Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 03:36
Static task
static1
Behavioral task
behavioral1
Sample
acc1bbcfe61e7d264022a9a3cf19bef8_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
acc1bbcfe61e7d264022a9a3cf19bef8_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
acc1bbcfe61e7d264022a9a3cf19bef8_JaffaCakes118.html
-
Size
1KB
-
MD5
acc1bbcfe61e7d264022a9a3cf19bef8
-
SHA1
26b583a1b82fa009b290cef8d7eb12e83cac9838
-
SHA256
3aeee9edb96cbc6d5f833d9d3fd92fe0be20156712b5efb39461a9feae711986
-
SHA512
14ec13e8e56d588a723cd443a371fc8ffe25237d24e699ab9fe1990bb1b425063739e6b2afa96ec8a4628ad0b65e8224175b6dd15ba6c9dcc00125b60502cbf1
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{769598E1-2AC8-11EF-8132-FE0070C7CB2B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3046194bd5beda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424584462" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000a6e9596c303bbe2f58a26386a5253e77580c6ebbc15e788a8d6e60f42a0dad5e000000000e8000000002000020000000f4a89768fdb8ba72323c65d46d99cb5e9cc5c17e2159897cf81de006f8c3e05a90000000445b8ec06eb5d907d2133a489633b80a4778ce00426acb46917669354a8317223afa9ad9dd010509e42bf4e66872c54c69d837d10276fc67f735505044216741b49cc695c231ec031c16fbe8dad4a21f6c81ec730b284c2ebab9981837bdaf744507bc83a693df3d877e70963154fe0994f3e29740c2735f3289f82426a293239d08a9ccf7c5647029b32cbcb05fbb494000000094b355123fb5ce566314bc1ed2be3f7cafe75753856bd514131260c9b7b74b04769670555a709b4d0c9441a47ef252b549b623352e115000a6297a049ac18b50 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000df979df39395f4d58df9042cd58db08228e6785b3d463d3d1ac8df24b69c80ab000000000e8000000002000020000000635dda6ca25bc819c9c55e5489692a495ad0f83c0f720812540d86f422265d3120000000bef15bfc0963a1e43e8aca65e20328da834b53ec01c2ba112effceca74e3d98f400000003ea740ea68b34d88822bd156c2bd18e9dc0976842f47eec85e04046cbb0a7e0c1d47b5ccb542f564620a3b82f1793d0f9ea25a7fcc0f6f7818c89f1c929b2107 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1760 iexplore.exe 1760 iexplore.exe 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1968 1760 iexplore.exe 28 PID 1760 wrote to memory of 1968 1760 iexplore.exe 28 PID 1760 wrote to memory of 1968 1760 iexplore.exe 28 PID 1760 wrote to memory of 1968 1760 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\acc1bbcfe61e7d264022a9a3cf19bef8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595eb9f6fa127f8367c99b3cb553c8917
SHA1f91ecb798aca141ba4df359cf18bf3b478ce9bba
SHA2566f49308429205bd54cf8e0c98e3cc7e29665192318a363c057ae037d0d51923b
SHA5122c7f954bebf2c193fb3b6aeefffdc9200a70409d2daa36272a243240f20029f15a2769c731de1addd6363abd28bf7d17764a3f510e20531cf02f694b8acf61b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f3e08007727a05a28219f8838622a1d
SHA1bc6d93209dbdd2003b12c57a96d1e90741e8b4c5
SHA256e1efd19131df906bf3463f7bd19ac8747ceba5ec71d6e122bd73f25b254ad87a
