Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 05:46
Static task
static1
Behavioral task
behavioral1
Sample
89858ac8374956f2d5ef06fc940ac65b_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
89858ac8374956f2d5ef06fc940ac65b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
89858ac8374956f2d5ef06fc940ac65b_JaffaCakes118.html
-
Size
73KB
-
MD5
89858ac8374956f2d5ef06fc940ac65b
-
SHA1
5dc1d1024b79fa5b761fc6234ac6646510cf4e13
-
SHA256
298c7dd0b9135a8383083a5006e0897ceb1c4e5c80c4b8069aa5df0decc0880a
-
SHA512
22270cb9109c4f63d2a2a6236a915954149b5002a3faa092046dc26dc520c61aef00c3332429b99f1a55cb31b83407a44c6a1f109c1cdb740c9c8b672bf26d59
-
SSDEEP
768:JihbgcMiR3sI2PDDnX0g6sH6n9hAnfoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:JtQTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30770531e7b3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000064b25cf9b2830a17cdacec650023f0a3ee13164e8c30d378fd1b1337650c8c7a000000000e8000000002000020000000da737b94484c6830d6903704ca6e8e2b5a2ec0b4fe41140cb3094c332d66368f20000000791a68e3f1ba701c4865d5eb1bc123c107a71c824f2e3b1df2cd04ab5249f71e400000003d40ba20979e711b780031f0d7ac04efade744dfc60e816f07f3a31e3db1eaf04023ddbd04e7677898f07fd6805a2dcf5ca428f99fc25c875196e88f2b6531ec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C475121-1FDA-11EF-965F-FA9381F5F0AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000067d63536db2f57876ba4851d336614e7675b2e652f6e7e9928796a5b17153208000000000e8000000002000020000000af6d5aeae1341666d3f74b9c6cb29820016d81d9a7cd662a74b4c1ad2d27cba2900000003101ec7aabbe5a06ee4444fe9224d6e48681d72b027ebaabe4436a2e9a9371a82aed88f7961958c9c171655777027a0c435f4fd1de1dd8c0a6df7defd20a877d3295ec72b559b55d078e6a85f072d7ebb83223deb28cc9a565510d0f2578ea13c0ed680a8736faf40f22917559eb2c25acffe4aab2327ead7247dd615b470e5579e9e6489a3cd9a47b8933994c9b12a0400000008a640e029545d3c7540983e29fdf32c1dfcc5245e0e0d76ce06110138957db15c465085e4fc8b96125c71eca7748d7133dc8d088430993f0e2fcff91b72f1fab iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423382686" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2176 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2176 iexplore.exe 2176 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2216 2176 iexplore.exe 28 PID 2176 wrote to memory of 2216 2176 iexplore.exe 28 PID 2176 wrote to memory of 2216 2176 iexplore.exe 28 PID 2176 wrote to memory of 2216 2176 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\89858ac8374956f2d5ef06fc940ac65b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552d44d2e9d8b9f5dd063c1c92ea229b5
SHA16584361f7d8b6e239b2d998f04fe9e7a45f34ddf
SHA25631991e305b0689dab85a6403eaabefc45da6b3bee560c5a96fe8fc53aa6d9b26
SHA512c5a7da02b1c42a7c6ba170a516ea15cb39c71bb92abb1d6a5526f4f0a36df1ce6da4341a323c11b381441659e01ba5a5384a5a3f4ed3c1b0356f2922be4e7d00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565dbb0150a6bb16355b8e4d54b7286a7
SHA1c0bfeabe1089ea47f12c9f3d076bd788fa9cb829
SHA256ad62ad9c49b79859146970a17ad007377901ece474409727926925fa9796a9cb
SHA512f5dcc831c28b5d18f2487729a71ffb23816129d34c0cf21430f7381644186555a10867e3ee03147371161cf61393ca58c23279ff4b4daf99d7c251b63e3df1e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c753b97f799ef183350c80491603a3c6
SHA104ae1646e146f7e9b31454709137ef2b4b6fe9e3
SHA25633e9f74eff8272e1fef218976989a0c0559ab84fe938b5697c62785d2dd9c6c6
SHA5124beb0641e4edd0e63a98929e7e3fa979106816dfdfd4de5d6aee5e55c90a6a41b1f2cf58f143c0bc42a5ef73a05fab52cdf2eb250e10907ef64bf6c7222f6310
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515c7d0369badb692654f2b09c39ee987
SHA1f54ab090d67ac530618fa01cea2122470599ea05
SHA256d59b3e04bc406d6cb1bda944bf9cf6473de953716561f718b1d39f1197f41b47
SHA512d440db6327a31f97659f6c8029d425499259bc03d7174a7c382e94c406f371913c281524cc17a6f92b74fd39515cdb4e9dc743ee2ca0ff62f4842d87f2b7f6a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5daf77a57f06275735f1bef5faed44fce
SHA133a6bba2725127a502f028d61b140e03520dd1ee
SHA256fe4b005af6208354742a4439c8a757644f3660752b9099126b694727d288c854
SHA512307ed649f0f0fb7d51f1c05c48ba25143dff1674ad9923229e1c737623b0f406be2c30b5a9ed83955ffefc10c23fc14ae056c2aea06f1e4fe89a4832b1e4ae55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54da13072759df704a2602c5fa10f8cda
SHA169ac1f08df69f43ee975818dcf427eab110180ea
