Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
09f651f518547d4f6a26970fe0aa2b62_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
09f651f518547d4f6a26970fe0aa2b62_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
09f651f518547d4f6a26970fe0aa2b62_JaffaCakes118.html
-
Size
39KB
-
MD5
09f651f518547d4f6a26970fe0aa2b62
-
SHA1
8c5acbb28516e62c2f086be8bcb772c8fb5556e4
-
SHA256
c85e8598c711e2212aeb91f1224b132d2005e692fabcdf13904c7cc3e5c7df7c
-
SHA512
ac6bdc15acf88f275445c5458149be83e4fa271fd861dac59b85bff18bedbc084c263384292241c15ebe73c90f407df2bcbc1234e2da99943588b40b56dfddb8
-
SSDEEP
768:x2qBtLUCvp98kin7ANPBi8qre0zBxHt5IA91GTfZF7KmPkV2X5J1tWMtLtItutIs:x2qBtLUCvp98TANPBi/e0zBxHt5IA91q
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000c10d783e1be3e976616d0f19d9554d7704102233653dd89b6a506eefbe08ace2000000000e8000000002000020000000a73cea1c58a41f48a241b0333d3b7b7a5428654306dabf84950beac68a18dd7b2000000068ba29cec539e241687299bba348702e6606584ae3f0a921065daf8ad571a86a4000000043ecc2d5fc3ae06efe899ef02c9d83e0d00ce794683b3ecbb30fc8ac19cbe91afbd37d11d405cb1db8c39d5692587da2e33d32c3439e7eed315cbb5cde94a928 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000074c398758d623316eb5bca3798ac62af3e43ed5728bcd3f9850e0f3a151f3816000000000e80000000020000200000002d95aa9d8fb682c9e329f136c90d2f1c99900b16165d4d9b43f8ba755da149ec90000000e21927667cd4952ee04f2d011cb95305271593395ea4ed821907ceb925e224eee632225ae584deff147aa72e0e570b31ec7180c6293626c5a82de93f37bb88ab000c1a6ebd3b3c0b00d388dbe25d2697e7556ce2132afa14c596971562e648282f98c62d3e0f62a97b3fe76897b6dbdf60c310d5e93ebcd89c0e3431413466961d3749ff4c622c9b9d5166489ba6695f40000000c2c736236b7102ee4554874e6ac3ba5b755f8bd17c4f9761324c65e62b382a56ff916b85aac571c9f0c87f4d25167a6a1cd6ab02e9221f1025d513bb7e5f4a07 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425413430" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E0303A1-3252-11EF-964E-D2952450F783} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05b89635fc6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2056 2236 iexplore.exe 28 PID 2236 wrote to memory of 2056 2236 iexplore.exe 28 PID 2236 wrote to memory of 2056 2236 iexplore.exe 28 PID 2236 wrote to memory of 2056 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09f651f518547d4f6a26970fe0aa2b62_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585b4701dc42d45b265c9ce64b607b466
SHA1a9dc04e8e3d0935a4c980542fd8ccbd35e9776d4
SHA256bdad87b583a4612410ecfde243e2e12ef34e0bf53dccc28cc9d60352ee775b8e
SHA5123e47aa7ad55d2c639d1ffcb118f5540658c3dd39d371da1f0ecff1926e1264b217cfccb3391d35d0692a29ebc4eb96f8ebe48fa32805b21aac91360bfa6d8730
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503ea1c5b4f95846f63e93fcc9de9167d
SHA1714c4721b4a1f5bd06c088158593499d661ee013
SHA25668429f7725ea0d443ea632527c39015b948ae3a5ef45704dcf1041b8927d4191
