Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 21:23
Static task
static1
Behavioral task
behavioral1
Sample
8f79c59e8c6cee79d8f00bb96e5ac1a6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8f79c59e8c6cee79d8f00bb96e5ac1a6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8f79c59e8c6cee79d8f00bb96e5ac1a6_JaffaCakes118.html
-
Size
958B
-
MD5
8f79c59e8c6cee79d8f00bb96e5ac1a6
-
SHA1
0329616e3c17d006b1ae81c53b24e402ea59cfac
-
SHA256
ff4a740f16bb2cb1094a84cbd5018c4ae87102c35abbb867bab6534f814ff3c8
-
SHA512
4b8e652292aa1636688a976c9935c963cabe23af7f1f7f127c92e65e6b9454621f10d51377f908a5c5928b8efdea1570e8daa5ca9962155e97a11b00448ff645
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65E55181-2126-11EF-A635-D2EFD46A7D0E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006f3c7a7cc886b040b34471e9bc34191400000000020000000000106600000001000020000000669357067724102f589f7e703c7fc5d336215e29694c9107e5bfbceff6ca940b000000000e80000000020000200000002cd9f847641e034baa33bcaf2b9aba5b05fa4e27500d76ac6875f56b6bbb77c79000000064fb7c2f2e932896b2b9c02a9c878dfdd2de5f87c6c8b4ec4ef06ad1187c6ec94f07f73d25b9e2793c82ae09bdecf98fbb9c499df90f5922f3b3c5d1cecb99be7a73c734dbe7c37b402e320415e73e8de8cc3eea130ae320957e91e98888750c2d30cd25f286aeabc302437ac0b126572b278c684aab554998bc0cc6fcbbb7dfd280526433126bb0a95eb55b86f0577e40000000a12adfb196ab4ae0db9e93e3495e31dd32b98b10388c263069bd34f568abd735ea8a8a189f6360c351dc013ed8bdab8c0b47100ab66296c8b9f4913e449f4d12 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423525295" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006f3c7a7cc886b040b34471e9bc34191400000000020000000000106600000001000020000000ff3fdcefb9ccec39a9e91e18549ee7de4bea953ab34b2b0fc28193a836a74160000000000e8000000002000020000000c5cbe04d506e61fd6179ab25166565153d6548e40cee368687dbfabc5894d6d42000000019ef05a31f5f0bce62673793013e4530f7d602783feaf756af006d74c112d5d8400000008665c0bd88c1acc38966bf6f5b77bc8bd60085d914e8a4a7e372a22f3aab35324993215f7b7239d4100cc5de3ab309014e65b40a7ff8d5fde6f84c903dda604b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c37b3a33b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2024 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2024 iexplore.exe 2024 iexplore.exe 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2180 2024 iexplore.exe 28 PID 2024 wrote to memory of 2180 2024 iexplore.exe 28 PID 2024 wrote to memory of 2180 2024 iexplore.exe 28 PID 2024 wrote to memory of 2180 2024 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8f79c59e8c6cee79d8f00bb96e5ac1a6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520d39458a4c7c3eadb9b8700415a17ac
SHA1944ac36da43aa68be3ac5dc1096aaba464c76fb9
SHA25622542c9c613a88154b8d976d8dc665507102223103f422071d575fadd7001837
SHA5126309f9b2571837ed024f79736cf102fa22dd1bff4d09e7cfb3019176d674b984b88d6ba47ff8616144cf5b64fa977fa8e6dfe3425920d779c91c57551901b598
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b05a44042ed3a61d0fc8be1f8f5e7103
SHA18ba4d4fbe643f2f3ba797fcdd36cdb0e0fbbf8c6
