Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 06:08
Static task
static1
Behavioral task
behavioral1
Sample
1fb09f634f6a0a55365f5ca18f0c0aa7_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1fb09f634f6a0a55365f5ca18f0c0aa7_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1fb09f634f6a0a55365f5ca18f0c0aa7_JaffaCakes118.html
-
Size
67KB
-
MD5
1fb09f634f6a0a55365f5ca18f0c0aa7
-
SHA1
c31f5880521cb98500fd6e7db82a28a371a63b81
-
SHA256
580d8067ea7642b1ceb4d8ef66cff93ca00e0be572872378595ffb870ae568ab
-
SHA512
f64eaeff8a3e3f60573c658beaa8d481ff5b167bb32cc7f1edf759df043a28b683aacf718a397c102ebb865fd1cf02a95e4650dce16daaeed5d23de2b441d117
-
SSDEEP
768:JiAgcMiR3sI2PDDnX0g66ajXYDoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8X:JEkocTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0bb510945a0da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000010ea571677beb1e474f9cb5ead8892f3e726b744dde940b4eca9981fc6542522000000000e80000000020000200000008e86bd9cb24f8325e6f45b24c9b3bbfc8ad06571ad93b79e72b3cca093da052590000000ccd8b87312b46f49824a89da5c8eb234febc77f02348791517ca2534504f55cd881fd0a8c5286c8ab29a87f5b8763269241280f4e70e3bb38e8ec5ea819c02c3c0234153eb54bddba3bdf6f26ae460d2772560a9c7a443d1b5077921cfebb2de43beeb55d5619434af56c6ddd2aa150c53d0a46b9e7ea99c465fc6cbfd800faf3d2f62ef60330d639481cf251f210cf540000000aacc325a5d76dcefc635228e10b9f19cf587571f2c2d21e5550103b9505c75283e45c1c4edee54964207b4d65ffa32a34f084340a609c4a30925c7410291a714 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421223967" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{341453C1-0C38-11EF-AE27-76C100907C10} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000346b39b3bcf7604c6a2db859b75e84d348545480fd25f3abc71439b2ad12fc13000000000e8000000002000020000000831ef2e52b0fca8164b961c3bd3bd83aeea5bc7160f286cad35f7335af8c3fe6200000002e7c6b99ca668227fdb7a74f217e054c134aad11e04bebfb948a302dad539d1640000000e6a8501c62897879c33d62e589d8cabe942c3434b72af36cee0e6a1d80582c4e8ef328a2b0db708569cc12ab9d0016b957a4df72bfe1a7e16c9e10595e41e0ea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1752 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1752 iexplore.exe 1752 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1752 wrote to memory of 3060 1752 iexplore.exe 28 PID 1752 wrote to memory of 3060 1752 iexplore.exe 28 PID 1752 wrote to memory of 3060 1752 iexplore.exe 28 PID 1752 wrote to memory of 3060 1752 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fb09f634f6a0a55365f5ca18f0c0aa7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5432296a3781a402e0909610819ad486d
SHA1d48f488264bfa8bc0b5a3cc33686c7ad5c6662ac
SHA256c9d00fbb0c612985ac8b5c0135a3553595e39b35e600cceb77d1a079e3f89c60
SHA512095c5c043dc3483ebeda7a6a2f8d01a1217d942952dfa7a683891ece68a54176ab3d2a2389f208752ec7836716537de16a4f85361e16e29d5e250e43e0e9fccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfc7414c5c43e46eaa8cc272f08ca716
SHA1afbf6b8885380784f4795d03cfefed07865b6075
