Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
42698ba05a70b0b633e5abaab98f5811_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
42698ba05a70b0b633e5abaab98f5811_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
42698ba05a70b0b633e5abaab98f5811_JaffaCakes118.html
-
Size
68KB
-
MD5
42698ba05a70b0b633e5abaab98f5811
-
SHA1
6249c30e3e264a86fb40be751325cf132d396a0d
-
SHA256
3eb45fa5564a9191515dbc2c4bc6812ff8c8f5c3c54a7e246efab8ff6f7fd920
-
SHA512
f05b48fd4f6d0c81fe7ceb22efbb05c34e29438de180d002bdb86cdba03b234107c480d289e851a6f10489b109d65b4f9708d1ad9543292212b748e8a9825678
-
SSDEEP
1536:zMqXhs9F0IKoYvHq4I8yp3rMrMKObrer8r+ryrGrVrJrm8LnrCrXeqr0rrrfr1xw:zDXhs9F0IKoYoAT7C1yib
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3047bcee28a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1638C451-121C-11EF-BA28-C2931B856BB4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421871598" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000775802fa03f84069303f52992491dc81d906d85e342434c894c25f5dc169b2ea000000000e8000000002000020000000e8442ab3903207b75f08fb495f838476594da4401e19065c2bfeb0b2d5da95bf2000000047b6e320d4111e5a752fc9917bd102b933fca50d617c25b53e7bb2ac694d3c68400000009a60aa7e0cb4e4eba9d18e307c37cc904daa253d1ae04ccb125d2996fbc161649e7e590495b29ff3c4b17b7eff99e6034b462a9506f7498acf39dc48b5dfb4a3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f7c262394b84d8959e4c5e5d820d5b86ea5580e3efc4815ba3beade1dd38bb5b000000000e800000000200002000000074475d842f3ffffecbc6565b506583414ffc6922f129096f5e513f0672bdbdba900000001f639b82ed92349a41b4f0a28fb904aa0c9aea5e9e67ec9f78af08ea79d40a0414ebfac5072b852fd2368042eb290b8685e51f2b72c3fcecbd0e303e87b5be5ad4c860a522d2949dffd3b44a7745529991a6b2f176eb7678bde398621f31597907763872c97dba329f7da6075d7d3c4e898c8e55be94761f1833ab995f6a0e4d832a5b1b02abad6d8b99008e1c8691a8400000004fe19009298afd0851e1900a6aac25d65fd74b3326ad216cb68d8b76d12922604e7d6cefdf379d15f0d5364f1d12ac925dc28831c894b4b8705802227ca6305d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2140 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2140 iexplore.exe 2140 iexplore.exe 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2180 2140 iexplore.exe 29 PID 2140 wrote to memory of 2180 2140 iexplore.exe 29 PID 2140 wrote to memory of 2180 2140 iexplore.exe 29 PID 2140 wrote to memory of 2180 2140 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42698ba05a70b0b633e5abaab98f5811_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bb4166e7913b17e9877c7f92b89ec33
SHA1c3dc5db6f0750d0c873c6d65477b67cab9b58cb1
SHA2561185431f112dd9f907ff6166a6beeda5ccef12b3338347a3eeb3c3cd2ad12336
SHA51290944eed262be57e1b7a66e9767b0a30cdf5910c8997915ad2ec1e27ed59af9c675c4222c46deba4ae7ed06660de7e7359682e4236e347047cfa7c55769c400a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c30a723fb56ad3ee898b3361e83dd690
SHA18a78b47205792c3110cd8785197aa9afae798576
SHA256c6454ebfb58402a0678236cbb463b7b35acede636591bc947916eaafb8cc2d12
