Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 03:48
Static task
static1
Behavioral task
behavioral1
Sample
3dc5c4bb89a189565fdc0331c8b0e292_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3dc5c4bb89a189565fdc0331c8b0e292_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3dc5c4bb89a189565fdc0331c8b0e292_JaffaCakes118.html
-
Size
26KB
-
MD5
3dc5c4bb89a189565fdc0331c8b0e292
-
SHA1
e4f71a4f3ef76aa147f6ac821e29cb9b11f5ec87
-
SHA256
10c0b848e49c13ccbf91cf1c4e711e831e2090f2001d4c74ebeeebea7d24f0cf
-
SHA512
dc2574bbcb1168d9570478a03e2ee7469cf554eea24ba8e1041804984d8388433441d35fc3220aae2a44627e36556cc021ab1505a930c0199677b54bce94226f
-
SSDEEP
384:cJpUD3wm56rTspAZX9kzenCgBWPJ5ViX5ivqwutjAMeoBEFG2:epUFcspy60Cb5ViX5ivqwuts1oqY2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000e24a334211e6ef708e8cc5e924e39f6c195cf05ed142bc788ad1d8d4a55c9f04000000000e8000000002000020000000133e9d315ab5bf666dd1f0393f2c0fefe1d4309d065c4f4cbdf38e2d6b60f3239000000049f83287f1427f92158df49f545c67988b862b8e95d5b4c9bbf9d2e82e53ef1d3bea3577ed1fac6da90a31ed4e51554e63442b8114962322229bba40bd4221815e17acc66c347ed8fcc02b01a4ea4cdcf3fc92430a922f809e8f11c9760feac6804831e6f01405817c90d0285bb99227d15cb138ed3b2d0616f12cd6637b40d124e42304f7508c1dc6e4c16e273bc46d400000008a9ee818fbcdaf9c2a52409f28ddd8ba867e13bfe85ea478b845709426f8c436e64b60592352feaa045891cf6eac4df4efc394884b681083df9296e2a91ebe4d iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1C4A181-11A4-11EF-9A72-56DE4A60B18F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b057a6b1a5da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000c1d02686dc7f0b2713c868a08d663ef14d22be27debd00e0c2adea318f6fe7df000000000e8000000002000020000000cd293e77ae0b12ae9cb291fa5a0a7ab52f883647548e070da0bce826bb358d08200000008ba194104969d44574907a412d5d77ce4f0bfa560392f0f00d7c4141087161e7400000006953981609dd52055e5f88df0dd4cb3ea848d858bfa11082e5902814348d1774562863adf5fd26876ca9bbdf672b1a3fc47665d45d3d23ab908f5c4427a2141c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421820374" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 840 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 840 iexplore.exe 840 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 840 wrote to memory of 2080 840 iexplore.exe 28 PID 840 wrote to memory of 2080 840 iexplore.exe 28 PID 840 wrote to memory of 2080 840 iexplore.exe 28 PID 840 wrote to memory of 2080 840 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3dc5c4bb89a189565fdc0331c8b0e292_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b38e0b31f8c90abfd261a2721c87e78
SHA1aae7d1f353bcca1ce9315df9ec555a2955b9cd80
SHA25698944894b57c756d0f1e3fd089091986f73db628381c8691e7ef5e0b868f9038
SHA512b77e31e36b3b1b06ef85637da34847ae36a76c7e1d0f597875dcdf3a11d8cb88634bdcb5eff056daf5409fccb2b57f73413d5869c0f118643de052766f697d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bb92454e604c9456d0b4ec75c180b5f
SHA1d0a7d85010cc7977b090c525f3c074d373fb1843