SHA2563c393307ee56fb2ff83e600497af2554bc805cee0806ffd334c4e84c89a6bc0e
SHA512e68b8e268856b29327f7b89783ef1fdb8be9f169ee2a9cc4d9978533a966ab72a8b9a068943728e82ccc817101c80df53e9c39c22a8db15390ec9c7dd04d59b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5e9846f5846c05e2de2e7ec12ba9e56
SHA13b459e57791565f2c0231c04f65ccdfc91c0d920
SHA256b15fdcadd0378b9e2c254e2694cded8b17ea6dee1745979b408425c396ea62e4
SHA51257fac4f5b03710bce0ca20dc47a23f44d15745e653369e196cef5a588f4209569e38efdac762f35087df7bc9f83c54878d2804ca15769a4a78a2aeb511a70729
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb59b876878e388d2eed0a6f0b0031ef
SHA13f364da7fe19ce83c46a35a0553c891ca5fcb6b1
SHA25643d952f5261a2e5f3e7836f03d658d6729e9cefde87d6676e37e4cdb728c8259
SHA5122dccdf35f831767df3095ee92508cf03043bf72207387b2b49e52f5c45e9af055ec0a071c4a0835586629eb2a1cae8b0a9d9c5ada2ee673481b5c5cfb0155c83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c97c759bdff46a41adf319dc7bd971a1
SHA18d20f4f763fa7be923ac1236a5643d7ee655f805
SHA256c36518b1a838e4ed681a779972b63ff84e6ef6dc7a8055e41f252ef01e28c879
SHA5125b4d2647ef0134a506c0cb89ccd52ba8b68ba150ef793764c4043442115a9a6dff4f8f7a6c38b9460b0f7c78b5e051c7d32ec51bc1d6a0cd43e4af06c663dcb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f09734973f3f250093785693469d1171
SHA170e7c0be43915472d2708064e979487e27751df2
SHA256b19df029f731cfc79c3bd904d1d6756f05f86b4160ce073a75056ca3bbf897ec
SHA512789dab5135f72ae6d4803edccd08abc3f7832580c94686a3463882bece125344f69c19cbe2c77b0da5778dd84f6284c4df14575fe9eeab92278936abf7386753
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f0cd3155d0dece36a7a4bbfe8f31287
SHA1c3d8aff13e200292b47a55fbe9659edbe30c6b49
SHA256b2e8bec1f2c533831fb0a9ac7932e63cc23d0552a9612dee7cad388d120e4d6f
SHA512cce874230cffd415c09aba7bd6d41193144deef7a2fedf3a0aa5dcec200ee31d41afabfc369326aed19dc7d084e64db56a8107a55d6445613351e74f57f40d01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b80e4ff9079b192ce4f1d5f246198d4
SHA1f7f3d2b1afd8e8a9ef696406dadbd7ff56ca74a7
SHA256bf3fc99fca4b8df61da69b06a84bf10e59ad3f7bb4a04a8e062494fa09347989
SHA5121092809acca204c06c2618c447de680850f9e8f2ec140c5d97f25acc9ec5e326c376f3eee4074682104d0db6aee93a77a2886109119e5abf72ce71eff5f9fe72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f4bedab99f8ebd7fabdaa3712f6fc0d
SHA10eeafd5835661c9e5c115e13d967202a6d770827
SHA2562f848fd69f5b35957412f6b830b4d9b55cc0d5895142b93ff0140f21faeec3db
SHA512d9b75ec7a8f3a3bde76adae119dadfa85b5e8583250b24d7324f51402144b93bcd5b0c4ea99f07bb4e4cd00e96da25cba0ad2793de558623b9b3c7e3957c9542
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5100ea99bbfa2bb41141624c3c21326
SHA1165f879ccd224e380eab24a408a76d422c827963
SHA2562ef7118978e96c5dd3bc38905fc773f5880b8452174d5fce51b4dcdeef9c113a
SHA512e2b8824bf06c10b669e20827b5ca2e4da47d3d0105f757a511f61667b274e6455bf80f3e51cb046311cdabe8c260073de8a7b1a12601df3812bb52170049e157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502c9dd22882a04446be604653f6ecf64
