Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 04:37
Static task
static1
Behavioral task
behavioral1
Sample
7bb8160f8ef5be7f678b1d480d528ee9_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7bb8160f8ef5be7f678b1d480d528ee9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7bb8160f8ef5be7f678b1d480d528ee9_JaffaCakes118.html
-
Size
65KB
-
MD5
7bb8160f8ef5be7f678b1d480d528ee9
-
SHA1
a6f2324a73ef319419ee0cdf41eea03120bcfbe3
-
SHA256
34fb81b9c0db5e80fb9871bef5d9911aa099e7eff88b56b42abadf5045274b5e
-
SHA512
fca72309ee34ff479d9cf708ae834eb0fbb3007ed7bff7fe985aba8f5eb6b5e3bf0da6bc103b7c652236fbe88559f8e5cb211c9290bea0e8b17f835967ab39d4
-
SSDEEP
768:Ji0gcM8St8tN99OIs6oGzqoztoTymhCZkoTnMdtbBnfBgN8/oyo8QFVG8sG/IjkE:JGCp72TNgec0tbrgae+NnzAC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0423dc8b8b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3847401-1CAB-11EF-9A72-56DE4A60B18F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e2d76d165172645977514224a641ed500000000020000000000106600000001000020000000d41cad87d310718ded1f1810e953e808d4354da23d32ae2004bc92a032cb0e6e000000000e80000000020000200000000a6589486be7f0ffeebc745ca0316c2753474aad6ea3f3bed706555b823d89f220000000af37d63ec00aeba6561928e04b0dc1494daf7d84e33a03b906fc98a875fcd1ed4000000098673a836e90e48d43b567f7d97c54f449568847b742654fb0b8704c58df55f16cd1cf8ff98b14a18e7b0b78be757f1b913629746bc66023fd7e2135acb8902d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e2d76d165172645977514224a641ed500000000020000000000106600000001000020000000fdf352c394534205087f7c4edcce244120f9afaf34dc2ffe8ef50e990da8407a000000000e8000000002000020000000ed87997f76b7c9e0cbfe559a33c120d9eb4db0607382e14e56dfd9999648078c90000000d1b0f56dc0ef8605e9ebfde497473e7459d4da8bf3237d2d7bcf7b432f7c92bdaabf3a32dc23a50b0d13eb77399a4fd3cc12e69743b92951f1950c1f014842057f6fa75fa208084b35cee1b15052d8a7f88ae5d116decab34ca213c78c2bbf1de4035c747e66196e8da6f74a483989a2a64cbe70b9acb271db74d64f760a4eec1f5fa6c7b1bd44e03319dc4a703d5aa9400000003e530de180473494d66d58a75b611cfc9506d4e644b2591b1c9efe47a8794d71c3b7bf2020c0a625a1545a5413068e8ad63ad390cbfb16a9b4e3d4e6c2223d8b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423032900" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2464 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2464 iexplore.exe 2464 iexplore.exe 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2176 2464 iexplore.exe 28 PID 2464 wrote to memory of 2176 2464 iexplore.exe 28 PID 2464 wrote to memory of 2176 2464 iexplore.exe 28 PID 2464 wrote to memory of 2176 2464 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7bb8160f8ef5be7f678b1d480d528ee9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2464 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b435c8d3f9d5e4d587bac6e09b0ea1bd
SHA146d092e90db5273e82e1118092901d679e613e5e
SHA2564253e8453b4f51b60bfc3176a56dbcb89b775ac1904e4ac04d3702c709d60199
