Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 09:18
Behavioral task
behavioral1
Sample
07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe
-
Size
161KB
-
MD5
07a892f110c29cd4e42cfc9a95dd84f3
-
SHA1
6560bca43717a367c7488442d23208fd02c1439d
-
SHA256
f69bb8df437fde3ad1418a68618a07e35b1fbdc5b37f04326c7e0c307ffa6db8
-
SHA512
00f7fe654c5a7f34ba1937d00c77916a106b67375db3e5a8da86e0be2c77e8221859c355d3994961ec5a74268eb94e3b3943a1e42e306d16c47cfe8028d16e7a
-
SSDEEP
1536:9ugPyptzfguPH0UqxH0a2Fnk4dYlHVIVzNIFbfs4TQT7TiO8Jxq5dmrhNv8n3ioY:9ugPyPvqWknWkbs4y7TifAArbC3ioOCU
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 876 regsvr32.exe -
resource yara_rule behavioral2/memory/4388-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-20-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DED2B61B-1A26-4566-BF2F-DE539D4468DD} regsvr32.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ifsndu.dll 07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe File created C:\Windows\SysWOW64\p.ico 07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe File created C:\Windows\SysWOW64\c.ico 07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe File created C:\Windows\SysWOW64\m.ico 07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe File created C:\Windows\SysWOW64\s.ico 07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{10026069-7A5F-4531-811E-C8DF20643BEE} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{10026069-7A5F-4531-811E-C8DF20643BEE}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{10026069-7A5F-4531-811E-C8DF20643BEE}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dostal\CLSID\ = "{DED2B61B-1A26-4566-BF2F-DE539D4468DD}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED2B61B-1A26-4566-BF2F-DE539D4468DD}\InprocServer32\ = "C:\\Windows\\SysWow64\\ifsndu.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lalama.Bho\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED2B61B-1A26-4566-BF2F-DE539D4468DD}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{10026069-7A5F-4531-811E-C8DF20643BEE}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD}\TypeLib\ = "{10026069-7A5F-4531-811E-C8DF20643BEE}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lalama.Bho\CLSID\ = "{DED2B61B-1A26-4566-BF2F-DE539D4468DD}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED2B61B-1A26-4566-BF2F-DE539D4468DD}\VersionIndependentProgID\ = "lalama.Bho" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD}\ = "IBho" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{10026069-7A5F-4531-811E-C8DF20643BEE}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\ifsndu.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{10026069-7A5F-4531-811E-C8DF20643BEE}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F}\ = "_IBhoEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD}\ = "IBho" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lalama.Bho regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED2B61B-1A26-4566-BF2F-DE539D4468DD}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{10026069-7A5F-4531-811E-C8DF20643BEE}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED2B61B-1A26-4566-BF2F-DE539D4468DD}\ProgID\ = "Dostal" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED2B61B-1A26-4566-BF2F-DE539D4468DD}\TypeLib\ = "{10026069-7A5F-4531-811E-C8DF20643BEE}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{10026069-7A5F-4531-811E-C8DF20643BEE}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F}\ = "_IBhoEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F}\TypeLib\ = "{10026069-7A5F-4531-811E-C8DF20643BEE}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dostal regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lalama.Bho\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lalama.Bho\CurVer\ = "Dostal" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dostal\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lalama.Bho\ = "Lamsa" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED2B61B-1A26-4566-BF2F-DE539D4468DD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F}\TypeLib\ = "{10026069-7A5F-4531-811E-C8DF20643BEE}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED2B61B-1A26-4566-BF2F-DE539D4468DD}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED2B61B-1A26-4566-BF2F-DE539D4468DD}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{10026069-7A5F-4531-811E-C8DF20643BEE}\1.0\ = "Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD}\TypeLib\ = "{10026069-7A5F-4531-811E-C8DF20643BEE}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{10026069-7A5F-4531-811E-C8DF20643BEE}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED2B61B-1A26-4566-BF2F-DE539D4468DD}\ = "Lamsa" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED2B61B-1A26-4566-BF2F-DE539D4468DD}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED2B61B-1A26-4566-BF2F-DE539D4468DD}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{829BA8A2-4515-4D62-9A4B-B89D4B55094F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dostal\ = "Lamsa" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{150119AA-A801-4DDF-BE5C-14CAF721A9FD}\ProxyStubClsid32 regsvr32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4388 wrote to memory of 876 4388 07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe 90 PID 4388 wrote to memory of 876 4388 07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe 90 PID 4388 wrote to memory of 876 4388 07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe 90 PID 4388 wrote to memory of 412 4388 07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe 91 PID 4388 wrote to memory of 412 4388 07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07a892f110c29cd4e42cfc9a95dd84f3_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\ifsndu.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://megauplinkbindinstaller.com/bind2.php?id=2⤵PID:412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4540,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:11⤵PID:916
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4800,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11⤵PID:396
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5276,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:11⤵PID:2272
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5328,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:81⤵PID:828
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5344,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:81⤵PID:4748
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5576,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:11⤵PID:2724
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6032,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:11⤵PID:2020
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=4728,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:11⤵PID:4380
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=5460,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:11⤵PID:1852
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=6328,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:11⤵PID:5000
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=6320,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:81⤵PID:2468
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=5220,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:11⤵PID:2588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD596666686b1aa4f9c66379b7ee0464001
SHA16491eab90ac6063c8fa40d41b8288e4f98b02661
SHA256800b635ef838e57d58f54f5b3cc16954accd861a694d1042f7e2c60a4bc6d91e
SHA5120b2c8c228658d9da1fc17f1b02ab4981219ef3761d9a514f420c2b97e91a66aaa90a90fc2dd5ef8a6c924d390a0ee397e36d98c17645b1edb3fb4b6ccbea7cbb