SHA1c99cf551c6b6f88abdc93b21bd3a21c463527d9d
SHA256c37f10cc0ae6a757dd79fdb577464471f1ff15a951e2109634fbe76e5391834c
SHA512d718349e3650a59b108256d7ddb0a775e587dbcce2be14b36f8c2c621a2fabafd8287b4b2fbc390b0ea732de64bda86e7f41ab51552a0fbc49caa2d66a3383ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a7c10b52c74afd4a0afdd24e28926a5
SHA12448e65ad80b4bc453559cd1fa1f5549f8df3ed5
SHA2563ccfeac9668c7b37974e8ae47682947c25c2f60f4a1d8059b8b6308b83f57907
SHA512ff989671b23dad6ebcc03a062f3b5463235a3315713f50b4106327f66a6a7d1d37622611b6627e21490b009a35b20402625ee20073acf7da78b1a1cb5101bebc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c16d2d65b4469907690d8c03566f177c
SHA16dbdffa3ec64afb59b95ad443741d2dee0966133
SHA256f0277091f7a4f6ea6539c4d4d61c50a5f8727b50626ad4dd814968b71ed71e4c
SHA512f9251fed47231f553ce59246935f8c34ce5e85594b4bd5baef15a625644e60b4be3f2be9bec307cd5094ef70e38249fab854b136d23995b3a5a2dc8fd9138f16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e13cd8ba4d6d28de2a4c3895c4bbcdc
SHA1fb0ee758ed2540dd1b99264fe5c8a3a3ab25dda5
SHA256c96fe049d52ad0d4c37b8b02c90569ed8e4f65d4ae5deaff43140d9282467afb
SHA5125e8e894cdff68c6bdd1cdb8123e665a13bcc57c1bd9215a1f05d51fc87fc1da6a0e1b135c3d59b14946a649a3bdf2c0024d0ab0b6685907e7bc4ddce624dbb58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c09cb5d1d348e6695fa58366417c602
SHA12bc086e1a29e3e1adde1f150a3b42d08980223e3
SHA256bbc94343a147ed095955018833ae599670e5585721bdc82c1fbe0b4ed4b8db20
SHA51269d8f4058658178f1dba216ad3e64e30105deb94a6541b63b2e0241ff911dd5aa368e4de246a3ac4c6236dee52b2cf09eb5253df155841324d3e6873bf31c53c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4aed86c1161b1f0c48fbdf294c54eef
SHA1b1aab25c3270a180c2cb83ffa7d8178682d50c98
SHA25624f986fdcb2e14d394ecca822a2b4c1d8ca4166260c2ff33888576bed751db3e
SHA512fb50534350c43ccedac39b270bcb54f7db00421e13bbef75db7d715f1a3ef1686e7f204e0f1f6a49e0d3e7c4c927a0583cc26ba65b505bd591d42f2cb3ccfc84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c4967d323eab48a664d05ae0e3f107b
SHA1e425bb2845f0996cea27abe80573d2a176d25857
SHA2560823d14a3c930734952ad392605521452a0ec41b6e9fef4b9131443f75e396ae
SHA51220c36247d07c74beecec760ae91166e7b38998fdedb965942935c0645cd58e9a5a03a519ce109adecd0405900e534094c2e4361f0d788dee42297da9e447b752
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3a548ddd2581014bce7984aa150a5eb
SHA18222f760445fbe44a194419782ff1cecab0fefba
SHA2565bfbe60fd1453e9133b79ae95341b58d363ab03083856c675b06c7a87b1a092f
SHA5122bac0de48785e3e50b84098ca36cc6e35d84906db15e2ea718f8ea9066e0990ab176e16a3912d6de960f9a660f982be388b91dc0df92981a19c45f6925e7ea50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57871d27658fd1718b692762a834511ae
SHA1c5f7af0159e7ef3311b70e41d898040a5740cec2
SHA256b10c89c3d166e752ff1d1e7586dfa2406bd5442970ef92d64b67f176e7879955
SHA512152936d122d4511f4516bcc1d7cec2c2a967a9d80769c81a446d3f667062c4de7be05055f58a21065229fc3e53975d7bd2cecaf85629881a29c34731ab24ba11
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a