SHA256c52a4f707d79393b389bbb58652b76bb203ec1cbb223b4359816497c1074b30e
SHA512b1ef779706c541b547756a9518789e42340233ac292e739367f947f5445fb37f5f1c0c97a2cfb0dbcd072e97b6d84ef35358738b53a8e19873ea9e14fbd7cb50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca3d8a04abaf54695fee2f58babda1b0
SHA1841dcd8d53d1a4cb30851eab5e6ee6c67eb7d775
SHA256e77d622f723a8a7366e6802fb58ea743969d9dc8c90e6d6626658cf0e68540b2
SHA5125e7bcfb2fdce17bce868985e42b9fa2be7bd8d5813711f472543751d8578b4e6835063bcc407391bb2eb676e170c0cf182e4797402bf540ea5cd29f9de2bcceb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5224f4e28ba1b3e7f10892d2bff1d141d
SHA1f6d7f9a8f8e76dca0981dac95b65a098611ae65d
SHA2561221519b6db0e21333cd16ce61d3e650fa7f7369a542cc082ab08481f0da341f
SHA5124097650924e6529f80ac86296d1e2f81e882d61e23c2a3dd89936225b814a75cc564cd31763ec0c8852e6cbc2862f82702674cc7e8c52c415b9e5be44e8a0be2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5085a3c792e2331f9124896ac9a685f2a
SHA1b746cc08fbd0f5baba5bad81a974a3c97cbf6249
SHA2562c1b3287fefb66a65181d46752e9bf55b04e68fe336367e145768523b1dcf9f9
SHA512f5054db4ec0f08de3f295ce77d8d86fdef2d126787edb00dcea2e4a0cb80d5fe9ef715b9f574742542292771fd27357b63069194090d2f68076773bdec563f75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c75956be9b6d3da9d805816f7771e98
SHA1442ac852b8e4880d9e452fff422042c81f0fb48f
SHA2564f0ff807c130bb200cbf7064253695a140f021619c50fd42ab4a2de949fe3860
SHA512b40b97c5d7ebe91df73e96865bb965dfead2fb78dcad4155b037b9c3fe9bf15e4562deef6da5f20a118b65fbe9843cd6c72da22b481a110db323e94b3a1444e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5674175429b9a6ac014b4d3af1dbcd98d
SHA133c27d085507b14bc0e1206fdd9a7eee94c181c1
SHA256e32d16e14084629b04b748ac96fdcb5af97496eec09d6afdebc5c92038ea70d6
SHA5127ea959f32d3133e6fe1742daf6fa352458df338d88924447df1f38dee56bb011bbd53588bc877fbf8049bce799eb71954b06ef2d83dc1d21b7aae17f6900d081
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bfe3e4d42c9163e37493b1464e836f2
SHA143e48d4e54b4b607c974a35b375a503ee94d1118
SHA25605557950d99ca9860b1de27ceaeed43c6210e6a65a94eaac6b38267e2ba5b36d
SHA5125f5d66a42d97d105cef62ce492ab26df8f1b882d3a2c73180749d91ab08bad9aaea363e24767f3d24561ddeecd88137e58c1c6deca96a3ad970361c3588c8ee7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5625d5a483b18f7686847e8f3335d8b35
SHA19003cc56513239000f9629f96404bc744a1b663b
SHA25694c96f981f630864fbfb7c70b373263e36d20864dc78e69d31d00b27e53adad4
SHA5125d4c53496b048aa45db6a50a80d9f4b66e1d98f15c08e0df59fccec03e8ea8dfc6703b1ea66fb9089f2357570f6fd2ce8ffa793e80f5f15461d72b7335aa0ae7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5f6edbab88ed4b54c8ffdcab631c9ce
SHA1d86529a1bbb8ceb89d0e1a609f4f21e1dc53a3ac
SHA2560c27bdd1d0090286aff948913cd5f1a3d1c512ef65030def3528978ea20a9adf
SHA512a5d01a0575e4c46f291cab4c77a4ae549843562aab3a790e987b67c3512881703fa7682d51da187bff39abf85ed6a04054cec0d1adfddfb07aef76d84e0dfd56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3a65a2b6e53492ede77c95c40ea23b3
