Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 13:18
Static task
static1
Behavioral task
behavioral1
Sample
80dee92cdc35e35f6c10e3c6903fca4e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
80dee92cdc35e35f6c10e3c6903fca4e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
80dee92cdc35e35f6c10e3c6903fca4e_JaffaCakes118.html
-
Size
62KB
-
MD5
80dee92cdc35e35f6c10e3c6903fca4e
-
SHA1
d06a87f22fff712e136079e000a965840c6a7a2e
-
SHA256
9ec8841a629cb5dc55e8a6a69698ba9e765c0d41e1bc6e404b9ac8332d0f5eed
-
SHA512
c49ddd6b670c7634133fe5d041b3e290fa5c05945c2c86b8b4eb3ae8786ca9d65ce886cb120f16e7e443e3e006c7ef967165d549a4f01ca9b86bc84b9f3c8176
-
SSDEEP
384:3gs/TWhzcLB63idlOZsrER+ozZ1QR1ZS1Axzk1rzF1ytH+5tH+gQ2dnhwoghDVUT:RyhzcL1+GYwxRFOlGLAFpyibqyN
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423150568" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000829381ef4991a184b6d28069c2498cc64c62c36711a2237ffb2c6b5cd023c009000000000e80000000020000200000007a6dd4d27b0a252b5c4881de75d75f439ab40be824029f220abf593539f998a5200000006d608309f2d868e8ca318f8d44c9cec42c3855339429acfae9af6535ee848d3e400000009da2b9ab2810080d1d7a13923f11df210f900fb8b74b09c05e2929012aad04e4dcc33b4183678ee0d0b0f1861f54e046d531f6491a000fb95c0a1519436a238f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603725c2cab1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000001386014bcba37774ead4898504995661d84d9b353410cda08bb8afb79d9e0d10000000000e8000000002000020000000a37b5bf86e39daedbea1f262bb2fc3f219a265d4a1e0998382dd7b64b4def4bd90000000a70123f3e827bf6ba241bacb9272901d37984c80be0dfcb57ec3ccb0f46c091542908abfa07cf0b52a8196ccb6357fdf23ee2b97ca1edd1566f4cfb677f4e45ffb3f9d5891e4ed3d9909d0dd5782170b867843c3b3b73cbcfdf09280aebda7e9c7a6abe0bc748dea258c718fbc4f64e9991253f7c6a148c30c640c8f08fb1a9bb3e5b2a49fac7efb2222a4a8d072605640000000a4fe6ea7ab976c15e269229636d91e6f2a0f610726c9ec8225dfa165e4e47ed2538827e193e2101f208e7dcc917c5fdb354003431de688c7da962e0e0cf769f2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBC1AE51-1DBD-11EF-91CF-DEECE6B0C1A4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1424 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1424 iexplore.exe 1424 iexplore.exe 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2000 1424 iexplore.exe 28 PID 1424 wrote to memory of 2000 1424 iexplore.exe 28 PID 1424 wrote to memory of 2000 1424 iexplore.exe 28 PID 1424 wrote to memory of 2000 1424 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\80dee92cdc35e35f6c10e3c6903fca4e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe29f6a1cae24fefdd346ec216d11b00
SHA1eeba2a6551529655f63b974ee3af9385d306d5c8
SHA256b1ba316fcf4722d61b3e8db67cddc2d202c526a09017db60e0c96ec1421db8d0
SHA5120261eabaeb84063f4160d1c9cf01c53987047f300c8042dcd54f8189edf7c6f352c1ffcb0648ed85cc15699062d1f18983e433923226a548454ce3f2b020ca72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da698fb18b8b8e7b85f4addbd4a92e85
SHA18b49227f786582b81ef1adc4fabba237952e1641
