Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 21:05
Static task
static1
Behavioral task
behavioral1
Sample
31f8d63a82b2ef22adc65a71e2c622c2_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
31f8d63a82b2ef22adc65a71e2c622c2_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
31f8d63a82b2ef22adc65a71e2c622c2_JaffaCakes118.html
-
Size
77KB
-
MD5
31f8d63a82b2ef22adc65a71e2c622c2
-
SHA1
7a550ccaf8398b13eb069785b4fd6ddef68b6976
-
SHA256
45471a852a583fc571d8fe1c67ccbc724316e0e0678bd61c71b0962b0eef7a8c
-
SHA512
ec0d8285a4c33fb865fa80914ebbabb58cafa4cbb8847436a3a5ad0703dd8182529a3a281c2258b720d92d2f199b508b21fd8706786901f9b49e70eb1cebd474
-
SSDEEP
768:Zcd9QZBC7mOdMA5pC5I9nC40S/JiceR6Pd:gQZBCCOd50IxCkqR6Pd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8047b5d94ad2da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000be0cd4a901e300cf773ef145b922a0ecffe651f6babbad753832f8ea1b047266000000000e800000000200002000000015a1809f96844b0eeb0f94fb8d942545f9a09e0637bda507fafc92aaad0eebdd9000000030d523076b93f9c4c3cb9fd241caf78a93f64acf2e908d6937ea8fc0d39b1d184b57413b1e528d1508668414eee1426a6079c8e70f9270c3f3f18cf4554d32684dd30718e2fabaab350eb52baa24dd78ff882d405ce893d99ba539f02c6a5cfd4c0d929c7d061e6e70f5ecebc066a1b06aef4e72c4b8915d777b4f15f642d45f15b5a0f63d66cac4813f6573b2a86b1d4000000099ae1896b44ae2599c42b6fa192072cca5a99a3171af4cc5c6c4b3e910ba1e8087961316a5723edbea92368009f121c514eb3ec6bdc060548142cdbd0f19d78d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0295FFF1-3E3E-11EF-91DA-667598992E52} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426724020" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000006c131e40d408110d4bfbc8ba292e837107177ca09a4383918b9568d27070f904000000000e8000000002000020000000a61cf062d39ea3ee9970313e5c7b3810a7e3a21146298961bf62c4acbfa3528e200000008d9848e4febb1e5ab47a05992e3f670633247e2c71d55805699ea54421075d06400000005bc3c64583fd44e69e6e0f1ea5ba61e874d9c8ca0535f4790b604250f16e25430ea5770a48da3304573e27a5686191f225825b0d223afdd9b97bb83be0cc27e8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1196 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1196 iexplore.exe 1196 iexplore.exe 1928 IEXPLORE.EXE 1928 IEXPLORE.EXE 1928 IEXPLORE.EXE 1928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1196 wrote to memory of 1928 1196 iexplore.exe 30 PID 1196 wrote to memory of 1928 1196 iexplore.exe 30 PID 1196 wrote to memory of 1928 1196 iexplore.exe 30 PID 1196 wrote to memory of 1928 1196 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31f8d63a82b2ef22adc65a71e2c622c2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f389cdcc9634cc681a20dea4c370ecd8
SHA1fc35ac7fe177f497cf4a5f691644e5e7ff3879a2
SHA256399203c0db0f82cc6bb77c1d1ad4e3ab8e96be206cd860119f1f463169fe9972
SHA512b0b5a58c7eca155bcd6ef14dea06bf0c6e5a01e3e307aab794b9cd81260547fec597e78e373585fa4de601957ca51d7542c3955ce14a31f471932e963960a298
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f7eafe7bd1518b2ef344a2d729f2c94
SHA10d220ef70d7585b45dbb96d18c51866cb15e99e0