SHA512f90d8085fd547e778640ad6ffddd79e546341db93fc5c534bd2d09aed48358120dfcff47efee5613e529104754c6990cb3d681f7511da5a86cbd2838644550e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587d2b26aae2f620f86dc900942708914
SHA1918edc6cc767d5d4ac7432f36ea3f5e128aeea02
SHA25622e203e0d3411ef1a3baf0e8b970a5f411886e50fcc78877169d38f82e511127
SHA512b43332732b64153b4275eb463c328d57bb7b01bc56635b5ec9bdff1bac1210903f88e7862ca102855e912264030f2301200a2a37ee56802b8c91e7f3ecb3a8f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598dd3802bb3b7c36e4935099673f3c3b
SHA1c9c378090c4945ecc4ab2b547ed73b728741204d
SHA2568f8ee0660f8f11245f361b688c2d97fc4c6218b04066586591d38436f5be263e
SHA5126b48296d066d351cd7bd89e3187373f8b553c3e2abc4f1867075f2dea3de0fab91fdc94ab171d9b7684837c29ddefb4e35ff1a4f62a5012967fde5adce15f4fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d0f3a804cf7a083a3dcf36f5175d8ff
SHA16a47ca76db219a9db07b433b191ba1912f31bd95
SHA256958e3bd2ec0530ddb91bc5fd3fe3a1d06f35fb6f0b66e3527c5b223d7c65e528
SHA512fdc50bc06b548a0f4381175c3a4a7e415b1ee4701441ec64b80787d6bca3dabfcb0a204e68f264c4a2e7c4ae0cb94bd5ec1f13a608d852eb1c17a977ce235db3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5540f26972de7b2e2e072f1bf753cbc20
SHA123f5bcba55a4b7a120cfa51173a8bda02095a60e
SHA25685aabe9d522bc827f1533a68c7e63927ee134c8fc6d83b0617ee8aed91ad12ef
SHA5120b6f2f59956dc3f25c6730b9633122b49d22275c2dbb00188a03081ceacf437e9dcff360f75930838cccf421c0494d22dd9efb2e2aab700c96c9407b26bb91b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587d76a05134e6700ec72d9c24c7e01c8
SHA123828435849c8fade33a027dda1056771eed1e46
SHA2565eaa3c4b88b04e446164cf92f15ec967f31e48cd7cf3daecf6001253ed518469
SHA5125bd4a4a1537b2e3a16ffc173c0df3b029cedf7b0c544e0cc4e2cb909b622f8dd0e505a38195524b996c3c5effa309466377bc16763fea85064f66f75f7548959
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c8bf9d56e481b777d756037f2757821
SHA12aefa59dc17bc65f893dccb1aeab5ca59b805fc0
SHA2560abce5eb41d93e7a27623fbbe42f1cbbc438cc96621b19e3af52b5e231925413
SHA512baa63c560a224d91776666618f7ee26e50578e503dcd0d9dedae42e6ba1fe7a21c5b11850b7518e7f0a49bd08488bb9420ed25b22b9983a2ac08008f3a4c2c43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503a6055c402a54aff1926eb0f5e00c70
SHA103e6aa0e45767eb50357091eaa5e18bba93fa9f1
SHA2568c0a1c5f8b42d2245491588f8517614d91a161d8a5e469b859bbd3fce60ac9fe
SHA5129040eace0a36282b6004a61cddd3f6969fcca521313477743ac3c064be114151191105cd6407270086a5c2ebedba87554d6457ead2174d9ac9d7945baaa964ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509a758d37b6e29b94f1f72743cabb102
SHA1f10c486b895dfb54a780e451f2a44334b0f90d77
SHA256914c61090fbf39bf473fd08ac5c8239ffa2f18709d28e60e3ec34d8accb46406
SHA512c6ed52349f5efcc9d4c6b9ad3221e7423a3233e5f09725dd51b762cc07baeec8e900143962dd4822e90b9303b15a75f94b079422fb7a69cebfe2f2015e0064ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5578b0be55756965541404626f500910c
SHA1d0a501e7464bb454bb977af121d5b01631b9364c