SHA256de62dbc81707146e42d9e7099dfabc57b4f1f3502925f4e4906a05d4130ed2bd
SHA51203ef9696adbdc876f4e462a9453c8f91feb401e2cc6b1c1cfa1c69e80bdcc682c04cedaa7ccd06a89a4a6b80c86033c6e9f5f82e824676c97c9c50c3e4fe7f9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f43bafcc36b09102a15974e4de4e009
SHA1d9d7189edf4bdfccf5fed4cc7a0be5664686098a
SHA256bc2020b27cf2a1ca0c5b632beec397f9b366716fc21288a775f351d3b55dfda5
SHA512f80b90fcdda34c8e10f341aebf3d5920c0631ce15deb60ad39eb1619e4687ade2f9b2e107e360a43c6d54d2b9c9fcd53b8e41bb6ee0c784999ed3e0959c77e44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580617606af8fd643473550f840581007
SHA12e71e41f202f9f4b3847768995527121d33c8357
SHA2561b19c3fef748314dd601cc5814185d9fa9cb6eb59fafc665b607e61863b7bab6
SHA512272c8e32a44a434985ce4b0ee2f097cc553b8fb27855635e257351098a0f6d7cdaf7eafdb1bc89508f3f82310e74fa0afb58d47f8b0a35e45122d9c12f122d70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5788ba3051e1149f275855da3a410cfbe
SHA14ef2650237bf908542102230a82e538e87e1dd5b
SHA2565a9d1d96d3cfca3da0f0201d7bf5bb9fdf95f74d88d1539ff1cb4cdea198298a
SHA512a0b8516578033c29eb4cc61576d9821565943ee985815a86dea79f7c7aa48a2e4742a7b47da57fc0a75866ad70b93ddc818240d2c69f428c285ee52969d533f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5583e37f5b02d2d16b7daff0f266499fc
SHA1f7ea3ed85287aca32abbfb965749279cb5a777d0
SHA2567795e60326523afc994ccdee2ca5b47dad5bcd2957f7d500ccfd63dbc041febf
SHA51225aabf5894bf1adab63ca7dbe6a2253a4c8c5eb505ac209d6b1df7617eb10ce5240ad62dbb06f6db5c15ba177ae7ea8fb9d4815cb9426abdb2548ecd0c9150d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528d3d692bd844693f791eaa46d0816be
SHA19322173ee42e3bed3498c3172aa5073686852f80
SHA2561c0db9180186139b1f325535d8f2608d52285b16b9928bca10ad27a91e87d585
SHA5128271e98dac2464fa50ca9c4b1ed92d1775b6b5bccf138cfaca9e3586bd70aceb9cf2957590be14df603ed16af443f590b58702388759629e3373498afdf3b141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541655963f2951fbc8d6462401b8eca2c
SHA104cae3a403664da0a8e45b455704fecbd50bf01b
SHA2562f43981192a4aa82094d44e8bb17b67a6743540fc50f813453ac5d8bfc88f1a4
SHA512b507ae0c4b8903ca71cbea9d57d94bbe3d75f5a91c326a6154698a94e2dde44e68edb56abb39de57e14e64c6832eaf9bfb4de6edeb227c86add137abf7d199aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517bb9664c293078182bbbe8103b349e2
SHA1aa8c495ef707b6065c157756afd8058b9211431b
SHA256963bb47f0245bfcb3b58a5af3b234d62fffd8b42559cc879463a3f6f975b563e
SHA5121e0dec2567743e014475117370f8e0d85b3a17b92a1798882fe3a149496b820c2108a03f7efb810a5eef31b079b2a55dd8a871e8375835cade5061f8d0ea8df3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59acb6f6259341807d3e063960f6740c1
SHA104fc8a2cfe15cff63df4056d11f90c0133d55d55
SHA256962de331e8c5940181fd5b8ff5be5535199e5b46e9248f9b3472dd84c92bc88a
SHA51280d2f1f87e52c4ec803d419f615f2bf9f5e43d0d2c09879b0a02ee34501e8b8bd3adcdc9d30ec112991a3444adbcdbdb50a8d729cbca1962fb15ce5ec9e8d9aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c45c6b1c92f3203d85a723b678265d9
SHA1cff5c42d6ebb60dc6d7546f14d3e13440fd663f5
SHA256795251a4282c55d9aa30f578f750ced5d6731fe0a3bab283d6ff51df5af9574d
SHA512960ca67d5fdeebf5eba7d1d36ee0481a48aabb4b110ff9b0e0ecf58238c958d0e4067706cab1d2af010186d3d663ec7fbb99a0b28369a1d5a3d20d6022c5533f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b74358abe5c5fcaca06471c7611a2bcf
SHA1695236f33d434b62771927fe027ff6807bf7c15c
SHA25611bfbd07466a02641330b63024a69e547726af9238dc340fc106a121f4fe5ac1
SHA512b66a6e1cfc5fe1c270ae146721e14697e02d94db81015c1f0f083276c320a05380ef9dbdce74dcb6b0237fc78b743646a19d690cbd83af8237485da4534393e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c392e2f97ae14ec8aa063d493a898a9a
SHA193b9aae946b708f2b4352200ba06279053341497
SHA25634fe3fd22d188bb1d7fba767ba1b6b2fd65f6b491d971ddcd3face21e4b47bcb
SHA512a978682c7b15a5cafa796f64ebaf235fab2a9fb72ebaf4d301d78a20c9e0a95a54f25ffcf9a8dad7b0dcd50031aeee4999aa09de35ffa7eef3b67dca542ddc58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57664d0f76d2a3e5a8c920ad5b2f1d516
SHA18c47e3368aaa4606db5769a26520dad7d2baa69f
SHA25640620a5d54c70ebf786d1e043ed6f568cef1b06b17f2f783689f1309ea814a83
SHA512aeb0392a4dc971991990aca2fb070df5553714713683f1b876e7bc0482ec3cf3552b4d01b2650638fb9df090039cfad1a0e8b73b68db3dc8f3d0c48259189c04
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b