Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
4f8e26645ec35bcf331b98401969d5cd_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4f8e26645ec35bcf331b98401969d5cd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4f8e26645ec35bcf331b98401969d5cd_JaffaCakes118.html
-
Size
36KB
-
MD5
4f8e26645ec35bcf331b98401969d5cd
-
SHA1
6f01c142f6b883c0307e096b39e2ff71e74543c1
-
SHA256
56f656b65b8a0b4169efa4e951b8121a0b6c68e1e88964adf7888730568f6394
-
SHA512
42a4be6374b36b97b349f9610a22ba7ad081bade72b15f2e810d27155c04cd84599799940884dace4df96a3dd89f0aecd33b0a2c18ceb26a047f62687522b605
-
SSDEEP
768:kfZTVy6lvxdoNoDMw+0VFqDRc46FwPydmI3g4X6:qZTVy6lv0iMw+CwF6vdmIF6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000098e12895962a04c4cd14d2329a8cf55084fc891e35addabcfb9219b8baca437c000000000e8000000002000020000000057c6fffe1aabe55f019b0f09a727f117ec534b3bbd8a3738f10dca33214106e90000000b6b5cac2226111add4cfea38e98c8f7f85fcbc12e8219d0baa56615dba7f873d7fcac6d613bb69171d625cbfabd4c4c85011974f41181a9dfea64b51bbb3ae00be9bd4bc5e4c53f3c33356c545a333ebf9b8065d7f004f576d0de8e6f1ddfb4aee024331b11917fadfc89a7c0167ac53fa054da8dd8fda32126ec9affd93761b13fc0b3d0be2b688cf6981de2520eb8e40000000e0d068e029579663ab07f5a48dad711c5710d4e00d43f070ae1ee1be6767121de94b395e20dce1ed7c580e7d399131c0ac1a80e446f7014aed4fee5ceb73142f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422103755" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000092bb47ac53829f10097fd53def0353641e655aebb4aa233e279e02d4ab670ce3000000000e8000000002000020000000b2e0f36e77cff1edebb80f38d9f8cb479e6e35e43ca3568e0b1eaf05b89731142000000066412dc348c4c52a3198fcc8210410f297ce7bafd0108ec0004af77e55fcb0d0400000007a42ed8eca3df54d0bde8c4de4310410c4329e33509b134c22ad45228641623e8a7818dfc3ceab25bab7cc3a6cfec70916cf4ab68abca2ec2ece33f3239057c0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E95A4D1-1438-11EF-91D8-D6B84878A518} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0bac87545a8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1792 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1792 iexplore.exe 1792 iexplore.exe 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2828 1792 iexplore.exe 28 PID 1792 wrote to memory of 2828 1792 iexplore.exe 28 PID 1792 wrote to memory of 2828 1792 iexplore.exe 28 PID 1792 wrote to memory of 2828 1792 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f8e26645ec35bcf331b98401969d5cd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d9f5403bae8b66d2577b4df0d3ce1ff
SHA127dae0d618b08d26c7fcbeca06e0f225e7e7b424
SHA256db65b6fa7d57fd5651c70843c4466691b8f21be99d6b11a8d8e43e9b17e9017e
SHA5124b87ca49d537129668fb845e3bc3895efcbeaa48c9b9529f11da8f8618d014a690e3f3295c210711e6c8201f07559c7f1f06217706d0061b40f742eca1a7e004
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5900fc4b9c4eac54f5ced5e50f09f5611
SHA1a4bc8320627826292129b0c8db93c8aa535a5d50
SHA256c1ca205917b499747c8f3771ecea621d9c9e02cf816c47841db88f56920fd619
