Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-04-2024 02:12
Static task
static1
Behavioral task
behavioral1
Sample
08ca70f472e9597228dc52a532035541_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
08ca70f472e9597228dc52a532035541_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
08ca70f472e9597228dc52a532035541_JaffaCakes118.html
-
Size
456KB
-
MD5
08ca70f472e9597228dc52a532035541
-
SHA1
8eb3619c40331f7b1a20a2b9b2c147276385fa7d
-
SHA256
05caf7d295e43e5331de9797ac0e876ea16e380211f0c1ec9417071640906bb4
-
SHA512
63eb99dadc4ab2fa3e839aae0c389c011cfc32d17bd5a47dfcaa5a99a217df4f0e451eb48088a6e76a4945176c16bcb2c1f0bc6f0aede90dc86b0bc9b8f4f72e
-
SSDEEP
1536:UkPmYBJfrYIJJYNPhPqlOQJNvFP/DhjNKtnvIJK7kE8TxFyBFCVwZG5I0GyLi+rB:UXG2yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d33e1b01b5560f25a672ddbcf34da43bf9dca0c1d827d2172037d662c36c14a0000000000e8000000002000020000000be6cf5806fd3d7748ee6a196f17875978923caf1287e7f8acf33d7da2f9a811c20000000b6ae0194a28bfc037a6256542310a6e85a00ade9f8ceef8391adabc478192804400000009fafbf183972585c2bd0bf74529aa070a3fc28d0b31f3eab4e2c047befa6426c8a8458c2146bac1318ab25db8f498af070c0bf0128c4746117d76779756b3f6a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420605008" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000069358702e8547d07ca7322d55b504e97c086358312c16955dcd54bf37f14d065000000000e8000000002000020000000ef041d6e82f75bc3724870b8a8f8f96fa602155e6019b086363cf3e5fd6fcc56900000000ca77a78ba3f07c6b508cd4a6835392e555060528999307df6ca262ecc2e391496cd1ef82819d97219f905cb4d36b22bc31c528a1d279201383a10bbd5483185836bb6ec7df89af47a2353e198108c936ba6f18f433e432b94cb104fcd3d7558cd42afb3585b8b1cd9d2a215c871fec0de2e787bf7a35e51cc007847227ae6bd88a855a1a43579728bd1d86176dfcf794000000057aa9727d83e1d73caa0cbbd52bb144e608b7be1cddac0398d801145196ab6c2fcf7d8a43ff6f62068d6d5b96f84dac0da65a0a8cdfa50eb02f18d8444c874a3 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{132B5511-0697-11EF-B937-729E5AF85804} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e5e3e7a39ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1700 iexplore.exe 1700 iexplore.exe 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2640 1700 iexplore.exe 28 PID 1700 wrote to memory of 2640 1700 iexplore.exe 28 PID 1700 wrote to memory of 2640 1700 iexplore.exe 28 PID 1700 wrote to memory of 2640 1700 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\08ca70f472e9597228dc52a532035541_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a121466fd8c597e563128629a66afaa
SHA16ba607113f77dcd0238fd63e36eb8b7232e88698
SHA25626c39798296a52f9838cd30168e8ac9228be8c7733dd9c9069217defbf133b8a
SHA51239c02a4dae3df8d5a0259737545d981c9e54d25e8b14b9ddc5a7f04a52c48dafd4f03d4650fbbbc7b65bc04ac03c0ccb8c221fab4067cd969822f59c0102ae8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5639c0a549b10bd0ed7adbb68a586e80d
SHA12c32205eddad1d5bb63dc05a982a7a083c09f95b
SHA256d585ec3840ca85509793ac663594053013852ea6be97bef713ef3e52879e2c61
SHA51205ea472da2b557d8740f33dbd433e9a5b624a0a9fae2eccb7dbf1647029ae262b6cab61d6a66e3dfa06b07f9bea6cb8d71b46b73b5386147648856d45a609352
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54df3066ef8e83f3908395f606069bb18
SHA1a9f8813e76592a825c7f0562a99d8105d23ea3ea
SHA256cc2e7d84eaf74af72e85c3241b187d30232a4518ee838ea47e45005892911237
SHA512c73fefd0f483a0a5b4e5f0b379168a3a9dee22cd332785c624cfad11d61c07283a8afab43bb44a464fc5de558a38345b64a1467b29f27fff755f7ed4376d18aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e1bc25ec78eb518a85955171b774df6
SHA1087a133950187323a6ed1a0e7ff5b47109785e22
SHA256e634b1f6802140b1754f96cef964ccef6d3c1035a6e3d2598935649c682058df
SHA51263242842b10ae82c2dbee6cb34405b96f3a4ee4dc631865f92d0c5cc233fdb96b2d135bbe69dcd383cb1b26c0d9214e379d4fe2da84269950f0e6e5e93878dea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f8b173d9998e6402eaea60eb7105c93
SHA138323e5d1ac5113ebe95390d550363b904ee2dc1
SHA2569b8026ca49ae2976671cae92cb4e9485a5437da4e2efaca128b21b15b716b084
SHA51248f656a1c7a9e174cf305cf010989708e357bb380d75daf28c677c9e247af1d282fee19fe8a9b25399305698f5932abfc41c458e0786ba37b04394f452c0f96b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59386a8419718fb95cecf0d5ce33eb695