SHA2569dd34e5c2c2c5e297584a7ed93fdde3a1e1a66b96f95aab9368beca69f53634c
SHA512230dfe6e3be7e4cc43091d8bdb156f98525a799acd52ea6290249320ec550aa7c8dad8405bdc4002f944ffdb762175cd44ff841a90964a665f8401742941729f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50af3a69836649597f07b31c416a30f4c
SHA1dc4eee6f57de225df6deeabadb2e1e1354282a0f
SHA25651a0cf5248801d5fd6e7e4e92ef783dc4fe6ab6c63e34c11923e111d93677c77
SHA512ec5373904bec0d16672c32c0e1481d4417ebf81de9f4a6ea45ba18ed03ca18eb000c87e9fac7609cb5142df8503c52972774eb95bd98fb9ab3c94ae68c85c7d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57eb045d44f2b8f588b8bec4bf5353f7f
SHA1f3bbce21821b310bf4aec5912d51edb07e48a0b3
SHA256d00a29d1270e96268737a54217ceabcd3c2b4e17f9cc83c7bf541f6615b652c3
SHA512cdd61f77865920700a68dc7b845e3c25dc1158fe496a3013722f4a50ec4aa859e033ec28d638aafe8623cb5edf90d9ce9b83170d182ff7811ea05e355876bae0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1839f0e670ade3a1207d7f64a8014b6
SHA13ae72d1f3dcb7274959572c639a3b7deb549e5be
SHA2567a0d42e3a370c7e429f4acae318a43ac1867809746a16b3c992051c005a2cdb2
SHA5127cb67af402aa78d316ff47f3e5041c6e0c304a641b047716e0d1b11c755dbd64d72740d07f93ea4ace3229dec3684ae1029b61ee44cc6f1b57472c384132ca41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecf4380cd9f89a61a5c9a541a8589380
SHA150e5f7e17bb82f29ade8c9e8f2973f0b57b69f01
SHA256ac612d4201ba64169461ebdb6dcf331b36d4fecd42d1509343d359c6eec2ce4e
SHA512408c67f8434b5523a37e670a6204474b34e4c076d2a83937d1d1f660ade9b91ab280ae0587b8ac440a90d72f32a72d00ddd2242ce822b3e0a08c7a68a47e07d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf2c97ac10223b33c25c4d40cb6aba73
SHA10b9425c254757fa6018f76a981966c8bf62aa16c
SHA256ff3fe771daefca059ace8e8a37ea023778bf646b20a793d5a4b003f1ae6cc203
SHA5121c1bb2a5a9fecefd3dd9456c8d18ecdd7b030fd8556b79f39a0e70cbcd94a727e9a48f17e296af0e30e7a17d418aa7613bc4a583df0088919be8c4244b1a53da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a16fab586b970d3b15d4f2adfbc250d
SHA15820e0b76fa4cf220cc073ffbe1d07a3bd149d08
SHA2564dfaaee6c5ba7eb49bf6f285d279521ec7c0ee77324eb659d9f0d67baf63dbff
SHA51252f90b5e34767dfd1386fdbe05728ee331c3d47fc6dd07f803add46644102be5c572960467bf498a5146f2e7318c460f03157a57e78dbc5a5732ccf5bdae39ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb794543eb8d9d4c1ebf872b8a70035a
SHA1ea3c67e99e8a76b4facdfae68dcf17ba989d7253
SHA256173c6ec8415ae1954e5d1c36c62ae09201a1609d9e51d322222477e0ccab5eaf
SHA5128a8b702fcfd224f21a9d52147ab70da3db9aeb69565c8fd760025b3ee67966aa8b4d448036a2e0769ecf00c0a8e738ba23cda202f6f4d57e1333d0b35402eaaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcdca663cce93ccbd64f8685fcc2dbe3
SHA18b87c4aba3876e6e113c82c8a251cf532ddeb3cf
SHA2560c4a6551660d09dcc3d3e96be932254ea244d4c5a58d6c28b3a7c59f732c406e
SHA512498e80ea51fc2b485d0a6d9edea55c939a7ee0cdbca8cb687d9d01d5ddb223587b1fc33e67591c70b2511401ff9cebf938108fbfea58cb87e7f74fbd22511ed3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a