SHA2568d04486ef1ed401cfe205036c1d7ade2f95d844d6bdc2ddd0e31d174f955198c
SHA5127a4e078550762a9d5043e459b32b7a6b20b705b15262570a5faed4f5c256e6d34a1950652b24f74604f14af4a9cce496e620ee92c2b6f631edb7dbbf636b45aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59694acc57f086924706e78d9a0ab0e30
SHA1a7e8e82713e602ee3e5bd708ad13973ef444c1d0
SHA25600ed6be7c7e3cbfe097dffce0fa3692acb2c5ae1a4fc169b0b546f08083cb7a5
SHA512c920780fee86fc95b39f8655fea80136f1fa4f9d4ce199199465f1094ccc979083676c4c167cf5a625b8fdd34698bb2b2db9ac56e5781fdc352a79b3175fbdec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566de716985d83379ba4d90ab90deca88
SHA1f1b19c4fe42465eef7cb43df31460fa320f108f4
SHA25689dd57eb3bac1e71b3552bc5a2572f1293903c15403611eb741ffd8b7a6a5f58
SHA512ee4f42927d7da6d11b9d999e8dafc1fb6e8afd8bdffdb609bc654f697242f1485555c410c0f13a05aaff53645453417c938b05a0417dddde7a804f712b86d16d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544d9621ca4bcb71ff751cd2b9d51a94b
SHA16ba51046810cb25f50ccaf7d914df59c434c7659
SHA256340165009e6158b7709ce3745d026097cfd7e50500e8c9483ffe639cb4f77c51
SHA5126d5ded6db2817c4ecf93162219f766a96e1148f13d4413c3cbe28e9fd41f851147dd7e4cbe8eccb0d8fa94b0b58b605cf43880c7bad99b6abb3f25e5f82e7c3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5279585cf47849aa593953cb0fe361773
SHA173eb7b08415aaa26058ba326714b932a7f0f0c07
SHA256ac0325aeb0ca91ecf7c206c5323682cb3d4b0f92a6f8310387eb316774900ded
SHA512442153e50242abf9d2aec1e354e8bf78bc96b59a96800ab9562b206c49de5d65ed0a83e62d5ab3470063c27565593a461663d91e7c21f8bbe2571f6e8476b727
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bb2ddd3e3a0bc332df3488c4d85eb8f
SHA15c4b1076850af9a75eff460cb60d2b94921cf7ea
SHA256bc430e9dc4469370dbaaf8f0c9f0c3de9ae67ac4f1f6c3493574904cc693e984
SHA5125428dde01266759a78494195062bca4775a7cf90ee282a5b4a3a62de15bad9bd8f129e1e81b8debd0fcdb0d5013205861490c778ed24342b73a6373267ee8578
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502d84b6303ca4688c19c85e9935aff06
SHA1a782bea1621f8f024d168460b09c7c4031c09e07
SHA25666b6b7a204d3a95d034427bffb392efc984e88cbe909216d301eb4a222cd1e9c
SHA512e42b132258d1972fb04f020a6e71506a580b0ff94b3c619bed15f83571dbc3973a274afcd2ceb9a18a0e0c469c733231280c61e9c17904016b4b764a952b27e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc8fc93a0414d29dae1d5ba3f993305c
SHA1c0ab29894b442e23981129a621538568935525fe
SHA256e90938894c67b62ef0ef214a08bfbdeaf4197ce8adaaf6fea8732b3fa01d4cba
SHA5123eef61f283fc508d7d4a5b56005591e0e46a43c201d6614844f0ff7cb630180ad8028f926b564f3da643a0eda851b255b33c1f01666bf3c2cc12b8679ecdc539
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e15774dc864ee2174cf4886b192d9978
SHA16f3de0b28daa4bc0c5c70aa558ae5903d18e691b
SHA25646f06524b2b1bb542ba36cbe5d2483368ce3177c87e467865f6428d2cb2e3a9a
SHA5123311492c1fc490ba127cc9b71b393478270d2f787b24416ea9aa1c2966ebc38619c4494481ec459bc57839b51fcb918326aa6934798bca39eee63573e4964284
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af14cfcae300d52e128235735aa0b29a