SHA2563ab21e4b0fba8eaee19b5011de92d32bbb42f33e1e2637640f4dea17c79ce589
SHA5120516653de54997095232df304cea943bbe39636cb0beeeb5e74cb59962dee68f2613b3299fb35a984419201963b4a30d95714c90d5ad7392d71a00b0a8e3347e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cca31536d14cea5d67583b6cff815a3c
SHA1fdd1837b5a416fd0235309c5db8c11a10fcff77b
SHA2563ab6f68f9705bcb1a5cb49bff1b6b0b6ee3647bc1b8dbf0223d280c1c0244ae9
SHA51271fa20140c361e859d86603b412ff29f692307293acf665d397b54d7444a6f62a31e77281bc54f40d0863954989d1db72c4899d07e55ceff660560e6bc906e30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5513ea47fce2d25addd62a2ac81a70258
SHA145b1d9da0ab6e22854dbc86bb072c66a26062cb6
SHA256391e8d93a191cdca1b2df9b8eabf6ce3fb7699c2ec467780fd87666bb7bd8a95
SHA512eecc85c0266349d0cc871fadf6988bab6ca0b8a50dba0ad05f05cb60c0862feabf28ec99e0712414c101069508315200e0c7b956e77baaf55825810882fb5c30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5860e9631e89e1976b0576e37c4120996
SHA1fdec0d85812387577a3a999bfb4cb2fab51742fa
SHA256cb1c4cb6f453d01a8899b06c8e7b9b5350047c464fa2c302aa02abf685137a55
SHA512454ae30fc4fbe3ac8e30a16b15a0b7b7b9f9f9c4a173e01843b3674ee74fa6bbd3886a86932099bc16092f15d46b472cb849abfe2d97cc6033eb23526ab9c27c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1c610663e2076611ff59734c8e67f20
SHA1d8cef6eb10df3b544d796cc8d4714a055d94f7d3
SHA2564782d66b404728889295e33cbb636ef80fdf861fe2bff8cad6af69513e007a7c
SHA5129efa97f61d51310ddbd72a7b812ab86384652e004d398fbf40308b8bf81f0f10dc2fb7920edd57f8c791bbb37d31463c612d5a6d7b14def3b14364ff75c5a83d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c035e27e677d6c919893221cbe5404ae
SHA1911e3dd6b945189af13b25c20f88c152ec3d59d5
SHA256653da4d68f816eb615baf27f234e845f0cce5830a2db8dba130f653a25e512f4
SHA51238d9830f46dc197e5207a25d59360fadaeb034ce2a843299426352e5025185c8eafb70df787638319b3540f04a4d5528e5addf9e3f37e32da8eb09327071abbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebe68b54ac67dad9f5bf88821eb7fea6
SHA190e834928b16141ac2bfc4015c980abab1035fbc
SHA256f55f7d0782be9b455fc0443c58f34ae1dcbfb8286313fe3b0f4a485971e3b0c5
SHA512cb5279cc70825515fc9f4d29f48330641598e4b0e8536539ba6ca30b806d1038b0a294a75b367bc0408828cb3b4d9fa6bffb5b50b19b9057dc5e55bdc5d4d4e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb737b97ea1882953eb48499728963fb
SHA1adc1866cde69d22ea880035cacc810ac81576c64
SHA256eea93f9bb9c3464b5c2d7071aefde80e019cfa8c02497eccd79e360dc630b2ca
SHA5120afc6d3e4cd7fe787e1a0c9bce6001c8a241841da87b2132b7c14703d8491996fa2938bdc5c35f5f06872866602075794695b25113a506a62601d63d0d7346d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c73e9c985c114afdf6618cea95fb44a
SHA156d56ffbe16cbe4a23ee135608a8e5beb27bc336
SHA2563fca42f9152b2c88926b9157d491ffa97d6c4e1ba111d609e748d8e3ea2124b7
SHA51279deff6611d0860478c29975a20b2e73fb4903542cc4ae07c253786c9b2d78849bd2bb559fd05866af77ca3102e22de51f0e12d2d53cc7ccd38d277765a56f1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a072d5e8ef55572ddbeaedab88cbc725
