Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 14:11
Static task
static1
Behavioral task
behavioral1
Sample
5f7f08d6943d0b827e6e72a7358abfc1_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5f7f08d6943d0b827e6e72a7358abfc1_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5f7f08d6943d0b827e6e72a7358abfc1_JaffaCakes118.html
-
Size
461KB
-
MD5
5f7f08d6943d0b827e6e72a7358abfc1
-
SHA1
2d914a0d30ecbaeac14c6f520f2ecf5def4210e5
-
SHA256
3e5baef6f28401a69298a881a18183a8b2548cfd63160bd4ef959725afc2a59a
-
SHA512
b36cd10262a5d88b5dcaa72f7ff02b5dfca0a946ffa3d0fc3c38fc25036d924b970bcb71a57b27fd11b1615e77bdb09fb57241bcfaa4f82a7bb6746398ace4e1
-
SSDEEP
6144:SWsMYod+X3oI+YasMYod+X3oI+YUsMYod+X3oI+YLsMYod+X3oI+YQ:v5d+X3+5d+X3U5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422376165" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000056a67d900d28371435f12b2f4d04bb094c0e5831e412359d53592e62dfb7b3a0000000000e800000000200002000000030ba77852a2c6133da42a6be4683533ec11cfa47218423f2f5cb0e25936d7c5390000000f126b9402009a76e793724825bf1761a90efeeea9ec803e49191f878e4d1f9d8308b9c731b5b6d9bfc979fda388b525663ec1db69d59942acb0e92c3e5d35b7ca9acae0b62bcf59e9fc3229eb9853bd3114d3bebff9658e019ea08a030b46a10708127810db854f81396cc138ac7579d7261d3f1835aaa40583ffd3b2603b176d33f60fbb5b25e14927551f2cba7ab8f400000009b4f1d52ce883eccf9b1fb3655e04d62e77c6368d2a1cfba5c4fd5ffcf5238c6c1d046d1e7ab46f545ce70255807f70347602826968daa72c54194cd1d23aa7e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF0930F1-16B2-11EF-AB84-52AF0AAB4D51} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000007d21fa517b9c3bd11069a15ecf3691992cdfe112c5d64d1210d8bc10b1de968b000000000e8000000002000020000000cb5bda40ce2d583361eeaa4c1a0d8e66dafcd099f0b0c1139b8e0b83c4c7bc38200000006a008a80d5ad3e26b2daa4680c821c100b62d40f131fd999dc42b43ad9ec40d740000000995d1ba6fefd9e4c329b5abb0a242d52e9fb0b93b442af34e9ac635fac5bb8ba628e3631e90abbe57e50c745a93e8f11d2c9bd5a6b952fdeab5f3dee4896d16e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0959eb7bfaada01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2020 iexplore.exe 2020 iexplore.exe 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2600 2020 iexplore.exe 28 PID 2020 wrote to memory of 2600 2020 iexplore.exe 28 PID 2020 wrote to memory of 2600 2020 iexplore.exe 28 PID 2020 wrote to memory of 2600 2020 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f7f08d6943d0b827e6e72a7358abfc1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9231fb75799e0c9016cdb712a409724
SHA123cb9e6d0c4aeeaaea1c7a78f5f775e56f7298b4
SHA25693ba5eec4f96847ce37048176afec0fed2364cf44d193797af4b086592696490
SHA51229b3ac6daea82dde0c6c21db2995bd2c9841cbd1c345d81e2c7eacd4298cf05458018f5142a1e71d108eb972007856a0a1c38dbf608cbdcdc0bb8ef2fab39e33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbe3f6250f6fbe6ad64882373de34b2a
SHA197be675237a9971bf359a1ae80f4b59b1ac02c5b
SHA2561aef639c241feea7e233644572bdae0c0cc6a0dc8832edae607b94446fd09c77
