Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 23:15
Static task
static1
Behavioral task
behavioral1
Sample
4d80e89df486215593c0bc13c395e41c_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4d80e89df486215593c0bc13c395e41c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4d80e89df486215593c0bc13c395e41c_JaffaCakes118.html
-
Size
4KB
-
MD5
4d80e89df486215593c0bc13c395e41c
-
SHA1
9cb92935b15e17feea8755c1ac3930be954b1d82
-
SHA256
c7a45055ada19bfa2cf91790549d559c6552335abda87efdb91134003a4a6c30
-
SHA512
03e52d75399769e4b49121d5fddb90c2037c1efc936350babc61609fc9fd18933d1fefad1f9cff337c9dafecc61e2cd49737a57dbf82c280dfd73a74b1b63bb6
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oGcLPd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDw
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000315d8752f75c480553fe7ecbe704886419244b4d77ee0e363b03e1f05f4591b7000000000e8000000002000020000000a32d3ab47fd55d1791156787d36e1741eb4d392f5482502563719a941694b943900000006248d803f4c673f67c9b39d759c92ab24f7145de0eca498270c4ce175141294455be852626a7aa27fb998f93958fc930bad251d002b9d286e73e9a6ecc4e72d9cf1b7c5523c27565fed4d3835f2b0509d134a9166093b1e76b86207205ed15c724f5b615ee169f89095f8fe6f276e749ebaa08ad5d4960fa8c72f34363f9fda8ced32f978a1807bf04295e4c2f7425bd40000000692e02e26dda23a8c59b6bcb9f25118f74082cfc0ebd2584489984963734d680799138140d340870ad1695691c42d13d3feb0cdb05820d6103dd7f8738228394 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422063228" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0151416e7a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4175F331-13DA-11EF-B837-5AD7C7D11D06} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000cbc7f26d4cb70212bedd352429c238c87baa37e5984b4d003e2f94db06af3bd5000000000e80000000020000200000008dd11079c91f3e692ba9120e8117eb5d45e5b410b8d6ce03b56864bb526544a22000000089db9c495245260e35594c9dac960678130afbc5e21b8e5f086a4318026477bf400000005bdad6a2e8ef3838ebd7d67aa54d853463fcd25d9758e3f3a6f452158a82905d44ec7351b01b9260ae483d31f5e1e34fa04bc8b4b5c5a61d097933fb20d50968 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2440 iexplore.exe 2440 iexplore.exe 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1676 2440 iexplore.exe 28 PID 2440 wrote to memory of 1676 2440 iexplore.exe 28 PID 2440 wrote to memory of 1676 2440 iexplore.exe 28 PID 2440 wrote to memory of 1676 2440 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d80e89df486215593c0bc13c395e41c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524456ecd5db4068d8df5db2982784015
SHA1dd0730a6da5e0a532dc5fe537e1b127a0da9f188
SHA256fad624dfdd56b5c16e47f43c0a603ccd4a7525546d12316cc0e4e62279b66416
SHA51258c5a4a5141b018765b94ed3763faffaa876ebd5501f5c9aeb6eb40b3c90e3f249f80f020dbf6b4b30d79b3ea31d5608a54d490612cf23a4cfb34ea6b78e32d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d217d4cb8f7f60d7d2de2e3b6eaffc56
SHA1a52a278c3732a2bc26b48d36ba4206ca5f3ecc8d
SHA256dbe5ab959251ae3d623459e6e748fb08403acd08562cef6e9ed51833978a3cc5