SHA1e3b40f8a83f56ec1ebb70ec12d5ea5ecf7f2fd1e
SHA2565e2f4feef3f7af8436ca73c5da1ee05a78da968080f3c13fdac24fcc760cd1f7
SHA512f78d5cc2c3ec7b1691a7e05c476ea908f2e13ce7985245555d00fb719e10c8bf600cb93947d4b86dfcdee8bd9b5f742c7206a40fd9995c58f85de1adc394f751
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52efea1fb6f7e443238b8d3d348f384d4
SHA1d8330cb89029a2878aebbfff9f2393080473f996
SHA2560d7fb6cc8f4dd0bec4b451c76cc1b13c2bd61c83ca1508dd69c6aee3016541f2
SHA512412a3bf7ac5e6bfdea698d687bb4d5adfd4f74e2fab1bde85ea71723c3bdda6659abe495bb4df93b5db3b64b21a2d4698902f5b40b33f8c93d11a2abd826d889
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5615a8dad4e08444c0cafc6ae5037d9b1
SHA1650f8520e59dfb9109f3e36c04116e54c13476c4
SHA256687b1239578fcadee9c3b97044de4c39192607478616729fdcc224295bb500bf
SHA5129e466b7d3dbb3838a14290e304af7a85452efe9d7b8d96a0be1459326f88fe533f0831a434e2e78f6f50a43a1d0af769496c694275a8af3ca5cd58029ff17951
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a641360d853332b4a13e9c615b3c0a9
SHA1459b043e7adfeaa8ea0b1e7cff5369a01f37d2fe
SHA25602db673f0c1a149e23d18f429ccc0c71bc9909606a273e81d320b0046ffa78bf
SHA51292335034596f909a4d9396f71d70220b6ce94ccb46754e7e8a3da7a644415cc7e272bfc28d3f0770fe77e998b9affd621a2bd35c2f7f45af0892120587aa5f4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53184d484157a27096b5c64e861d6190a
SHA1a2bb0cc69a07e1ce7aeee3b66c3c0866e145d4c1
SHA256ae85d3439b0271e299e99b4628bc7a0b293fea99073b5e8a716ee87d6a944b3a
SHA51263fa9a67048b046de7d028802c53e0a067f7c2fec9947daa6627a0f8e996a487fc7074cd57ae78b2d440c8d4c2ca9bab7489998e67009d07433db989f7053330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5caf3aaeca19ebe2ca6375abe78194fd3
SHA1baeb0e917d47b544672a72e54ca16c393aeebfce
SHA2566ff4cae66796667e104a403b99d200ce82556fb7cfe3a2944bc847b03ed23262
SHA512ecdcc72bf7d1fafae5713d69f87de7a94579da735d519a38b1c4a86fa9d27a3376fa6fe000abaf76eff9da34775abe39dfdc66ab67a27184ca648e8cd74ef34b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ed6eed502e443b881f8e3ff600ca571
SHA151c6eac51e4dfe74e5d14f472924952b4255292e
SHA256eaf65045186499f2e30d855a0a6660f533839a824097a695ce295e361226be1f
SHA512c18ee843b102a03c74a2692e654fe35376289cf2b96c0b9b8bf21268c9d49d31810334e098efdf8517590bf650ba8909aecf234a1ad9a9244aab417db9c6df81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a16bc58a968baf52667fddeaf80051f4
SHA14ea3c6c1f0853520a5da5de6678d029d6b6f2f45
SHA2564201f8219f4b332b47c637c97517e44af031ba4d22c402e7ca7eef5fe1b15df2
SHA512a44e68f9bd7cf6b67bd118619a40b0ef2126468a74d3ace2696a4259eaa0d58d92b3b6ae684230c946814e2f318e79b47e4c834a538f2839a6727c5792526033
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5163b2cd39b22deaa96c4877b4f59222d
SHA1f51f06221b41f317d693c0fc3b8fdc11348a2938
SHA2566bc9df29edb31f50a1ab885c0e7bfe390aa156395e6a1fdf522e778010fc2c1b
SHA5120a5e3e1bb3902137f3d9082a0565cff673be426bd70509a76d2bd871160a2b607e4176e46a74d3993a8e42a896b6b387fe6677bc426ac882f2b50c6346740ea2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b