Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 18:03
Static task
static1
Behavioral task
behavioral1
Sample
31693e42a4635bcf1d1f4fdf13407f67_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
31693e42a4635bcf1d1f4fdf13407f67_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
31693e42a4635bcf1d1f4fdf13407f67_JaffaCakes118.html
-
Size
70KB
-
MD5
31693e42a4635bcf1d1f4fdf13407f67
-
SHA1
5b64f5ce1d1d9747037a474c4bd6cb2ab3398b44
-
SHA256
1afbd28c0ec93a4b86234c6032b6b01af9e70a98787af555b31bf3f11fc10162
-
SHA512
c9c5af2a6760d96ec664e4a3d345dc58e2c089d8296e028e714b1bb1c5d18a682cc968c0b5d1a00dd35d798493e78c3918ff3a7ff32c6462346c87bb95f6031e
-
SSDEEP
1536:gQZBCCOdU0IxCex0qYf0dzCNu/4dzQHNVpQ+DvUo1ofAvrKyz5cJp2KHFB+sat3S:gk2e0IxeqYfmzCNu/4dzQHNVpQ+D8o1u
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000333e59d45622f9e4768b5f4569d6ba4c940eff364f59024425ca36ae39a546ad000000000e80000000020000200000009de825fe7c32e31506fb3e7b02a7bf82fdb48a2ba4443e15b9dfb00311de5ac690000000d2d04dd144de93770da842b502d530e59025f456500d0db37ce8e13d8a9afd2e84965829136add2a48b3e20549f3aa48e255eae428ce4db96e078d95171d83b2afc0ae131fae31a8258165abf15926410d4395a866ab8cadaa5113e5f7c9df02fa6606af6ae8ed93e575493a6c5c28b5a613564bc00e6d67e21eecac2e15fc898c57871cceaeab3f77bbc4366311858f4000000021c413624586e42a0c5b68810d7a6e2c99b1930bf30d179a5cb990174b3b1ac33c9c50bd4e5a4a5943ee2d9647117c66d31f3cbac0fcfc8720d4f5a707453157 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000018d286998b0dbf17d21267baff76cc14f3511cdc895a564b63f9a553a101f416000000000e80000000020000200000008db3b3e3ce9da6e354672847d2f10650bff018aaf7a010eebb237855e67909312000000039db1f0d80c8215bf7ae9588a7806e4b2d00b9b6093befa6ae44a45716c96698400000009240b28966d041593fc7b63bb0a0c4749bc66b29e9ac0ef909b12af27f7530fe0de50f85b6b8b8d78c0fd2c7797a2626d651a20251091c886108b071f3466d34 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0cfb18034d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9B86781-3E27-11EF-9478-46FE39DD2993} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426714421" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 iexplore.exe 1936 iexplore.exe 1892 IEXPLORE.EXE 1892 IEXPLORE.EXE 1892 IEXPLORE.EXE 1892 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 1892 1936 iexplore.exe 30 PID 1936 wrote to memory of 1892 1936 iexplore.exe 30 PID 1936 wrote to memory of 1892 1936 iexplore.exe 30 PID 1936 wrote to memory of 1892 1936 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31693e42a4635bcf1d1f4fdf13407f67_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9309c605674a8f66161a58413d454b2
SHA1ae1d050cdf1677487ffbb1dbbab6dc02af59602b
SHA2564209046a6843be649b0904775e5c9c0cdfd5904f9c601cfa6734e52955a9c867
SHA5124459169d417444270f57eeac9b5657bcf71077abfc4ef517bfdfa2ffb7ec0c1767134091d72b3d348ee0b2a034f4a9b88ba94a7947a85d29ddef0bb637f90ead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a9a0b94f8d72e7e34cb51f0a4df302e
SHA17333b5be9f4ec2003e80cff4f20ab37091ad5b9d