SHA5124fa34b861120aecc74a0e7daeb3b08e7f8bbb7a54961618d8c129401e9a3fdea393c06c93963cfac358ed9e0cd4ff3006e8ccf9576fe1b654c8aa0d4b48bdf40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c3f5e1492c6a2303f29aa60ab5ae751
SHA173a674ed3b8abbe5dd0c58ebf031575f3a9d9994
SHA25681413e4da540c1899be1f3e2a54fff5140855a3710a830fce8649074e92a5249
SHA5120903ad2344bf3c50c05926ed94929b296ecbd79aea81e88fd34a60b3459f0d5a477d965eac5946f7b5036b67d2f489152807dfda63f65dc1a223e85d898b3a4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd922acb1cb353c2fb8b1f6ab84b4729
SHA1e7ed4b1c0ab8ac431356b5d64df9e989417cd3bd
SHA2564074acb902f8b6e54893266ade4213e753ba0af8ac091be1b346dc3e76cf7f5b
SHA512698d66b42e5437f2b572a936557af81dc273d5b0af3276c267d7e3b664464da9fba0a6c119ffde17539a67876f8ff9457d386d53949f5ba1beffa443e09778b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561606bc02fa49ae9e11ebcc3104a2c10
SHA1060ff7b81e90ee88537d7a2c96922f5b6679bfa0
SHA256e4c351a9e579ef5e94ac2521b518c2dab0dc1a1b030d1d495026d56c2c7e527a
SHA512b922c68dd83c1c12eb341aebe1a82f8611a40223aa06f1df0c17484987aac36c54ceba25570c247c2c7b6bf092f33b3ab9ee7e667215c926a3a6e3d5c0cfd851
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca9ee2eb7ba9b15ddeb4edfb2a39f224
SHA1e7d19d3f91c4467ebd9992e307204fde700806de
SHA256a370a86b8b7d93a7e561a4c1b7d1138e078af7d1ed5432a90c5978e1e635c8a2
SHA512cce583cba9b02e3b7620a5183bb29fa7f2b58d07f8a9535891267b4c5a14d12f80d8ea1cfb4ffd08b7928f13483b24a21c50205d3eb08a69bbff331f2fb80438
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df09a55f8659885f82eb2b450c689a20
SHA171edd6e5905362d42f5ebd0df86ccc61dbb8c1a9
SHA2563376b9b7e2b55f33d07ab45117a9a5a0ef7b9345e5c261bf8145fe3d1728ac69
SHA5124aa6116cc690a329993ce3c337442227bbff281e5982bb8acff95cec0c9cf8fd361a318794650b984e9daa514ab570379a608fbb6f4474560574ab5aa597b4a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c3572b4e9d76b0c6c68753c690729a7
SHA11841a0c39828991f8dab84930fd924a0f16972e6
SHA2566dde84685eb75902a434a630e93af531c2243ab4a50992f40f03cafa6b630b97
SHA51211e2ab66c887626a97a1de3b8de653c2bd87bc406257109358f914f6b6e68b6823028248c30cc3a3cad91fdea34357494815502948775c92f9cc35989693ae51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54709d87fcae192eec4e302c132001c07
SHA1341e86ba2db8b0153a59d18dc2a6e942c6706485
SHA256896f2fb0556b1a6ca61bc4adc1117fe2333873988b91514b79683abe1575da8a
SHA512490889e0b1a85bd27f0a5f11d7c2eb49628a4bfdab3ad1e6c7ad4b2aaa34c64ba936403291797f97e1e185f60a194b18e57eab4c770588df8cb0e871f4dabe0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1b67bc307e8e920f6d5ba3607ee40a5
SHA1765b6b5f4666b227cda62154f7b52b1c228eafe1
SHA2563476253bb863677cc8e4c2439fd07f279e7b4bf184be3264cb0d3a96383ed560
SHA512862124f8cdd9cc72e12ae8b5979e76cf9fb2a8cc69b9095199b0df1a90712382d8deb0229b0a1b8e9f16d08ed41946df984b53a6a94131d011e065cf66b0eb46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a55250b811ed86b7833aec225abff60a
SHA1c7f3426cf463c5bbe48bfb7cf3862cf75d731108