SHA5128f5478035a02127fd6426acefa353cae9f862397d12c820c33e6dd9e72321fadd36c30cced16f779663592c54311fddf8530b8fb4273b40c293c95a3110e9dca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5201e8286f759e11ebe692bf10760d9c8
SHA188476a266f20c1dd1874a7a611b7ef8d4cc4c117
SHA256c7b253ad64694c1fc8097bfd0d6b5e2704877b4cf713ac9f4132b6931967a744
SHA5121f5d43492fb9dc95741aeb42de2d514653a7248c73b1bbd4f01088712a85c2e47389c77b646771d75272b3e21b25b047d96f57ae05f90d725889737f7dbec931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cec1aaa489ff297114009a03735bfd5
SHA1d7f6530c67d05d31ead5a92cad0bbb6008fd9bb0
SHA2568e2c4f5d247cccb8304fcc0e585dc3d31a2baa339465614b8cb882188af5f1ad
SHA512cae6f1b6d5eacffc048f2570ca4e53ee5e6fda298a8d765c8c77e5afd86c74790218bce2d08111c4e99b3df3376e589e4faffbe0d9c9c3444a1858e9ae7cc0d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ba3345adccf4ab2f39ae1082b50ac5f
SHA1d4c7d04c4a581ade120c4ce9cd959e7697b05712
SHA256720ef40e00da2c5b769958a678a343b6b26b804da6ae7b29305693fb9d819429
SHA512d5d22d01804f7e83b3144a381f0e5cfb5296a3c0eaca4a215b94a7439c94531c6e9f121d1c21f942e2cffaf71061d45c712a04be9b1ff047deda9334b5bc133f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a37feb1358e646c54c69e0158320090
SHA14811f51e5927599ef4b9d1b20b9e6d43e8c02c60
SHA25676311b04103675e60daeced8fca61086473bd1e55d71195abe21ff6f8acb2ca9
SHA512f600a05aa6d765d38687157bcb699090cf863edb7e1b826838150859feaba6d1ab7242a8b59c04a8ed7475fc69995f73fb0566a7f811eadb9bb6249ddc1b3a0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebb62ef4b54681f4febc2c2b6596e81b
SHA1280542b7de238ef7cfa6d50203fb7aac41cfd598
SHA25623ec67193b61211ae08d94f754548c49928e5a868089ea0d92ef8f5eff4d1371
SHA512f58b6fb64301cef3d3bb16b2c5d5efdfffe0b075923c59a316f3147458fa055468cde66f58dbe3cd66c36e7c21029539993058ddb6a4b8fc2c8ac1e710aeb80f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a23934f049ce1cf35e6de17d4692983
SHA14c3e0df661790d803544328a1853f70c1b2afa2c
SHA256d43d5b287b77f7ee5dd7e5d6f329317a7ce44a0f928cd8a3c10e2bc804b6fbcc
SHA512ed7be658af02c24cc611eacdbd1cfb1e34aeaff8fec1128519c2d7363e87fed6179358291b2eaeb896cb045a8ed9afb37ee800d8e3679fab76205d661c990bc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516bab8336050198fb2030021e37086a3
SHA1e53361c5c38c41c42db512a21a320f266285beb1
SHA2564bd1c9a48dedef6429ca740ccc0f8ff95c4f5428a6408e152a0f354ec80d50ec
SHA512f845956d839b7674d52b9efa7da57a4a1c6dde5a596e733b1e43d3d118c17d92167b633e02ff5e3d3219466dccdce7f39d8d21a955df8b5ad8cc7c2c38b6a32f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522530fd56f40a6b075f8959aaacab6e9
SHA1bd63bd3a397ca3caa18060603304af8849f8a531
SHA256afb812f35bd36e3a1c72ae81d58d413dc0d4f89eb425f6e0df28056df566462d
SHA5128391a206bdf3d8eed8c7afa453df625309a623445d9c867e0edfabc1caa1d52a9beeb4568e39e28d996099f67d3f8a7cb9e9e74a22e89ac8bfa83e14b6b33c83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e82f20ae0ae982d9d8cdf28ef277449a
SHA1bb39a816aa7bc83fe080e783bff7a7627f2ee1ae