SHA2569836a2cd0d3c2f6c83d94a693993ad039f9d767d8bfaaccf100f89e57fac5abd
SHA512c6756d311a82119a71cb1d3582b46eedd06f498a8f44790ad92647e2545cf7af420e7b8cbcc048cd19a8b9c2d53e0ffed22808bc2939ac97a7a60c8e177521aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5194d8af3c3d1d1fcd4f8b5a98da0419e
SHA17816ef28529dcfc63b50f26ff43de236981453c2
SHA256383ca78b0b20af960aed60da867a1a489c362d5ac7515d6f8b3f2a76ee2d0bfe
SHA512d6c9097c3ba0696c454d5b86118586fb9091ceef82da0cc54a6cba0520b46b2a262f88bc7d80e08a7f88f31cb347326a3ca7836ef6d3ee189edfd0a99e18e7f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58272aae93d78789a4d7501395e03847f
SHA1d5553fe2c06516d19c8de34bf12ce9f7271d21d1
SHA256350be5ba8a1a753abd167c2ae26bbfd16bf79f905cba724db426682ce4aeb22e
SHA512b88b5f7fc81f6c21d0129d8ee4e92a70b5180bfc936bfa7e7c4bc0c08c5331df13cc987418829803458b8fe75014393622dda31e2911f6350c999076a80b1012
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56277e8f2110722416a38608ca8056372
SHA1452dd5e4cc64202b23fdad360a0ac23959941e80
SHA2566b83d8a99102478fb71cb79d421c82420cde34d00ed6606cbdd1b010aa77862a
SHA5129d63d5d68984c36edf6ad049164e9e5ad4bb03f1cd67051e72801b44b1af954803eb6a896e8e4e1d346d2e52bbf1b232d402fd8582b0e9f4a02ad5585a27a8e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7e4d46a6c3762f542b1387c1b144e93
SHA137058436ac8a8cfb8f800b53e5f019c6806bcd02
SHA256e73d43e505f70387dc7e5e92ce79f84b0f3f87236d7f80a379a7d16b9b86f52d
SHA512592c34c07452720cde3edb33529fb98f66b674cb1d8129cefeb3f76602f01814d40495132e956d97b88598930485905b4bdcb71b7af9f98575748884c506052a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df14c4b924842921d525fc4edca82012
SHA1112cb40879fe6c0b7bb1f0048d7d98852347c1de
SHA256c12efc720f73233f6d2b1e6053133c86da4ece65d53d74ee255ad213ca05df5e
SHA5120fbfe3c9cf076b03bb3dd216fa7ad16a70111d34c16923a82b9f8957b32344b68fa5e716df15618b0ce64e62566e558efa1daa265b7c28fbeab9d87aa2e5a5f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578b763b1e191d5d8586dd1e768ca207c
SHA1ba6e6d6823622067436a966417e76cc9b63d8b75
SHA256b3f9331ccb3da3b5008b36c925a2e85801373c20c7baa4494827134156590907
SHA51297c5d9a8507db831cf366b5fe773b2f64b617149f14be730909b01c2047f37170a7393f22a6bf9b21050eee34beec28e8fd70315041025419ddefffe309ad830
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504af981aab1a053d5c545c92500f1a12
SHA1bb1f28a4ff24319fb5573232ebedbf48e4a361d4
SHA256cd1fd4a49d549e465c95c67783ce6f1499c94c3b5e40920fc2403708d29d7ae8
SHA512d01f5d05bb9fd5ecafa944b1c9e4db859f12c528ee27c23a6b759568b59d71c733affff908c400a056b72bbcf80d330e3ca12acc0bc757dd2bac0fa7c552e914
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d914fada4f99450cb6c86062ead89ea4
SHA1e2bf9c28e132c880d8ba322e816603a6910b18de
SHA25664d24a9760616313d53806c34250b4439370a98bfb1f419a2c1bf9e0053a4ed8
SHA51226e385e11df34aa47ea0c1c641bcfd1ec51ed977f386a2dc94c46980cd2054529cc407681de9a0ea338c1682af79612f3a29f20ab8aaa9df1fcf2b5a90d375a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e5fa3b4434fc852c8875904e0b1f5c8
