Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 00:35
Static task
static1
Behavioral task
behavioral1
Sample
a32baff61c0a456affd07d44347d3966_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a32baff61c0a456affd07d44347d3966_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a32baff61c0a456affd07d44347d3966_JaffaCakes118.html
-
Size
936B
-
MD5
a32baff61c0a456affd07d44347d3966
-
SHA1
5e521b7ec8104e1c965ed705b6e136c0446ec346
-
SHA256
6354bb6065a99ec9295d014a53dc8370f68b59035fabf6cf9d80ed134a1ed5ae
-
SHA512
f6aef6485a39ae4054eba5a9c4e57762ca6d7422e862dba5a4db73742fdce65c0a898f5bd0da918122ed072ae59d59276b54d557cda1e97726c451cfe11099b4
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000001c183ecace8e300bbd96dd31d97b956994a61712d29a17ec50f99738c3033b6c000000000e8000000002000020000000e73c5aff6aae59ab41327258b17ae12b2e09556f53c15e045a539f0d0663634d20000000ce6befeff9aecdc02af6e22558c128591d2c4d2a0faae82fe3640b2ca0b2c4324000000023d7480b5c88a4d2969ad44c3d5c10f4c169e5292e86b48d09fcc4cadb994b910882563fdd539430a046c042223e0dbb1390e8be46f8d35a038fb1791fab26b7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1079f49b29bdda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C76CA541-291C-11EF-AFF9-DA79F2D4D836} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424400773" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000084371d0c5f676abd9de14d9eef6fe5cee2cc04486411084c74fd874d1dccfb6f000000000e8000000002000020000000fe8c942fe2758d4be5c5624b2efd9a19ce63b1a024374484fd060f539a77f43a9000000028fe39a64c4a6e35221b28e37282b543c1b80f4255ba2856d54e74559ee24b9dec6db57e7647e09f09adc99c0be599042e08c4bf703b03f0a29dfc7b7443bb73ca0696bc16f0f391868f4ea0a06f2892c85c3bb0197310c3072fef76542eff66d2dc1febb33b0952b154685facbeba6645c3e395066880d8b40e6a6db8da9ac10a6731f8ad514742da6083b0e57ee8fa400000003e814f19de24165534027a91bc50070eebd695fa5d289a3894964c6bc0870582fbc4c837e400ab181f7086217e48ae4e60cf3f27650e380073e5c70b0042a539 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2020 iexplore.exe 2020 iexplore.exe 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2600 2020 iexplore.exe 28 PID 2020 wrote to memory of 2600 2020 iexplore.exe 28 PID 2020 wrote to memory of 2600 2020 iexplore.exe 28 PID 2020 wrote to memory of 2600 2020 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a32baff61c0a456affd07d44347d3966_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cdb4847ec88f3e5922005efd938d0b97
SHA157ae8e1f86f426f79ad94d63ab7846df5b9dc7c1
SHA256b4e04ada855c347e2618fff829892cacfc30a87c30efc630b4fab28af5e2fa95
SHA5129d4b40c8b7f42f33e5e6a48b90d72f0ab26e6a02d3157601fcd90edc126708a9f7b3ffa06d820ca09a4f43d360c389a7ccc172b14f97696475c094699ee1743c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb7b7d71866c45af6e32de7e1463c66b
SHA12c26da7223427207c0f00e00a3106245117cfbaa
SHA2563ef54a4bbfc58f822da848169f41eaa586378587cb7806ec6b21446150dc262e
SHA512bad34e20af555258cd3ede8feb0a81c2b17589d1a9db0fcc5397639b0e98a4d763411e04423f94882e21dd65c6455a051a5bb8b4b2c89405e4f171df3fd144f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac6482a514faf62344c27502ba4cc21c
