4ed204a80d6dbbc1d747cb5e5e99bf41d3ab4c240ee2e6
SHA5128285a6d2f9e5bb775cb64858cc678bc37e3d3cd16511293c799d3a2a18fa413c8add0c001696bc50990eca9fc8223ae9818a9bf3c37fcbf5e7650ed943caa261
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ada9a370f7080525af64e1a9e33d4b90
SHA13595c797f274c0747f50b1ad47914cc5f828e35a
SHA256d312e6158fc76cd79b9f04d66778e0ecb2a69fdba5b52d8ca767e2e05045afb3
SHA5127f81538719924a7b28b2cedacf9f8370496b25f9a00ab15993c9262514f36064e1911c439a5f6eebb3f184a9f2c230a09244b4b8a80f8e1b9040b6e3ea53501c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8ba3d03a2974d68289d72324d8a7a4c
SHA14f8a31016bcd21252476003fea3638650d6585e8
SHA25607458d53aa8db0d4a012c1a85ca96ab91a1d7b8cf5f74daa195a751ec5fb353f
SHA512ff4bea587ca1223b7ca9726ffd98a151245112a245a2544f38c649e87b1d2c0f1444727b44b5c6e010c7c4d1616ca088e02be18c1950e9373d3949a436ac02f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5822d886d8b3f6774f7dea78d90e33be8
SHA106cd08c52608409bc2454db4aeaf9273021178db
SHA256c2cd4c9701b78f3cc01c1f863906f8d79051cc4ad2da4def32b4fbf1689757db
SHA512b5d73c9efe9064e5753e5c207c08e0c73c7aac0eef753a040fba2306a0133a2ebabb6bb524c3b0972c88e00312e6a876318b011996f2c867ec472ab49602ba1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3fc75f82fe384bc31ed4429babcae00
SHA10dba1c1ccbaf9810ce5877a686a6d568ebc95035
SHA256edf0deb85ac8cec0bf73b6d192704d1a52be128bd66d87440d660da69dd6725c
SHA512337601f27e985e48bf781dbec1fe98e7bd05b6ee78b252e239359b996cdb307352a58939406fe177375e015f469344a0c91ee4d948393172c6fc837ee6aee7d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5512aa7c082e8d90dc40948e7bc4cc8ca
SHA16a960fbb597b5e3b81c290259a4bae479ffb641a
SHA2565c37bbc345f75a111d1132351d87ddfb19dfb680a0c2dc5f6a1ca54f24f102b7
SHA512824c1dab352c9d66710164ab55600e3496ff757e58772af1bfc1c0479920ab70144685a13faa0a9306d0e06c3e662d82c74889282df7f25ea47e93e0bbb59f42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cf5aef57402cd66b56a545e8ce1d8e7
SHA1ef147d86c54bf1174ff0e5db3d9cfca319185c52
SHA256cbedf76edfb03764bd38b7743198995425034c0c1acedb811996d1a66caa8e9b
SHA512e412106ee1f1099dda8ced6ea7fe3c5aa5e0d678c38e6135cb8d698eec9de7d3c4b7c998b4e76f05bd83b3c191a93969c27fc4ac77f609bf399ca83afcec869a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e57f5cfe803b47a63dbe1f135bd143b7
SHA14be2332c4d6dbb37be29d39410df690d05621bc4
SHA256b5893bff6c146109044dadbd3929eb6f485c00a7d98c1c028f01b6744f58060b
SHA512420d80e5209fcc9967c9a195ad384dadeb18a38ca4e24da1f5a8b2ac4c38c1f6d6a7d0cf8dd3037f347c754a0431903852873e7ae90fd54f85addd9261454419
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c729c7ca36cda1d44283d74b96ca9a8d
SHA1cf5c544aa6850d81fce5679b8dca6629bf1c7247
SHA25608ab5e416265a0abed2122df58af44ea0bd146983b5c486272b9dd773b0c1d11
SHA512591e2a28b2f052ecabe2490460879fd50cf122dd6adb0624601456d3d6a82d4f32838122a99bc04257a813aa85242c19467d0aad23a3f386910050c5f67915fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585aa20ce21c49161a358a5ca1c7113b7
SHA13df51b2a9d2eafe63474b92a64258e3297bc3e88
SHA256fc81afcb4d6922fdde87bb8e34f11d2399da19212a3b1e3bc0da053960f85543
SHA512c954e120f7af899876dfab67293c0b600bb11021b34256151146213fadac35318d194c8de9ae3209a6f3094ada0c1d1f9ae2d3d96fbf920942b202528f4b447d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567721336c6c06803aa14d4280c2862c0
SHA15f4f33d09b8f41abebb546bfcdb12254e759f255
SHA2562374b5444caec76b2bc7944e14dfa9d1dc82e39d4de7fed414eb2e5447437f15
SHA512f891d3699e2eaa2c873ee41b9223b9301eacf30de8e4fbc5c7e0b9144b21526f3c89f2429a7870b8c20da0736325009986fa223bc82cdd61fea821a36800276d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c142155961c6b331a47eb211723fdf6
SHA18b60cad1473547272392125fb7dd7f2e7d1d8701
SHA25660ac9ea962571bf0a6c2e367f2a749ef9ad241a6b61c99d40e9e204e9a0ebe39
SHA512182aa065caf836d77f74663ba009e3d50bbd56cc8f17eed1a06f49c0603ec2046c9e9d943316a9052a4c9dd0523c9f5f944024c66b62b04e286bf09b81284de3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53438afc4a3f2ffbbbb7124fb324b5903
SHA193ced2be3a5401bf99135f27ab553dfda510b41f
SHA25629e3bddb8b22eb9e3cea48dfcb8ecfd96746d0d3c0e9c093ce257bf8f290b255
SHA512a7a0b14a22c2cd7b46bcb1bb1dcb1d6f5634fc1f3151603113a357ba4782eb73a43f3d7581788ec1edb89953792c4fb126d15b0dcf442ade432667bfd07b927e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584fc7b7d65dd553951b9801c1ebde8ab
SHA14ae8466205a75762ea696bb1a6980ce3d13b6dc7
SHA2562bdba647098b2bb2b0577f41ec9cb11cbb4aeecc0673d598a73961c985e57797
SHA512136570e4ec1313c907b4f967903834f61156d54f93edafed17ee581ee4c8fa6a0c4f8be6f101a428b5ed7bdf48d6955cb469dd08355ddc9215ebe3d9c92967a7
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a