SHA5122308edcb859dcd96df66008cd73a22c44f3c5e969c91217391b2c36c22f72a62f20eca7366a8772132edfc84c17bfebf19def341441f53e5c3df15cbb183b866
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f9b00c0f89a0138acfc169201fd5be8
SHA1337443a6a24f23dc0e3e33ac90ac0dce7c4e6ff0
SHA2569152cc2417dfcf0dc86e3db58d94d2cc5fd20c44a16243d00b341c0dd77e1aa5
SHA51259aa3cc79e3fe4d41e1ce590486423feda5c38cad156f30f1ff49c95f991df168ca96a219a47513f3ef2c8d82ea2d7ab448b1468297202e8166b80bf66dba6e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1d64c8e1e7b27a90831db3a3e6da5ba
SHA17e6ecf3f5ac8b12e6661dd3799073dd94a9a2407
SHA256fcf1c47fed2956a6b0d3274daeb560c0aa6843209be8ac019955c8e53c9e52f0
SHA51204571bc36b0902260301dbc3b2bca78cdfb96f1449a7e39254d962199f4666509d69176b846d3157802884cfa866a860508261aa551e5395a5a04ae3049f4434
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5630fa8b536bc1cb5d0b7eb6477a0af37
SHA1842225eb6a084ee50b574b3e74bbfa83090a785f
SHA25631e5df115301ea5c2908ffe0e4e7f13098dbcb726b5ee4285fec18ef88251b13
SHA512368e417dddc40313f20df7182605c27ab5ae864f9b21f3f5fdb590c3a5259620f790f347bc64b31b572b64dfc200b722588a30beede5539a540a77050bf2a811
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1409ffcd3720b21df176a24a2d88b9a
SHA145ccd2702c963248eb32443209ee141630d05657
SHA256b13ca17a02965ad260aa7c505948673273d63b2c3a66e451db044ff9a94d60f9
SHA51248e26e8a14c4d7ce7ece7237092bb6e7de9f0758238573cf888ffbedad593b9bcb52380c68ffbc3839470ecb9f54e671b150a65bd50997f00231b3e8effd41bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51444818f3be32b62153fd4107b76844a
SHA1c2c2718484a8ff385363b7282784cf875a7acba0
SHA256c2f7ea4feb8cf1cae9877cbc6deabff43a5b8ae51139d746037b043672ba7510
SHA51207476a775e32fdd23a96558e9dc808e521d425cb1d343ebec4316435b899ecc38d2ea0160f347a5ff7eb25778dff773180b4d442a1267b66fabfb8eab363ce9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5682ac27a6c21b570bc612e2f6ffe1f67
SHA104ac9f15a4aaba71103ef112b3daa634cba030b8
SHA256bbfe2bb30325b07f98b2075abc6a21d52630495f65427708a7ce72d8983f7c7c
SHA5126c15b5b22e1f552f717e4ea587369a547f45e991711a4f3b4f9d641ffa15ab95db348497d457837fb17c83c52423342c78947d2ca2ea311ccb08cef4a4727426
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570e1947e40eb6b2ed729daa99b32722b
SHA1504f442812a3d0fc41547fc69893a47b0a8265eb
SHA256307e961e5acc30e8bb238c982ba74918d88d63c27c06541f2ba95230cbabd707
SHA512cbff38f8c72cfd0fe92f742f89a34f9129cab788001b38d44fd2fb6890083a6bac9d46e933cb40a0ef6c41be528dab9f2500e01e7f73256dd667fe795812abd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590b7c2d21d58e4812d06aadf8ca6d7f7
SHA1d052cc3423a8a0f6ed02305a83a9e13c06300700
SHA256bfb28bbb276590157776aac21d1adcd905820d6433454a5692e83dc6dde33215
SHA512f9202d4f66bb5087e9fbb00237794cce47e90350b7fc649b6d588ffa0763060aaba1514db0662a117b60a1a12eb1e606983b1fdce647256ca214a6bf677afdf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5a42a4a9bd8b3e2c6bd8f038f6c4cd5
SHA195f27a00517321acb3ae7b7ccf77db9d0c351f6a