SHA1ead00eb5ab44384a503642d87538886ba8152b61
SHA2563bdd558117b6d8efd13537475dc82c772e0762ef5e63308556f84c44f495180b
SHA5125eb9b054be9f4734e5c26601ce8dbc184f2a6f72e6c12a95ba9840e1cffc6a094793766764abdee12f4f5afdfd8142bd445d3adab8b44b7c378ecc7e894f92c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577f899fc4b8008a38603311711c5c684
SHA1c9ba48b00cb3a0855021e6cfcf99d6d424e68bf4
SHA2566d01a981f6ee58e84551c68b8dc16c45fef8e463d9971cbce3abc4f1745892a3
SHA51261b5ae24b2155d7fbe27ca8ad7ea505872f2d1254ab633e39aadcbd50c035b43076d5981479aa5ea85dfadc9215af3b5fc2d02f0f689dacca4970a5a415e6d53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fff6376b612744f469fecd4c5591b7bf
SHA153b8a79c745ca3d983a617792847de0ec2ec778a
SHA2568e005cad7a4387944a2c7c2ca1a41ae0341ed3ca89cf34fb1fbe9e35bc457a24
SHA5126d0237b6d06efa6e4742e70f490a7a75d14cf555f522d713c332654143fc90af85398cc59d0e47741da882dea61e96ed320bffc60c42eaadbde0a14f1a17806a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8a1bcba0b64cff958e0ad2ebdc7da10
SHA10b8c3827476ba26879cdf2d7abb2d490003795f1
SHA2561eb8a48296eb6d84004b5839e468fcf5ed8a8020e76a8203c824d35e614ca631
SHA51221a56dde4943e86f848398b30d76906f69c90c30339c21a48dd78e1538a8fb5c254e186919d9f8f93002b3d440fbd18abf18f0099a10e491bf4170090f1dd6ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f6d36f53ea227fa20841edbfe7c9c81
SHA14b1d672eb35cc811832ede7a7f8522897a43986c
SHA256714dabe096ce4b4d53390d83580d1786c2c1d4457479af5cd4aa430b8b23b144
SHA5129746ee4432d2d9b76683aea384da12718b702eba6bb1d80268500ffc671baa4f9acef40a67cefd16f10d1f73b1504a30c3dcd380cd31585913dba84e9acd4d8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4e9fbbf2bc71e5f67647b74fc465572
SHA194415053177bde29117d4c256e02803eafa0bdc7
SHA256887cedc1d06be2548171ac712ff7ce3145121f729a79e4100e1eaf05417fd714
SHA5127e10775a8f7a9ed34fe6474ab8704f2f1cb1870499bbe5c0e97be43cc73aea206dd2fd8281351837dd248699015d394c5f65ab45d195eabacfbf65a936fb5370
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed18bbb46ee34cb5fc77d17ec2c4f7de
SHA1b95936667af501e6b39be785c1d5d0c02122b0f7
SHA2562907adba28c1ca0d836ce25eee14c4054e13ee66ed16e90e1806da7c3290219e
SHA512e91cfbd9761cd26a996a9a2c1fb514ac0c9a9564b8bba0e44f5fc7c1c97c9dd148f0f12c2e256e136d874fd42114c7256a9f759ffaf29d3c995bdf92606ee475
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cafd792a0b00a3558ca674fb8d2c615
SHA159421d1acf98fd0ec7450d90c4741fc65b80102c
SHA256c0d464c95b3dc4753012e6c13aef17428d3379503b78e7e8bc0cba44861ba090
SHA512aba0f0e77eec878881bcab238ba721e91f28d43061b979ab5343c3f1ab7ea294005932bda5ece83dae4509c61ef8cb4415d66f457a8d014f16701036198ab1d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e57b2f88a7dc951e02829612ed4e286e
SHA139ec2861dbc96384dd590ecaa8f5b3503027b68f
SHA256412ac61e20a511195189ac4043c65ae5f4386f86717abaffe8ff68c4ad9fb6fe
SHA512a029e31a44ca96385ad0d6f38201a48dc00dc3f2ee0ed7c0d582be10c1aa7078e91b85f2887a09e4f5a1b51cc20f05dcb6f3819e8603787530aeed744c40cd8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9f4e8a95f07a40be15b537cec74254e
SHA177dd60d94eda41a6f10e60e39750ab06666d9ae5
SHA2561844a793bc08f13c917cb78e0d0884c71d3a43ac9ecea9d6930482d29e6966fe
SHA5128374c4e6d178de5415ff5988f66ce523adb689590594df0aeb4cef553104f89bb1bf90b31a2cca409372cedb246a8bbf83b4f3676ec9369fd873627508ed535c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5585a0dd0d357d25635a6b40c9b62df4a
SHA1ded1ee9745fc1748fb8b8a6d6553301eb002b35c
SHA2563b7b26cfdc1433498927244b27e3621460dc3ef485508d8871f410a8f0c7293b
SHA5128aa7079c5ae688c4c4e490f31ffc1487630d662753ca51168a3df25196198f873e982f8ede0b1aa0b76f883419320dbe657b260638116a4e1088bbc4904720f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6597107051e54faffd14784da6ca28c
SHA1c0ec3da7145a0534a3806c6ca0f03343f6ba122a
SHA256bf8202851d57067d9e38b383964f991ecf7ef36e82af67927a426afdcae48436
SHA5125819630256a4f3536bc3a934b432124467296901d4eaa6d2640cf9f3c729b364774f35010172351369267f2268279cbf13e2e3cf217b529b267f44aa61cc3658
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a