SHA512427fec6f4f8a60a1af33e68fbaab94bc2390cd36456095d8bcdba05836be736e602c71f018f3fcb6abff9f9c6bcae4be9663b28e124b7c5b9c43267f39a82aaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf4f34e2e478307754a5434b73b9d03c
SHA107a1c1d1cc56ef813b2d2f648f2e48d821180a4f
SHA256bdb136574217099137fc34ddd2c52e99409e5367a04061bf5c3a19e76f5fb181
SHA512c33453bd9dcc98438862d13674227c332a3caea3160f7187b49ed304b150ac0757b18276f2f6fb679469cdd45bf480fc5acde7c744a436bbd1b875cd91dcc4da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580637dceef6597312835ce9d86955f97
SHA1ac18d63df25e80b5fc72e20802d6c2429931ec2b
SHA25638eb7ab016303a85a6ac42fc1ce1183b23476ad3b4a164b0e846aec3acb787d7
SHA512503c71065a64cf73dabe2b592b9549b4e9db5eb06eea7b9affde888eb10103ce0da6f82082060414349f26c64d87f974c71c447f3eb3ebc34b9e2490ba45ef9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525e088f4dc45cf664cce9678795439a3
SHA1965eb3465b98883386367e63fa08d84281e13ec6
SHA25666740aa3f4ca9ec7d1f286f3a0e5ad4431d024e22738ff1921f0a47538dea46e
SHA5128395f16d0973a8f1b63b0d1bd47ad9a60b140ab827ec67f4664d68a21208c7e702657737e7b4415dc097fbfffe9ee06935655e3bf8eb9e60952760fd00840bbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6a53ba6aebf73c315bd3838274144cb
SHA1c320d1843107886d216d63cd0211a49343824a4d
SHA256f3093dc395405e6021b51fd994062439bf0b83c236659272b818576b9998311f
SHA5126bdaf94d2801cbaa74d524cd97e100e0270a82ddc1e9b2ed7e59010f03e0e380a57fad43e010bebacf091dc04fe59c1951323a0b8d9606c90d49361cea070d81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518b466aadb0d8e2a065616a0f99d9366
SHA1ba175b38173258612a1cad6b99675e2c8d1e2f71
SHA2564dde5faca26ff35e3dcb6e4f72444dd547bd7523c7d7eec94822516f6f75c0b9
SHA512c67193a9b52190488479a3602bed9d96ce60673835af0356786cc9ac4856295b7079e482e452fab5b6cd00a6e38da1b69c32dee81872fa7fb37fc063fc51fe6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd4c3529ee4722baf6c88e823ed29fa4
SHA1a6d494a3e680174a9a49a43f4ce2664ec6fb95fe
SHA256023bd7f9826300d65cf59251496cecbb4655becb9692831f7042c1b1729898c8
SHA512084d8a0be7847c4105a761a6623579f45964780aa14c3a149a00c2a8312edbb0447bb86606470ae5fb19f129f7ecb37460735f91915519a0d5d5ce14fb19a1d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de59068266c6eb103e76c69d54bb8af8
SHA11462fd8826a627086caa2658a54b30f2104f71bb
SHA256229beb804da2ffc95b78c1d47f9248b695f9482719c24fa5acaa2f5e52d6b01d
SHA5122c4d239cf96806b11d0dfc2e77fdaa2b97b47e698f4cc2174e9b0b696a1b531f2a4bb8631629989010cc1e2fc2823434c3fddaa3947ee05a1c8840eb88feb71b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a98eb724cfaa3303a69986ed2a11052f
SHA1ce05a31eafc85700bc6b470a560437323083a1bd
SHA256a384e4b4504152f3ff5d10cda2bb3038fd17071361f6750ac83fb3edbcf435d3
SHA5125cd845614ec8bd5a07d448ced5f3abac37d97a062b0127f64da2c630b5cad2413815590b08d1fec0289d0877320d4f627e43af10de40b4ede427abb384974246
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583df8a630244517ba19d826d2a41898b
SHA182b90150f3f6bea3db79afc1c5a228315a5b841a