SHA51211d3e00d6c87844b9ff18eb21333f8d359be9488dea32deed9546be8989a42f3277e0d887451a47b90092a579733bc3442e3e09f23d6af4692308e9f888d5d25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a79fad951dc6ea38efa9956c28e80217
SHA19424649f8fc8460bce2fa07d693791b39dee91d4
SHA256e83e39059d150cfd4f527b5286d8d1101cfd43f3af8b9bebc96ec1098e53456d
SHA51225610931adb642bccd77adeacdff1ce090dcb315ef1d87f15f0ed5eb79568ee48543452c1c9d26baf691627c324f78826bfeb0c3d2d4419715c35fcb0bad620a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2f839400e92eab28ba0406f71877810
SHA1007a79acc20cba2199a9f0e9f7572bb90b34cec4
SHA256d4a92affbd3eb6d1b26a35debd2d0e52c4806f6803734ad7450466b1341291b3
SHA5120b47ff8e65088a7d6242eda6f9cf01282b9933df774b46fcdfaf3925f56e16308fc334f1ad36eeac23a3a209003cdbce5c89d2e553825de0ad70de3a38732969
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548501eeb63a9f6d99babcf896814a6fb
SHA1622fa80e60e97c8ca6837948984d8fea4aada9aa
SHA2568ebdd85480c4cafbf969de3f3cbe88788434646b1f9d318a37a635ab5798bd8e
SHA51242f08f887b091e377a9d751707e93afefa6a5d5ae04e17e4c4661c1db8d76b4e7c58080aa7241a71f7fd9180546eeb2a042e98d6d2f833951b67ee209133e908
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbec3e88921cf6c289ef692a442b5fdc
SHA132819840832db1146a34d84c131c16098e92b04e
SHA25679d38356777bad7dd055bf9bbf27019e0587240d2596af9368ccc02edf5f39b3
SHA51253b12319749b1a1de9f231bd02e8abbff83ceaece1e914cd205bd036c6533713a7fb3a8aa3fbcdcca04baace4ffdd93a8e87d4eed13bc6407d7b4a8ebac0f628
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a20a16076ad10449ada68372392a4069
SHA14f71b7f1bff7ebfed5990b288890fd23950b6376
SHA2568fddc0b4e61d955b677af6b04db37cbf9ac4c1e0bd5e351165335595b7a17841
SHA51219e1c188011229ec6c82a28ba93feaba8c5e5f19dbac269e3f4984962390f2cecc279344989b1f1c05b8fb56c53eda57540b09e854fadb8f1331dee7c3b23b60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5558fe86e8678097440ac1cc1c5a05359
SHA127689dd00fb1c625b1cf2963e0ca645bf94bd9b1
SHA25635a9bb46d3502fd72d3c718bd352cd9ca2b4990a8f1dcedac27b57773bf4f733
SHA5125889085ad1169cf8d60c641fc0b932ba2899800942438d07aa1d6a19f07af41bd79370aec8cd8f42f3d46b67c9669162851d6d24aa7a213b5de26d33274c9893
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3540e5e56e2480cdd3753d367816680
SHA1c6a0bb04dcc4cdd829dbc22ff2a844c52b629e8c
SHA256968b69ddd55c3342b7b76719900b9a8f2f8f3c02cd76a9d2c459bb0bf0b59a37
SHA512e3e29a29643294605fbbcc40b437a0e3a8c5d8fd7f478b1bd3780a3fb12b9dfc7b03532058d58488c366bbf9d48399f39f12b49a71d0c4a3155759ff964d5db5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58dd167c326fb376a7df3c33d187a9d92
SHA16c8ce0d1a376c0e721b396bd1fc20c8e71ffbcc9
SHA25631927632362b21c2a39fc68a95eed1258b573ef05e6a46873e9ea892c8440d3c
SHA512ad5ef9399f8fbea43575ef070b22873e0970829e0747d5e5361464492f36dd918291237d2ba520ba2eb83d8d28fae153000d274ed0f812e0b82d3d65b0c041ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df5216456be75ff476a95c5734f6b44d
SHA121c2326a47c7adac7bfe0607aec5a4eb8aaac792