SHA25640801ddd5eb31331336886e56e9f854e4a0cb7a7158e854a343bcf5626695e5b
SHA51270b91546e166781719a3ccb4c102b565f2af3f47016b6d2331639442affd668c8c59df210a60da6b7533d128e96f16b4aeaeb0df668aaaddafe3f4fd75ffe9a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9a1b6990242aba95fd231c585f4fcd1
SHA15257f63c142cbe8635c9add73903285664ed68ff
SHA25611cc95b75203d966bd6b047431d98ddf72413c21f3598d8dfe430db0200d1005
SHA5122e350b1608c32d64d063201bb09c9b1b5f27ea0c9cc36d9578aa8f6c896d4914173f2f7448fe5c117e13aa5393fca956f8b5ca875e25dea7a67bcfd0b202d890
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e1bce07d7db4c3fb2f46d8f83be55eb
SHA17ae58496fdfb7ed0736e46b61a4388108e15b407
SHA256d9e7603d5955df5d65b47c4bc254e3851f399bcd7aaa5ecec80ede52a5ba785d
SHA512c55bf9cb84b42421415f159576320d2e721e7dd62c6c52883e240d5a2f8a2dfb28e0248f141dde6766c92f46388d65d18dbb7c37702e3cf6971df324034927a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556cc880e1b582930651eaae2c741cd22
SHA14ef710d0d85433add9f8e601759487fc43b1d06c
SHA2567df69b7a164e94677d6cc8a154fa4d506c7ecdf357420e3556a2dd58970f31d1
SHA512423cab97a9dfc8d6da9aab0f1648f787e3df2c3517855d2f9d8e9ad6bde1818acd6b7d6435d4fd1b04c7a073d18412e6a98bdecddb46867377892279a5cabe57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564e9710f8c774a0ec3832f602034d6af
SHA12bf67206e0676065eee86ccca68e6410ef665111
SHA256c73227f4c99a64a71f3363c863b49567b0e8547020d7c410bf0a51c5efea0b22
SHA5121f3f9708bdb0104f841e4a35bd1952c0924201efad6d3c5a81aca68f13f20d5c275cfd144e39bfed19d20b26058a5d64538365581302fbb14a70d3c401c59898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506d4bfeefd400747b050159c53e89f02
SHA167f73eca30e74f060952700ae75b8c25265a8c11
SHA256c43f0dcbb9e6eff273ffac746d06dd4090ef35a75e081f680028280d56cee2b0
SHA5126df9cca8dc608e7421276391007bc43fc4547edcb2a04e0bde8904d839cf17b1bfd7b18c5feb1503a8bd3100625f9e7e5f791c08f5207acf24c7468c45ca8ea1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f4f52b186e88f7232fb3bda337282e7
SHA1da888b9fb372acfab012f7f0968e191f80bf48f7
SHA25631dcf460132c184f957a10d6934688e30de91cf455997ebca90e35fec0840057
SHA51286e9dd00b2bf3b83d6640e7fedb7ad5953bb9de8487ec16cec34ce19108a277133bd7cd3b9d9a24174815754b7c83235e2d26f0a112fff67389e8017ba377626
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c2469af579c4371bbf713a703796952
SHA1cc9b2c918afe9bf22ef0171971f221d992f5c5ef
SHA256f403e0c110807d5b3aba9cfd940c4e943d6c9e51075c78db6a43789bff62de1b
SHA5127d4d30e9d63e6a83165a1f5b46e1bf4311fc1c421293ed446c0898eedc3450a624093f2e5eae31dd9f54f60f57f144b9c4af65605a032bce0f2f6789a98452df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a107999dda40e96f78a725d9600c361
SHA11ac437a024ea2e8c0f14ca88028523d7120c6657
SHA2567a543b0b791756abb26cce80384fd95736b6de59b0af029c5163e922dbde257d
SHA5124f3a72bef13a4b2324cca043cb9dd9ebc5c9150451b84a389dba5b4c15bea5b8f86c0ac8afc868c876ce9cc2ddc4cbf4111d4775594763767c50b1acc98e26b0
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a