SHA2567e4f413cb01221f4572eac387a4001a2d51949430df05710ef3acebce1349d71
SHA5121ea152cf6038f457bcaed3eaa83f1e22ebe31167c36a097538164c746e580df96ab89862d4a17624dfea266f81b306968ce262702533a1d7f682179ba0362fcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f9ceeec6f49875b36e6a88119a9cc13
SHA1bfd02a2948379f8459475bbb19e34a3ab9d032b2
SHA2562f9ff321883a0d3dae8ff0c0071fe429063766b009303c96b3b6d5af24c933e6
SHA5123c484e0db9ef62bdceb71a6ef2592c8d681d5ab2cf79985625aefa0b1d1f2c11d3ece13ca5a81b87d517b9d9599a88a30c49bfc41580b704a2099a0203e93035
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3e32fa8a856edb9557b8f4811eeacd7
SHA162dd2357b4f9b32db9cbc3246b9acc98a4c85dde
SHA256cd73465836b2e7a0e544dc1c6ebedadc143d9b89822fdcb7bdc1ec774ee04edf
SHA51228b6cdea435dab3a8e94f9140a21239697625bdd7ce1a8abdd457e762d6f1d3adecd06187ffca2242c0e7355733419e973bc7c9d912c88e0b65ff6d0998c3c12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e50d77c777fde0174cb26b772d8df4b1
SHA1d4f0ef92ffce6e72c4bdb8ab6f0050d998f7239e
SHA256d7fab56bf978291d047c43e32cca0aa01c0ddeaf9bae45aa6d7f3451c03732e5
SHA512b48bfbcfc1ca200ef32798ee4816381d57948d7c75fbae724dceb042a09e585f6b6ad110f6f683e6933fce97ea93d609431e53c3c68a84f8a4dc3378ae9f2811
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57971db53c21d153919d2d7aaee81c0fd
SHA126b293b56de457ecac76055938a0363011215a40
SHA256d36c76e1786f6e7ee75a99d9654450421a57538a0fa90f335cbed7d85b3b6385
SHA5120abbc5549642d3438ba66461e6a74787824633031392ab7f44793bc7a928db67bab8bf0e01dd50caf920f7cd5b0af3f9cd20c3f9bba37a5d14694acdf5afdbf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bad7321b233d745a67195f4c3b65946d
SHA1a15fc953f1f20e5882723cf1c08a099ae37ae7f7
SHA25630d420410712ae5c5d32346d77d3dbbb3728607c581d87569f88c1447cb033fe
SHA5128adadaf5f3d74c0aa19d99b45153b6e021681d1a19a03302494864f8cd6ce4004f6c923c1f37b11538f29a8835fdc8f8940974bf3f61900ab0abb2ef2d12d3e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a79301ea0605fed43d61543bdac7fd9
SHA19dec78b1eb414b0167992888ba9a64e265fd7abb
SHA2569200158b7c81496870db7151ba83cd504173bf98066e84c99f3c809fceb115d6
SHA512c4db4b12ac9bc63dab094bfc73a35c7fdd60f47ca4c9dae4e8fa9d674daef474eaece21d1ee81b8ce9d6115d5738d1f46c5e7c1ab8358a50f301dd58bc12ff06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bc6eb582b912b3b17a6ba22df267f94
SHA1eedfb186e077756a231053c986f467f4107a6228
SHA25687d2a0a78f2fa7437e9fa26cadb18c21c4e274b49db74f0ed97d017e21254255
SHA5124b9da73f5550fd7f9b04ea217e99bb2a4b18b6c3f5a6aaa6352c9f0e69bd42a1f53057e895e9429d4321100e64999f732800f87b4559ca3c3c7342b1d8f608ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512ccd6ef99a952950074d62019504c09
SHA18b4ee8eeba7b3534a61c7958db5e1d1ab0582227
SHA256fbc5160cabb282c2e718a77d31a63c515cfc37fa6c407e9ed03d33eb84f774a7
SHA512d17a86bda9169338303910c0799780cdabc6eb7432e96656e0aa4c2b97e5fc7305c036e14e95daa196d5810020d1547a4889d0de0f28e6b6e9ac0c6709de5fa6
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a