SHA161ef394337e657ec9408f8a5a08bc327aae9781a
SHA256754ea3b7acd658f703edc73243bb0e32862a3244b45e0289b345fa6de7506b76
SHA5126c2b08b31cd57edad5eadba1d42f6808c303c2aa6effa849d19bb58fb87a1ea1af29dd693c2f8523c3816b96a77fa53fa699961efe60d32462726cac72045a91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5717009e7fadfa4a8fb91f6e826a713d8
SHA13e2dab600cb1ab8eaad2eb3f291695e2df2160d2
SHA256249a4be2917cf77321a879dd1e040905dc5975d6086410b3e54f0562ac2323e5
SHA51283459d18d302a651e3f8bac4158745a50fcc39062eb89b4df5e3338709352192f463a2d948615fa97c8c70f9131c8a2142f72d0ce5032d9ce970eee4e0df1de3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5c2fdf9a6a093c64899e942933913ac
SHA14c9fad4d558d751f2de6febbcefc86728a04a2bf
SHA25698a5e6c75f3374ef9810f4654a2152756b138742a71997a799f009dfd116467b
SHA51210864bf8b8eebac180e311d15d8088da4473f66cf7437bf2ef80dbdb4f782a2782db9e65a39a81f770b2f2db34806a27f3b58127b13675f6fac96bcb75ba3aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abb24822f1b4b0f41cb502eebc929e85
SHA131e4859ba98444b8efb8545c739c5b57836fdc25
SHA2563c8ec78ee4ca67d63afee9868387b8d9dca76ad9b0b2e2684e82049f887000ee
SHA512d05475c6a8f60867bfda77df6ef16dd5ad5b93da7661e75d7c605b5d00d591502c628a2102abb4f8df6e14f1848f1ee7e8a41000155d027d264bb3efea0303e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519b63da781786e614a65720322a44579
SHA135f466913257ac0aec79adc7f5086c9b96b1f5cb
SHA25646add695d0eec8fee3203a46383bf1c3ef55ab6ebe7b5989a5543d22103e1681
SHA512ba8f89a794c00ba5dcccb3b3c03a519f3973f960d4164eb688c361e3cd0f7259d61f9f77776f6a70bc6836be5adb589cca6c4f7084e71f739bd96dd2d0b606c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7d1a62d73caa9432a5dcc1db7780a53
SHA1b01bb04b3bbef0c346eb0630e8ec2344504eb5b3
SHA2569c7c353102d1f6235337a4f1f0df3912e10e3e2e5c4c95e18e0d50b9468e30df
SHA5129b4e0cc9fc5442cf43a0b36bde893fe367f17995f0a02bc0813dd546657b1de603ca6e5452b791c7fd6af8cd9c86f16fa3dce952dba2051bc4059a88ccdd3895
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555be319a2529b2a287ab8cba401b659c
SHA184a2f24b156458850abee08e2c29a0f6d527d30b
SHA256c4c3b9d73420c6fd17860ddb88b496bb80d001c83912787acf13aa7ac2029ce9
SHA5122b414d504d9cff138ed6f13c793c757b4959f2a6d4edc628cdceac0e632a30c55842a6820826e73d3c14fb374458cf057d93d83a00379b269387a165bbf7ef16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3ad4e5c2f962a1cf7f21f17eb2872dd
SHA108c6f22a60dc954b53113038ec0b0f7ae0982d4b
SHA2564c4023ce40c25ce024f4d92c6370330f6ffc6ae452784061d0317f185c666965
SHA512a996b6354942ba3f47e28e1d28139d251663e709e6343aa4adab7d6290e27a58ae6358393568f2c54306aaa9919e9db0ac4e584aeb7d77592194ae3a0e99f148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521370e1d5298ea66cd6ecf0a18e6fde2
SHA1a97bff685c316c9caac578860a6b8fbf78ab8c20
SHA2568f10f46b66e064e5d08981bb6f4706245acc9edc104eaccc03219baa38287593
SHA5120ca918ba8a78d996ae9bc5c1f122240c7a31211ef63402fa6847d0b302dc347ffc19c779a0de205f5727e7d6d9375c5cbf50e4e447ffbe27823cbbcc8739a03a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ec2f2e480a590882fe37b7683a07ec9