SHA256e7a13a3bbb274e9e3f589e8a7f1b7f00bd9e117af24cdbba44ce5c30dda8ecd6
SHA51287e438a1298be1a140eac1ed562af16068bc3b186c21abb36f0d4ca3726b352a4ed1a16b71601424f0ea04d7583858a429edff852587fe2c72f785a3b4211c16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510f2fc8e3e13fd84224245b7505a41ff
SHA1447372a6aa96f7be87dd88a341c7b534cbb379cb
SHA25625a3e3a4722e384f01df30a4a600f660a03a9eb500cd40ba6cec7467b8e4acf7
SHA5124e85167b7a0810fef2ab1c4a6809dc2e1499dd043ba6580a80122afeb2e09be5e76ab2f14ab7d20b69545818dca9ec5e2aece97525c6b656bbd8ef43e5414f9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2974fb8e4a207cce381047a81963136
SHA117e6ef49e745e150264f67b431a42acf7377ae80
SHA2567a9caef9662c8bfcac4487557e01171c41998ffb11d3e087d9fa74ce495b38c2
SHA5123104ef205748039a974e748a9fa0189493fc5a35d4e198a85ba126bab789ba440d810f409ee486ad112fa198d3258eadf20add0bc294a4c10d7269738e21aaa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a654952f171b09e0a5ca2cef0ca8e5d
SHA1f78f68446ef33e3bc2410d93cc734bb844ee8c88
SHA2564b9152f0dc19400eacf70c56a0498b6902228c0c01b63c8e30d6b495ef6e912d
SHA512511930a6f0e220d211ec886343ece5631ade447fdb0a85fa60d962ba60c952d808957d75514efcb6b0ed3f5b7e79cdcbf3caa6fda6527340f7856c95facd1f8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a67f9eab4d9d4292de7008e178025c98
SHA11515d5359795cb2226f01d46793cfc6c55af4994
SHA256b97486d28685e08260b6620c7eb5ce95110e431e6d395c46b0a927972926bcb3
SHA512fd6e087a24d2190f197d114b918c5a0f337a8cf763bda629d0b1b2b15a284e067a5f607719f2ced220e89ad1aae790de748674b7e4e38b5264d5f678818a2a1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5957d93032b707e22968ee7386eda05a8
SHA1a1fbdf8693397e808ee466e74c61a12091de19f6
SHA2561c1f6ac564371f382686d92876f8ad44b292b5f959b754bec68ac3a9d78e3420
SHA5126efa47807ee79953812b4e497227a60c03b5f76ec3470fb026e5b560398a20bde3a528754b531b8573d77b8727a77f2b118f5e75346a85d793ecf0360ca2014d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52635c567c4b3994fddef83c624e52250
SHA12bad6f9f04e2c756860709b77a86ae121200fae1
SHA2569fcaf0e9d52ebae202058b848b4cf3c3f4f87233bd09f2a00f2935753251020d
SHA512f8ae4407e1549de184842f5638bf7f7365ee0a8390c57f247795fdc8db8a320fedd21c9bf7cddbaaf8833154f38c7aa2f129daa4e4d321956ce8fe4de957fa67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a40d5b099117537ddd35172d4693ebd
SHA1d537ea43e9b4f2a69e04765ad533b1913d3a1685
SHA256bd45e9a03785b5a69699136eb6c85e73a2337d9ca3ef96c8839359a12eed599f
SHA5128baeebc0731c245c4d6f4a05dd0aa966ad34404b22e5b73fb8897cab789c1167ce9f0ba3acdfab77e3fba5aecc5de04018ce898bdb0abfab25589823d07455ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa009a1704c9674560b2fe5cb4fdcb62
SHA1d169e3e1ad78f9835f34b5786e8b4d1c39422833
SHA256dc090ca570373b505ca62b3224b68a7730a9d6d78e228ca82e636133dd0d85c0
SHA512d0e31614824a3bf24db9065d67300a0395093708d67044b880f0cfa7fe6abaa874f207c67d58ae79e6d3c3608f8d37e3ef0d49f957c3f5b6ec107276b5580ae1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500958509060e17cbb43450f5f68aff5c
SHA1c1ed33632e25105c6ad673c330b60b37884151c5