SHA12b7df66d3f597d631954c23855e20ae51d0034b5
SHA2561e4af6e5973948a4ff3ff7129dc0bf8ef9c055c992922c4b5247e958a13587a1
SHA512618231919fad8f77da751db2c573060fca233c99cd66fe8bce54de8785ef20023e94c219bb46191718da1b2cf1624e2225c15339cd67364e5af9789042bb1443
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b500caf958fceeb9a29a1d7d3f937fea
SHA1b84a32d1f1a0ba23ab392d688ef99dc53935a50d
SHA2562b1c3067e209a7df2ddad1d7c182301828dd21e3d758175565b6babd7e9a60d3
SHA51222fbba242f64953e6fc8387f3b20aef9d7ece975da0a2bc8bffb6368804263fd761446b9732058c29c745dec9b7162d893a68ad11a7edbd17b5b7e7bcaf2ea3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59be6ccd16ff78aa6484ca089d74d7691
SHA1ae6f738802574bd17c3971295780404de2ce8b69
SHA2567c1808f13e7db431a700f79013371d208ba16d08e6a738232a9aac6b4026c2d3
SHA51241bfb03c4e57492732de74900ff5ac633133e9d21d17b1311fb5c5e053b322cfbe25d9cccb8f599a2c259e1c4c66b2e731b160c36ec890f854ece889dde661bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5432f60d34321cd3242b527c74a3423ea
SHA19e0097698ec018e97326fdcebcc63622a7c7d9ab
SHA256684627dba8cc0e19ce25552dff32b7f4ebe20e8295d70b4bd67d34af76d7f1a8
SHA512d8472d7c3c8772d3f5451cd7f226d7689e7dc4ba419e0db756cb4e8aa7bb21e099dd47cd1a45788583246154c9fae41293cda5e5abddb061d1ba107b9f9f1421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5132477fc5c410d2e661f5376fdc3e79f
SHA19d8d762b219f5641e27481af3a85815e5abfe506
SHA256343fa913bf2dc8dbb55c6727a37e98c7f678b9866b2c9dc8af4a13a4792b1a0c
SHA5127ff9fade17ddb6548386844330ebc7737dc4f02b35a917744a92be3cac1b9492e166e2e1cca5606454c73d92b611cc25aa6d8cab026475c2ecee075c8eafbcf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4524299ea66670573ff9c5ec6d69c66
SHA140cb72715d3902b3a02ab4406a1e165c609c92c7
SHA2563167954fdb8c6e2f91c9069549222113e8eb4316ae31d27d4744a7db85221a8c
SHA512326845c31f3f753fad2a7fdcf7a1cd7690c3cabb1a2bd781c028680f765451e0cb9ca20bd203f6d1c2f09ae5b4f27f740c42267544cc0979888db75d075a200a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51689a852d5dada84b51302a025faf48a
SHA12e6a18fe728e837ab01ce69c20596077b29e961a
SHA256debe1c5ab6ec7384f2d1ac27b3cb021c1a060a2af958aa1cfeec8c38370a4a7f
SHA512de2ca66d51ab80c91789fd530cf47e0fef3034946f86555ae97402169044f17e5781975ba03325b0e9f286ac8df531f0020251f3cb4907b5206ca43285300034
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545d6695c7613f3db0989ba24629742cd
SHA12862e81b8ac47e5e23cfe49fc2cf9a154082a086
SHA256fcb7338ae3af9b8d2dcad6855de7fc7ad8b23be10ac3cd7b9435d4f176b3d399
SHA512fc43da8554c23bcc03480c64c72d9d2f7761ca70260e22244867266d6c2b52bda6d96c884c89459bf1a48cd452a640325d1521503c170203c207c55c967b13c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7e663dc5e1e6579da72b36083af5f77
SHA16c71d71acb1cfef6a05862d11bec369a4efa0f0d
SHA256f708300a93101c21a6bf125c7efd4badfa0fcca69466c32fd0c3cc986bd9038c
SHA5125e223ebdf46d03e8656f914e053ba585d89961768ae53ef308643dda53e42635062a2cbdb862ab8a2ab088b5a45093602881a934a5ca1f6de30ae3b4a26a9227
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b