SHA1028a82cdf87b13a786c7d5a8c879f824b44d7551
SHA256035365763eb9aa6f433f89b2730e3404cadc532ecafa0049692ba0907e27d5c3
SHA512d54a1fe33c66f87d91dd4acbf80d1afcab92729a8b58fd0028eb0717dd6dcdd86dffc03894e9bfcc801bbdd1aa9d02b96e1ab248360662e422f66bd126993a9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb90d55cee8d0096332357c836a7efe8
SHA11636a80a7440fdfd53204f133ec9a51405864f0d
SHA256aa48d1bd3ce92c475e3dcb9905eaa7351e74b75e207b03a84d3343f0e6968e90
SHA512b352bb2fc1c9f31e02d4d034d9719c41b350452fd1a2e91bf2d3b428c95412e990b5b6526a2349eec153f312827d521fc519acf323660f9866406aa4882ff54d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f82c789bb36bf1321faa82d724ae3e0d
SHA18bdba2d103a1bc9744084d6a6634a3c5f44040f5
SHA256d046dd61e607f407eed49d73569417f8c9d7e8c7bc509d74b98a705ce73a3596
SHA512eef8388bb0fbc7bd1feaa1c0032ad6fe84334f57196bfeef0ff4197a4e83386068bd27bf10541c45054a31cbf5a24b21c4039e74dc6a79cfceb9cc1265d9c859
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532f22fdd5acfe3723a3b77e84fce4709
SHA11e00f97f7c61b513f67f4d3eb6eaf7528203e07c
SHA2560a88528c8a0b8d9477038aa2eb88b8b6c5cbb414f0cbb95f63645df7030aa4ec
SHA512dbbc231d4a968e7d63365a16e3324e7d1efd558ed566746fe5b9a63f4bcb99df428bfa92afdc092e0ddfef7c5cc6a787a9d6a662956e7096ac76a2df417fa806
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55318cf0954176da5e26da7abdfc4ba43
SHA1feba3ec11c69240dc3a72821bb6e272365bf30b1
SHA256699caead8812c456e2c01196cff771911d80738252791ccf8ea57754ddf586fc
SHA51295200f91bd9378f89636d1a464ce1b2c745d013892b4cc5b41821b270e82bbe02c8e933a9ff8dca943aa965b7cc335077ea2b1624909326ff9809ab9ae95aef1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b8e618bf6f0e7840e021f126aa768ec
SHA1855efb30ef8157fec486b46d6d2c23b1843d7ea5
SHA256e8ac67f6da1ba6d932e7193fb30b5d6fa77bb2edcce6b1a5f2e8676962d84b3a
SHA5125ff614a09e69d8d9c0ed640d0e5081cffb5592e00ff3e5bf08515ae12aa35627e4dfed59445587ca9c0d8284205ebf98aeab18ba03cc5b1f952607fffdc6cfff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55742841f1a25fc2d28e1048731a9fad4
SHA1940ea0778541e9c2be67640ee77c3bd0f3ed44b5
SHA25660bf134b552462c2419a4f8e64d2716acd5953ce4222f61f56f8a9c94a4a94a9
SHA512cce0d51a5958e712d31070e0c5e7ec2ca1a11629508f2306e54b951df15296d55d7efadca2774a6e3e372c56b7df62861250291a6d80ca2bae91ec4d7256ecd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdd0a7177231924871aa45f3ed02fe19
SHA1cdc9187a71208d625c5a123790d2974a966e0120
SHA25687387f7f0cab9a8ee4599c6c89abc4c4e7647343f0b5916f8cb3695e16c12bd3
SHA5129acf1c3e867c8a3e0d42a6bfd34006e69d02900872e6f8c6867eeb4df16417fcebf9be1effda3b824528eed90d886f398c2d5cffc92b7518f84fdce418dfeec3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f27dd2376235f5d881f123f5739fe5b
SHA1287c8bc72c83ebb834f4315b42ac5555929d0195
SHA256de19efb534f287badb63aebd39f0651f305cf1c0a3d5baefa442fc14cafda0eb
SHA512cbad684c803a5b557c7a6553856fa31fde467b90f00e9bcf7d6de3ccfee87344ea5db130f1e321e9da72c1f09798147ef4c7778e82c8291170433aa0473bb52d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b