SHA256188e0921390ada0f0dec12b3f43502697d469871d3c37ee8b3fd72831125a529
SHA5125c7acf36ff31269e3ddb16c1690d0ab491818c42a747355344e36f85b547c3f15a838581172c88fb7c386d11ae28d0175248aa98d055cef30c13eb926fb3154a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f572141f1b8b1acc575b220e578ab13
SHA11425fcf995a9a8ceb6fa1a9d7880b790480f984b
SHA2560de559a711ef28bf06e9b56752f26cb85b762f31614a62a293e85376f436e2f7
SHA51213b88862c21adb47f6aa4d9ef7e187094d1223d49e6aeb44b3f2d2f812e53276cb824adcfb6be93e407f11472d94b4bef2205b8b7a887c7f73eca781e6f47961
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d3bb16e0d5427e29ea06e89fea2d61c
SHA1f99f741bb15356d1dcb0306437545b83a4d67ceb
SHA256a0ebd70a31cb5dcba76b6876a0b26833a5b5336854f626edb0e980d4d73b2e1d
SHA5120e24ab4fbad084bda7e3e5cf4551d6318011fee4401d9fb1775bee5701d2caf99c81de81345e4f3b70c3c88237204f43124dcf140d8cedec456acb6303f93fee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2bb094dafd6626a27b4f056dbe789ea
SHA1ac66d533cc704c9bd280f9fce05c1bf861a3ce85
SHA2560d36b775ef8c2c6bc0f90a4f81c79bc3b62ad6ca1ce2a2f74673ef44168788bc
SHA5127e107145529bb26a0e27bd73ed2bbaeec78fef125e0908c6b0156fa0d50d34961528c3bc67f8d1dcc923e74eb0f9c5d84b9284d8363f2b0f36c1c1658e990f41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5411d92f541ff65a70cb0b568e4d64d1a
SHA1ce68fac8a1bacfc6566bd0e50541f04dd51ae7c1
SHA2568ef84a0656b2db6ce222ae4bf3472528a90a6da777089244f2bae1f44ad3f8f8
SHA51295753d2bb365bc340c5eb9ca4de1a5cf7f65d4d93710b0bc7da8ef087e9a4632a270a6ce69d178187fbfaad08104bd3a5f940946e2266849ff8a287c6670e629
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5132d085dc61dab22b3b48ad7c6ecf7d5
SHA1e26852f61f6a22d23cf97c7601ee3f558affe95e
SHA256bbf235f9e66d82c028c1a80c6266e00d4d449ebef6a4ca59d0eba587c8e0b8c3
SHA5120f2d442e97b3d02048c3c6cc26200f72a18e07ff76210c18b6a6c67094368719318d6ac4c7b032f9ee47865df7da88d7ceac6c4c08be590fc8f93cb203dc6054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5037a0f73ed47dfc28a549391d3c8b49c
SHA170ab2b1096708377235212349fd59b4498cf38f8
SHA256286bdeb68bf3c1e2168ec28ede13a32920ca2ba504c39f0864da869c0f05674a
SHA51241e46c60bda0ca6b067c5f50c7e9c2b5518fa4379862550d9eec7b09817e5e46b42710738640f4e24485e2cdbf892029bd1393ab297f403c90bc1f6f5b877327
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8e0384fcf006fdddf071493463d1dd2
SHA10137b54f51fb3249605045e68e7cc27e9ba8c062
SHA256a33e9522005143abf5de13819121be0b4a7a6d401e303dc3fc58f3594facb308
SHA512799b8ab9dbc0aeeb744def9f4a0eb59b4f9a4ca8cb14f9cadf23ff3a10322d5200cd3711dac69d85f96421aac57841c74e28ff15f9921f295344e4e86e80ac33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5416e9583d5723af09d4257fe54385e8b
SHA138663f4cf4ca4b95de83280d3f8f17d783b64d80
SHA256d70a298c92ea5527d3a00d2ff3de4858e3a7715ee06cd05fa63d350246ba0e05
SHA512209cc6dfb26aab5cac8ac01d3f926108c3c24f399b71cb2663065b75b1256065d25aa5d474e512cb5c8fd8a0f780ad907660f76c5812a605a747e9299c833890
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b