SHA1599dd5edb52aad43412676c00e244a2b60f5df63
SHA2569addab7596f320be9ebf4eed68a4dfad6e9636a5b67269a4d1416e4f94022a03
SHA512457b084a75c5b41b35726788511059867807d2c6bc79972eac4cc444e3e2d31e846dfa623b08ffd5765a70aba6fa79df58d7140389e2ab7e6456eefc317275a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e33f5fa8e5e774a25ee4cc572e29951
SHA1a19e35b8147200805ac512eecc1609cd74b95885
SHA256e4ae2adff11a0611c3ed74c2e3695febe56b1359f6891903d39b545ff0a88fc2
SHA512d7a2622b1134c44d11c3b64923f8de5b740ac002cb6639d22fd3ebf2f99d011f70f1f9293a8f3a3c033651a2f8e9ee26b42b8f1a07337860c2837d2abbce24ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5ac48867e07d6111302dae8d4c4d4de
SHA1d8d2027e8bebf34cd712ffae7a7c37df5d967006
SHA25681367fe214dcf15940e41c35532ec7777e18a06f9ac2650d11fb7e46fc88efdb
SHA512d0d13639837809503643bfd4e180be2f76f6e29594d75e93f9283a5b23d81a507a1702c09072571b2d4130a7e4282fa3fea8d02bd1e8224bd87a11c40fedf7b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59af1037fe560077752eaf5bf8ae903ae
SHA1023f400cc3854796cb5ba538ff745d9e858efc43
SHA25694b6e76d4b36b33be7d126f2bfdc71d8a082048c957d784142513fd80bd728db
SHA512dc70d24884356369bd557b81dbe5fdd325010d5f783a301d8c06d6f6b8a56d4f5c6cd85a2e8504a51b391d107468d5996ea20151a1bba981f2a456bd327625d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556d1bd75ca2e3ef4fb603129ed942917
SHA16dc164dd333891f8ec37727af3587fea53898f03
SHA256ebb70e4634342e8ed8a643a92963aa62918dbdac24e50ad2049207d653860248
SHA5121b854017d153c50435fb5a2d1ca0d47f971f82271172eaf0ee22719e4de72a7304ecc108aa5359efb17e1bde8286a1ed1bb77815e58ba6c745aa5e818066ccfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581481668aa54c43dc985f33c8d255b9b
SHA13065197cd6fdbcd48562d4501741086bcf07b9e0
SHA256efb10b66d114579b3c4cd3d6884058d232128b31bc549529dfab891bf59dce82
SHA5121fa5f6d266473bc5050a218fb59b9e761efbd9cca57ea5f7f54c68162ed96aef610a3407ec3de6602f5c50334cbcb1de95339e8ac8ad2a96ac78c4d793b35631
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f860e2b5f803e34f9accb7cd70f6791
SHA14164573bd653ece9dfd859121693ca799413293f
SHA256a44ca2ba0f92a629e6579188ca1ec2018f26cc3a0cb426734a09ea9045693be6
SHA5124855c771fac8f493e788066d7c8c5e5a34eb0977f77a12045e1ea5987d6a5a2bdecd8d9997de693bbdfc6f7d3ecce7de04c65652d32e300d51b421c46e495d38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546d34fa3fb0f6bf1ca9b260a25e3b3b7
SHA1e559e55ec6db46da8ff044774102e153c15780fe
SHA2568c85bafddf6a94eda664e4c49b2a99df14e4551ef3bcf1ee14acad3a2a486483
SHA512a804750bad13421eb4109e0bf7518501b97c9ff43385747636f85d4adcc5ca484e3e7c622548c2721ef13e5774597b5da51c0a79306097611d3951bd084e681f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d477c27f4424041793905e74a7a11abd
SHA1c66e8cf7f91e1e67509698e7c23f0d7c1aa44f85
SHA2565c85923115f1e06f67899e3ad20d54ac2c79ccfde0ab5ae2f7aed4961b93e988
SHA51263cc76f0a5fc62e2a159c9b9766a4351de3e3467c82882fb962b9555fe8204ef18bdf032db0259d855acf1c88e375fcb54a028bc205bc14c24e6b1d3097dc585
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b