SHA512f239f012d3ff9cf3cd315d73e78a58b462609a75743e3bf56e9b2c25e49cae77220ab8d00e35503cff28a1680c0e13c8660b0dee78b639f32e20160e90c0c8ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1b0b2254a505d87b1133c841f1d3e00
SHA104f31e66858d9687a427d2ff92d5444a5e106712
SHA256804b3ecf880c2068512aea44398d153e90d3ca51c4a5ccbc0945db5866f3c059
SHA51227714393954d0a842b950d21fce00dc4b5ae0776d2c7f74c1c4546acfe2c601fb356efc9cee6dc291a4a2d7fec41472c9a4b22885c4f836f10fa0c0c4dd47f38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9f1a000304d77796d7d286eca872ef4
SHA12f93f6f8a84cdef465ec029191bbae83c04226f5
SHA256ae49c8c7e651f535a7ff83a6d78fee31c4c253f83111578dc44b4adde1cdf702
SHA512e79551eb74f597ae9fde453025b698d5305ced0728135774be154c83498fc0a4ad4af71eae572f3b1999fe56d6add9711142e2d5ba2b800a95c446630aaa8477
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f090d7073e7da63472d8e61192f6e66
SHA1ef480fee790da5d3156cd891974eb7060d9a0d46
SHA256d5942db79edff84a73742aeaff0045b5ffe76df6867f83826569b4d9f7ca1d1b
SHA51269189b241256c50345c2cf3ed7771e6cb24314edb9e08997f2dff26dd4a6e364cb0bc70de4d686902446965f77575b74689e546006c4759c7056c1def4092b52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d66812167e52f8b2c9b834a4637c9a8
SHA149ea3b1d109290f67e12b43be8381adaed575f8b
SHA256e9193b4b38926ce6d97de331620767f946bd3186dc50e3fa4d23fd1df773eac7
SHA51236a5254387f68ab1ac38dc742161ea050628d43be54ff1000e205ed7c3f3966a6766f43904b93b37b713eda994a5e85bf1a252e48d65c28b3e2bddb3ad94af18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cea6cab2dbae42a1acf1416e39df6992
SHA107b96b04d5706c7e584377ca8e367023686d45b8
SHA25633f0abd67ad908225bd137f1806f5f65b79b2b472a5bd7e8ffbe3ea1a0d276eb
SHA5126a676a3919dd41cf71d76fb9d26a0488d538a88e563141ccb81edf677654ba9cfc47aba8fe0f875d9ccae012e7f057e997192dff63ceb750c89cc42937e5d22a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556c7c4cd31c66193b2743451bc2d6ab0
SHA1b11b354c6de0cb23184849ac42f37a8a192ef7a0
SHA256583ae641c598df0ad70b923d6bdc22535583ce0b11df5c5c07127a3fa6704adb
SHA5128dc133e26f1d1c26d57c70573f70dc694c88fb185b472c63f87ad7237685ee9cc8f67f5e3dd5aa991535167438f090d346e1cf2678fae252a9cf6b095ae4339d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502e538821ab19aef8d5948070a8d6fac
SHA1f5484a6a306b8435fab3f07cb4ff76747fdd97ac
SHA256608b10b2b264de1946f55610af50fff035f5a123c9dc981c5aec70ad1d6a3fca
SHA5120b013dcaf76e14315dea02bf6918557d4b5549efe49c374afec663585f24cd384c71f1f1e1cb52c3ba5d840b0b26fc92e3252e93b15ef921df834fb4439f8350
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597d160add3d2db8c3c0e65dc0e607005
SHA119fa1660999a0fc2c974c02fad31288ecdba15de
SHA25668af88310db2682b6a9b1899c25f0a0fb59e304ff3437565601fa712c74105b2
SHA512eb8c4ea56ef63b35f0561a23065d3194aa529ca5d2eada50625b7fb96bc006a4c72743285e2c16e6be3a91ccf70e2308938867fc769b58fcd487a553e6102a49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55435c2835e997e4615df55ae1cb22756
SHA1fd6b86e45353b68e0e0d9eddfa2980869dd2aaf0