SHA256c1285c7e6922a8e930a6d056650295dbe235748e5c1596e14484a079db127789
SHA5123d8f1550a4f702f213a24d9e3b4210a9a5a2dd606fbdb72a346a80929a6bff15291de587629d032af14636dc6cb5ce9c1a03f0e64a3e5b85e531dad52c6db6de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4e35bf578c3f33f101aec6dbfb02d97
SHA1fa75f8d4ecd87b2459d8848f060188ab5446485b
SHA256ad7bb7b631d552c6bf4261acd130d9b225e0637ff59bb241ab97cc7c21fbed4f
SHA5126384e672859dabdca517adceb0cbf575de7125b426a39f4245797c63762331ef42d2b588cb90de196c6b870d02378a6abc2f5226f49266918a5e48bed522d9b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfa9e3053e59d077b1b0ae9a06252d2f
SHA1eade164f2c33dd4cc95763cd574f7ccd6b22a21d
SHA2564dc95cf85133e2e9b13531fef00f6a853e8ae6f8c94b53139be022efa587a17a
SHA5127eb7b60f265df9fd40bdb7a931cc5c8c7bf1e3bf482d95054ae9a3ac8155904eb0c4308c11a8d1357a18517d05ac8d7db1eb23fb50632815d277215ec0b4a37e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8f8d2d81b90a66273c1a6116a5e7dcf
SHA150b8a172746d3043acd3d80796fc08c0b5eb9ca3
SHA25614835e2fee4d318e6f9538decc0a44121c4572f74dff5a9029fb2c710fc6f699
SHA5121a4304b6f8c95b9cbc31c453aefa65f3de20515e26d021069e39107c679cccc18c053a6cba2a293c3006adb61718dba1a0dd1def81eb8bf2eec15ab816888b55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541ae57618d992e7fe89b3ee4bdf94d3c
SHA1069e03d25a44c87cf78f8cdf72b8540f07ce8007
SHA256f91bed5531c9a544d6120d23dc0441afaeca603a19e69aeb3807df7464f5feed
SHA51237d1c61f4cb425ae46f977b2006df10f5d75dbb64c02e7e72a48bbb033dd2888847600209caca22e82e385967beb201101b5079a9ddee523d72cffdbff386a1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b10fa72ba9c148b76d6cef6d6e00026
SHA14572b64d04f80ee4c49a871082ee64e3c11ab8c7
SHA2563daa91e4a483b895103c23e9b8c3c2c91e0fafe89aaa0ec09b2e66969d3d0def
SHA512629bc71fb06300a132b55036cb02f0910aaf0f7194d9596debd8e45c0650f259536b036f9df10a9930da85794c2d975a98e75caefe9718dfeb2268a52889b864
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de5b6c24664c1aabd250629d4dd46d64
SHA19deaf43ca538f0b4aa64b02643413eff4cdc4b3b
SHA256d546a0a16000681f52f60138c22e2ef77f99843d2411c471ba15edd086cc0b78
SHA512c0a77913d42ea5ec5d6497d5a2a910e799b5bdd5bd2513b8ebf6e0906f7ee0ec65495509a938a46f7a5f7a97f33fe8f00e16ede37c8a24938cce1c647e0a5082
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fccf6c49bf8f62eaab0d17cddce05c5d
SHA17946c8a7b0bb73b31f0accf836a1d6181507483b
SHA25655a86860bc78ddc0035faeffa305347053bfa5fb1ac600453c97de5b5dd963b0
SHA51221f25b517d3c8801a2ef1263ff4f5a384b688aca58b4e4aece28bca2dd8f3dcbaf4fc18ef7a4888a959b81558d2ea930acda76d7f28bc77935e5bd34bba20a0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5712548b4f18c6df1b433d42ec31c6bd7
SHA1e8548630aaac5de2adebe22e086c639eba6c3a21
SHA256587c4c5598b10f5b99900bb581bad8299746821d2481866d44dd5dcf3c32dea8
SHA512fb45dca6846a8bb21ee502287744e3783cbc85b8e5b6a300aa62f6264c511997115ce66a2fb812681ed04ca983bf64f441a169e017a1705d35d83b9751def895
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a