SHA19fccddcfcebb9e9144c2c298c80f27ad0816e6b9
SHA256620621e72b511a762d36c9a52f2267fafd6554f9f7a80937d4789a282c28175d
SHA5121102a2608a7964ce20abca0e58358cc7adbb9f51ab9ec91ae6312f0cfeeaf44038f57237cac8f10e2679fb19f0201119ebf6450570a116acbea68ae534af5950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529aed518aef789eaeb65f02fbbde6a49
SHA17d7011cca03b269081e0c69253577886a05977df
SHA25613a08a030156916a39c5c8d576515c9ddbabe8948bfb94c5b24b616111db3228
SHA512ca923f968882fae6f121f58f79bd8714a07269966487392588f897514a2c13379ddf714b1c186279eb9d18d77a5c883ef2adc6f263c753612bc1887b7f578023
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510717a53c22ccdf2ba0f93e925eaa0bd
SHA12add011136dcb425ffd1b9c8003dd977381efbc0
SHA256f6666a0c52cfeb06380763b2bcf54b3a18e044236da9e851ccfd130fccc57833
SHA51298eed78fea336a44e4caf37040227a52969b9908de2a18225e08e048a06fe470c106e36afa79cbf827dd6f8a622adf8a7e9578d4447340f32f7d78bb14ec0f8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53376e6e5d501888ea43f4de100ccdfaa
SHA13036261227b20b5f1aa1d65632258f1c245d3627
SHA256f78611275166de18fa2d99c14540d0246b8d03db6c641d9b78f433286c5b0ad1
SHA512510e3aaab7618715c23e43cde75cbeb889f2fee82a3a8616cf602443eb598534c84124522144f703ad3070aedd70ee5b6d5d0e41a27e2023f9266b9e772e13fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556c1754ff99dd34756d1a728a67b0b0f
SHA1feac43c5014aece86d332c3d9977bb8a0b9aae84
SHA2560c3c7060bc580e728f443785c941722ff987fd0fde08f56d29f0a9108e703d10
SHA5122e5c4c0e5812004334db58ca631d86b5b60a5e5521b131631b0f4ba90c15c67cecc3524ce9beecde82113aecd9007a455b870b446827ee2aec341b3485f5362b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547347945b37503b70386dfee8a0550ee
SHA18a19a11b0821c68363a7e8b07ea31c272f6f532b
SHA256eaad493bfba9823b4c99dfc7e94cad104f78a2666cf4e530facd1f2da32ce99a
SHA512247491b4a0457e28d6d66482d3c09395b59b116ffe0e5a3a416af9c3e848c2838cc02a7260de48ddcdadeb37c1b2e59da82f9aed7b0d1e2c14938062a7e18cfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545c688b164af7facec1f121e1a5c3b24
SHA176bcff72b88883f8f9d0a7e85658fcac61ab0bad
SHA2561b6f118d14d7bd803e38f0f106b6bb4c28355e05e4a2c07537c2feb0ee1b862a
SHA512879a267b5ede7ca5017ae6bc590e96790bc74af52c34880e60d7116a8da0ac85babb9fac52a2e3ee4c241f6b48bf12f054be28af6cebe9d1f1b2835320912f74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3db751f9551403c7e70c834b471c320
SHA1afe1e489d8286d18327075641cc3e3804642a5fd
SHA25635ddc0998c81c3840b31a144d3e25761d0065177ca1fd1bdda9b8d99f3c2b726
SHA51229f1ad66f2e8a98a9ff796e3c78bd7930585c4c65da0b05c67d0c973a73f8397196098a57b6bc4aa4df9c8e2590e37e16dcda4965835ef6d01fd905564aa68b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f415735ee06ad029c04b20ba010ffed
SHA125e0cd1c6d7f85a84c5810471bcfa6a33284de82
SHA2568822a9795c44356dd5522ad4648dbc50898b7c8bc87d4770c346ab7ef7fbd9e1
SHA512c7b54663473f0ef520c5484e796a24dca4ae2581203fe72a46783d242afced9ada600f8e7a929c8b810f95d32ee84d0cf488096189db731a6b170e6f44f56186
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a