Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
01/01/2024, 03:39
240101-d7284sdfc7 101/01/2024, 03:35
240101-d5fx4adeh2 401/01/2024, 03:19
240101-dvanbsddc8 131/12/2023, 02:24
231231-cvqtwaegdr 131/12/2023, 02:21
231231-cs7dvaedfl 131/12/2023, 02:01
231231-cfzhgadcf2 131/12/2023, 02:01
231231-cfywyadce8 131/12/2023, 01:24
231231-bsgmraffb3 131/12/2023, 01:19
231231-bpzn6afbe2 131/12/2023, 01:04
231231-be39ladfc2 1Analysis
-
max time kernel
1682s -
max time network
1696s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
31/12/2023, 02:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http:///search?q=reflection+nebula&rlz=1CAKLUN_enGB1063&oq=&gs_lcrp=EgZjaHJvbWUqCQgFEEUYOxjCAzIJCAAQRRg7GMIDMgkIARBFGDsYwgMyCQgCEEUYOxjCAzIJCAMQRRg7GMIDMgkIBBBFGDsYwgMyCQgFEEUYOxjCAzIJCAYQRRg7GMIDMgkIBxBFGDsYwgPSAQsyODE5NDAzajBqN6gCCLACAQ&sourceid=chrome&ie=UTF-8&safe=active&ssui=on
Resource
win11-20231215-en
General
-
Target
http:///search?q=reflection+nebula&rlz=1CAKLUN_enGB1063&oq=&gs_lcrp=EgZjaHJvbWUqCQgFEEUYOxjCAzIJCAAQRRg7GMIDMgkIARBFGDsYwgMyCQgCEEUYOxjCAzIJCAMQRRg7GMIDMgkIBBBFGDsYwgMyCQgFEEUYOxjCAzIJCAYQRRg7GMIDMgkIBxBFGDsYwgPSAQsyODE5NDAzajBqN6gCCLACAQ&sourceid=chrome&ie=UTF-8&safe=active&ssui=on
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2244 msedge.exe 2244 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3988 msedge.exe 3988 msedge.exe 5004 identity_helper.exe 5004 identity_helper.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 5104 3308 msedge.exe 16 PID 3308 wrote to memory of 5104 3308 msedge.exe 16 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 4732 3308 msedge.exe 28 PID 3308 wrote to memory of 2244 3308 msedge.exe 27 PID 3308 wrote to memory of 2244 3308 msedge.exe 27 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34 PID 3308 wrote to memory of 4000 3308 msedge.exe 34
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http:///search?q=reflection+nebula&rlz=1CAKLUN_enGB1063&oq=&gs_lcrp=EgZjaHJvbWUqCQgFEEUYOxjCAzIJCAAQRRg7GMIDMgkIARBFGDsYwgMyCQgCEEUYOxjCAzIJCAMQRRg7GMIDMgkIBBBFGDsYwgMyCQgFEEUYOxjCAzIJCAYQRRg7GMIDMgkIBxBFGDsYwgPSAQsyODE5NDAzajBqN6gCCLACAQ&sourceid=chrome&ie=UTF-8&safe=active&ssui=on1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9028a3cb8,0x7ff9028a3cc8,0x7ff9028a3cd82⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:22⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:4000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:12⤵PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:4056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:12⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:12⤵PID:1196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:12⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:12⤵PID:3056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:12⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5448 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1040 /prefetch:12⤵PID:712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4185379998117822649,10055551374274519154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:12⤵PID:3996
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2988
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5552758a7bb19b27354a76866861c4801
SHA193a74b56e5bb5aa86a53db413081b3ca7ffb808b
SHA25653e1302ff50d199fd0002ddb9d4f66fd264b17e73a50e67299adf1243663530c
SHA51213889bc4ffe240d8a7cf71ca0f2a397f33e38106116f38b5b8fa6c977187899d2d7084d606288f2892d14776460c2fe450adbeb93d2d200caffefe9919076fcc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b6fdc57-9ec3-42ab-a72a-deb646b59f3a.tmp
Filesize5KB
MD52cbc1b0b18efd3ea0a504ad5424a6ce6
SHA12ba751b9c6cd1517bdb1dbf485d9155e1d82791f
SHA2567f3eea70373b944e4761fabe4b8f3a3606c35f6ce318d67372f002b939341aa8
SHA5129e6652515e3680ef36b295afbad8966a9103b1e72c37b55ccade74ed35cd1d37d260a27d3bc3f32817dfa555bc5c91cb7a19d9b3b1e315ac0c8d745f76423af6
-
Filesize
4KB
MD5617b7d017f2c14c83c660e641c86d82b
SHA12af1ab87cd76d7894fe19f2d0d312f33af23df8d
SHA256d0a07a4569b6b7b86f133699a02a0e8aa8f73ed9044963a18d9bb9c345456339
SHA512e762f84594e87ba7fdadf00f8d808b6fb2803be1b64de31a84a1f7aafed7d89437f2ace848c67152949e4cf83da1d2b538487c1a00c974e02b4a77c29efd2649
-
Filesize
5KB
MD528ff920726f07b1f4b159a4535497123
SHA1f0ee5d0eec65c740995a1df2515dbe0b9c651e0f
SHA256e599f8369291713ead23752b7d79be2ada05edd5092482a85f86e97aa4836ec8
SHA512681a296323ca260ffe367911da596489b1d130b549b4920392b38cde69cfe6c1cf29cf5a9b76db9b269bcbf188caf23096151bb1cc06f4f3f945da1575329e5d
-
Filesize
10KB
MD5b847ae1c8ca58bf8dec9fd81fd197dff
SHA1bae51d03c1a9db60cb8fb93e44a9e502cca00fad
SHA25621168bae3ecffd8219a66616675af3ee5c4d99ff26609681fc48eecd8f06794f
SHA512ed9abaea285b4815024c3a5c38ba3bd9694fcea6b8d9263efec16876f4c999955f91b5c4e9643103ca8bf7724e12e76419759fb3adcf78c6f86a584dee1355fb