SHA2561f99209d8b73462b88f984ba7cdbfc0399eb2679c71e91603b77cf04b60cc234
SHA51232a0f7152c5f76135d5153e4cbcd79b333f7402fc7867a567ebcacc5b0a16bec425f26884b7692aa13610163a510f8f1197332cff12b7d9235eb079871d742fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e752add0cd502564eea05350ea8409b0
SHA1935e4af1b2c3c0ba8649266750c3dbb5192eedbd
SHA25642af3f36d02382fca73648743bcea12eec0ce3d25d3f978e38c276a103a46969
SHA51251696f1a404ab728258a6eacdeeef00e03182f33bd64fbe92edef36777466f92afc1fca56df77bd740fe838f450ca0d5d940dc35f11cefc7e25b8c16b49713eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b402379fc47339443b7ad767b0153384
SHA1ddd5c461f7dffeb1a30c56d7dbc89f14c8e328d0
SHA256d0659814c92f23c244bb998ec6c633f8712656efa47c6de7698a84b594da76bd
SHA51202c315fefe7601d5db70a62cb6fb93f4b3873b46eb162a066e095ed3bf1427da343d4dfc60fb80892a2529e3a7cd4f5a1a36ee97cfee1cbdd3f687906b97e430
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba8510ce28772a58ec2f6106189069cc
SHA1ad286fdde222b856518781b37e65254e62108340
SHA256ff514b875cda4c124fb28bdd7ae2ec8e7ee54a0be94218c03ab9bd9ba54c06c1
SHA512a83d4405026cc6bdfd017adc90d40a1eac22317ea67ea7860806e745d31cdcae4d10f30ba01114cbca49480ba76bb88f5ac5346b106582f5553b93342d194302
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4e70cae29228f118323cb11b49ab9eb
SHA174c94add48e66d0a9d809366b5e096c209dd650e
SHA256a85704ebc59171ea100317f5a7e64b9318005489d048083321c104dd6ffecd6f
SHA51205e9f013745ec8be8060b3f6295b1679b423b44c51bc882195e59c0a6247cdf0e02abee8f388802e44cf9c64145fc9a43e92744866d157e40c746e88258cac37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579e6a3251e7ea66154be055e29761c12
SHA1371bcb674f4c7c29760bdd3302e56c161bf3c112
SHA2568c1efe745d48856b28ca1556ee9466a674c0ac21aa9d7b0c9b5e63909dba6eb3
SHA5120c7b90c8743889b0a4c1c1006220711df2175d2b4bf39d6b3624f9969e804870ac169aea492cebfbfacb094b3230dffffe4423ba4967d6ff0f4369a381be51c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3db27491bae0a1d729139753ce2256c
SHA1682f4142404d91051f14c85cd58aa8e9be75d8ee
SHA2567f58d67f3c96e661444ccaad77c66894df3cb034df22e338c6c1e8288ea5c0d2
SHA512520a8dc986cf7a3267acdf887bdd867c61426eeef8d099b9696a32e95638dd62122f36c7d48cb20df0e203ea293f7998a69e3a8c245ba352bc672d5e2537059b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5accdca6485a16de0f0e30fb2b0a1de91
SHA1502e7f5b97d35dceef8ad78e26b7e895fef6c227
SHA256ac1665fb8983890a83f7c3000882e0b9c1c002f151f0b0784d57cf65afe7a709
SHA5129cfac8b80a710ad445765b4fe73b91a7e0c246862deb1bc291483e1504d670358173d26fca2d624bdcfb8784decd23ca206c04b09022df20c3acd4fc291b67dc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\settings[1].htm
Filesize811B
MD50a063cfb18939bc20f4cf9bb5c5bd199
SHA1ef3c26a2e1d336801a9aa75a0bb53492a83d2fd4
SHA256f1d03df94c18249cd41de4602c9149fc99defb8102a8a1d8a2719daaff0edd7c
SHA512c6d98030108301da000e8d460b597c0e3871a92ddca6ff28f927f30cc107bda39bf2ed9549054ad2e5f9d600391ebde7e32026500c4c12d4f6d6e1c17faa28b9
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b