SHA2562a619a8ddb475805c837423cc5060dce257f6e7936a332695359b9be0b08f35e
SHA5129d9f90ed0d99c754cf0acdb4019699fea73074218d861a7d8ddb79f901cbc3962c1188fdbcd25ce42a9f3db84c7930f795f06eb903f1fd04eb3738eb367437cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5957deaadd6c80fde63a9c99405c30d45
SHA14631486c897b777d316f8c9bf20009d6b2a87440
SHA2564f5fad98adc6eabfd2cb3d7b81655245014b36e4b027a27feb79c34616b0d68f
SHA512e6ec073dbbbf68804854f634321ec26ef9b011431a6431085e43b2e2617aad1fd91d0e2fcac0d6af397aefd3e2b1044c4bacd157d6fc44097cfa7269bcd50cf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5811f2f91dad6a9346aad8b8bd6f5b4
SHA1f4c30fcb6a45c640500117cbca7115667ea6885e
SHA25652670ad489d29c7a12b60516ccbc083caf86e46a4d716022439d8948a52c474b
SHA51277415749db469908745769d37c74595a052757b4617ce11f45a6206bbf6e8f920b9cba0e0192bc5476ffafcca6e53ef8ec76badcc6e7161a5bd0b57083106d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53528576d59c0588c14e4f74ce4a76116
SHA14ac30a8da1d67f89752069863a4dd8a6bc2c04d4
SHA256cc3fbf0fc7f71063b067b06d2cb792f7a039df65ab7dc5b367873f8a7844e870
SHA5123e4fd9139983148db93e766c711988f8a02507fc23680e14b52ca4919664b953271189507f70fbe031072fd8c74c3f4517c8d3d7802ec406f0707030c8b7a077
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff3a4c08c058094bb6dd4031071d72af
SHA1d530a26ccc09f49eca8d16e01f0e68bc168e0f6a
SHA25679a01323d84d78eeca8cd8ad22401b965f975f2bb65102233eb3f0657c526862
SHA512ae1222da43e8b9cf392483e91460dddbacd0d1f9df77c380d7a0950172cefd93ac224b55bcc1a1d793575960e791a79b1e92244287c6bf38da90965f703b0c92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5835a0dc24aa792b748a49d0cd45febed
SHA1a44eb4225346fb9edc338e68718d289ffceba88a
SHA2565b066f3debb634b994dc87064321eae54813b098bc1f5a21658d00c40821cfef
SHA512ca5795a3d6ca29c0cbf0307fb87c5d1b23ef8791f3c54a2ccad66abdbe8efe737ac59a21c3126fea83cc8511885f0d40a2d4d79dbc66342b78c832b11eb376a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ba7226d2793f1a13b2f08f5d6efb137
SHA1c1269869e88f0e3973847fff1d622e380e512a5b
SHA2567aaa7f5104fa820852a145fec9e6b0e937094ddac6595711df308fe3243ea266
SHA51200c7ffd247273a1fd0433978b23c3958a76cb93dd3dd5d1f5efc2c956675b48cb7659def05c5f046d24d312110e56b4fd9820f7bc7fe8ac9ae247489a87ebde5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b15313cc8932085ef720cabde252fcd
SHA1c05b28176fb4deee521b2bc363e3c368f01b000f
SHA256cf5207b64b471b8679734e9693f7470d1dbdd11175db211f6ee409956099b2cf
SHA512659983841d6410e633c18ed4130bb4cf6c5c82a5bfa7eedd7895de6a7e017c67151b0a9ed0e833fed2078ebe9b1229724f23e334e3b3143334a49dce3d8b3368
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfbddbf1ac11f5bd7291e31adf3b1b3d
SHA1780afbdcf73d6ce21a68910983194b97b63a18d7
SHA256b6bfd5b90f838667157e9cf80ea7a527a7c99de197e8eae6f779560707966819
SHA512c1b5155c6194b1f0a634334fe45f7881d53a30fe25c9ff4d99fcec6a60ce65bcd2ee48765244f89648c4e886dd97ebd011347a1609eefafdb62b860571fd445d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b