SHA2560a6893d17ac04bfecdb22f4e273a5d3e8c515751a097fa30867266f3038abb4b
SHA5125745bc3d8db598b25e58942595b2cd7d4acde6bc9ab6d78d529d0947fa277ad99198ce7163671be1861771b4dfa316a1fdc6a39b71ebf8f67e37560fd278c623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3fb825369a8f6e487de428a5608be5c
SHA13f598d791e6d3c46bde69c3ad0e95e941cfd1361
SHA25600b754bab28e0549ed6e1dc968cd35b49296e182577d5c0199e7d45b32243600
SHA512944e7a3c7523383ee055b460f3f5f3495d2babd7c4a3ffc60ee99ee8c443794f73dc8f9e7bb86e5fab64fc23f0c3d24fd2a786ba1bff724c70a1460136460392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecc2e4bc303ef4987d811821c8a85a82
SHA10c55f623070c867861ef839248ebe9e2aacc449f
SHA256a14fa263c6671cd6c6930ec2ea1174b44b6ca43e8fe4ed9060303da37fe12333
SHA5128fb377731f1aa8dd96a4f8da82149bf2931a65135d17c7d5fc590393a770bd5a22afe61d4bdda43fb35aae21919e5bdc601c143e5fac9cbf83de1bd3b3c389b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51efd39927592b1d4243470116a736301
SHA1e3736278b837d304165f098b35b1cdb04600520e
SHA2563945622b93ac8b3b9793cc680aaafba3fe2c9a8043b81dae9c1d2b253b2d5bef
SHA512021ba437be7e93f532ad320e0778519d1ca25f52440fee0a35c5b42172b8d2e28a116cf3894b15d41f4b52277c732fa2f845a3fdb4d23b7b8248a4566a7506b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7b7674b15b3c4c8a210221eac279eec
SHA12c5efe3cc57c096816c5467cca9d91bb433d0e28
SHA256e5e565ecf2d5c17890e4f5eba6f000f49993cfe69ac221e78d8e9609a51e4b4e
SHA512d0c7a81c1f7129c7a251237305ad56a20060f5daaea16b03bf8b5cb649b84de460062b581d241c9aa914355fccec7b692cce471d5e95547452e88058bf33330b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5508e8ed377c11bc05186e627f81fa6e9
SHA15dc03db7665d5b8ad962414226f605f80127bbe4
SHA2562959bbfa042cbcfe9865b71c7a59e3e11b6e476dfc18586af9f1a729a459710f
SHA512ffade2bdffbb8800bbc7664065d72b5ce72822eac7d5d0279e40e2244aa360fb2539413549236c4339a1a350e7c34c9fd0a62c9828f7cb978737ab7d93d0692f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5310f76b224ff031162934c529a27ea2b
SHA128cac372f73fb1112e64b0153398d32721f4567b
SHA25631a96793459c9e2ac9f4e501387659b25d3d116180bc75c956467b0d161fc7bd
SHA51284284ab822d7fe78e3fd329ac58fd3f6e5e224ca14e12fae869d48b01a80ddfa1e160f77bbd65341a0c62fa556ad31ccd758e6e687e1e102424997c4a0a032e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56aa9ee0475eeb6db55d7d92a9d4e2618
SHA113874b10a799ca3e36c64648aa3c784d36b67fe5
SHA256f3624dd8635ffbdd2d2185ccec1957efd94738cb66053ec94738c3693548d1d4
SHA512ef8f091075dc31a764a4701c2b9128471e6d91180d038beb2c832b09d7c8101c8b96389610a46e2e7c16c196816d4281a042e53c843f00ffa29f17e907387eb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4a15e062baa943615ac81b2b740c41b
SHA1b26293673792d7ef08656428cf6e4c789218b38b
SHA256ecafbc0e30b834fc8f328b4385e3c80274a7d13cd1e64d3f0c53fbd2d1d2dc3e
SHA5121c7a9321ba6520a6115702c12f5296c55599f5ddbbd61ead77b1d9bd756b01f43c1f9835743eea66112aa17b0b6bcb81a25f5437f600d4d441fcfc37fafe4e5c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a