Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 04:15
Static task
static1
Behavioral task
behavioral1
Sample
3342f4d6475fc766999ca4de3e2513c0_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3342f4d6475fc766999ca4de3e2513c0_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3342f4d6475fc766999ca4de3e2513c0_JaffaCakes118.html
-
Size
27KB
-
MD5
3342f4d6475fc766999ca4de3e2513c0
-
SHA1
a4f57f2a8c5455949e5a82de8c4d6bb1b2a700f6
-
SHA256
8768e685972e947033d5c2f52746401044eace2a50652b9b1bb93f1bf3b02829
-
SHA512
e8a4e1833b4a1d8503b3ee7a0eb08203cbc44b4916251bda4f3d5e922332a8017d0b132db5e30b9994f7242a1b62fdc725df7d773028cf80f544e4fa421bcf1d
-
SSDEEP
384:x53H8mf53H8mf53H8mKZfQp5P1j/PtlwUwVwzTZ:x538W538W538la5P1j/PvwUwVwz9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1030f3de7fd2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426746789" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05F71231-3E73-11EF-AF94-46A49AEEEEC8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000cb98f96f6e48ae09065cac728f978044f4812c693999c66d9995bfcb4b8aa5af000000000e80000000020000200000003cc009596f35cf065dc4af41d510a46eb229aea0ccce66fcbadf391d1aa3c30790000000fd17f7890d46cb578d18f0c29fea7f801d0a51b18a102ca4374490f754515637ddeb60482b704a62531642cd422dd610b66ab97c014d89b745dca302cb07856a957c0ef13e8b095dc94286680d0475650def990d45d12a35ae5e40f23387aea0c43866ac0fda339b872720210e550bcef26eff490111ad07f2080d88749de0319802b51ae6959373ce27bcf27a194589400000000aff6f7946bcd8962a2cf112ba8fb59275490ecbd352ecab368e9a97063943f846c3305671b76d15daefe035ac86ae8148209895ab2f74d7c343d0f1923017b9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000000bf455d859aea5c987075e2831633eda1c46ff04357b4bfbe22627e3794117a1000000000e8000000002000020000000a5257ebedb0a5e5e5db92d1ed524665e69c80c2cc2553e869784348793a03cfb20000000b54ee8ab72e7f2afd1f9b24c2c8082a8c559dabd8c3a641010943167edc09acf40000000bc5cace9851b51e61e3156bcf1273aa977ab8dd66c37d6689c5b6b775138a4905a8ab132421495e4ac54839f3d21af6a38d4821404aa472f214691005141c5f9 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2032 iexplore.exe 2032 iexplore.exe 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1960 2032 iexplore.exe 31 PID 2032 wrote to memory of 1960 2032 iexplore.exe 31 PID 2032 wrote to memory of 1960 2032 iexplore.exe 31 PID 2032 wrote to memory of 1960 2032 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3342f4d6475fc766999ca4de3e2513c0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5440fa362ca47bbe9c81b498dfb53af09
SHA17536d0471624eab6d8a6a2d073d5fd0936b67d0a
SHA256c6c49444e5553099b47983297e8b0d64dc3bf17b5d6beb2fcbac966be4a54bb5
SHA5124ee7c45e188703d4ed5b7af2f693c25112905968a13d0345568ace2ffb21b878d23347af88ab36a0b587e447c9efd780741c44d176ba459334a6f4efc0ea1037
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a6a00eff5ad8ab66a6ee2560548c2d9
SHA16d085e146d311712f7fd3e0037dd7f7af3d5580e
SHA256163b65fd54f2a5d2dc3c648213949f2112472dac474cf4b26bbbc1029ddb93fb
SHA512eb2592f251523da1175cc931fed63c2fe7dc40d203d622a997188c8956f8f05e6125374d0993957f48ad7020b325738cd577841c50b1d72dd93df292cecd60a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5045e2cb4924a330d119a7b2cd11b9971
SHA19b2535933ff90cbcdb92564730818432c8d70567
SHA256ec20091b9d55c462c4dc898700fb2e66284243cd9254a16f0bce6256b7376dd5
SHA51244c87696c2701f72421c46e853ea7b2f81800f691153cba8b14200e3f17e15baf142e9b018fa23554666f55e21f5caa1f55c9be65398e044d61d251d4b112113
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5851fd63f667411cc699e42c10d76583a
SHA1c18b3af979cbd7c9a21dc2ac6da15fe563711173
SHA256ff776d1584b4d36a88c971bf8b58142d754056dab38a85c04e03e07f57a1776d
SHA512e19706cf3ebe6c3547dafbe4c5a50453743f7a95fa26a7f499cba0442232eb6c05d9a2c1d03d4bc7da3f5afc71954b69b4f095ac658563fe3faaf4989c36fcef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6971636b214d3b77d5eec55852b0a1f
SHA16c06b6035af5af2fbe42817a3726ace585a90fcc
SHA25681babdac31a9df67bfa32681f10a1599458519c2af0b5a7f80d618b1c57200a9
SHA512f075628a59f158ccb6bceb812f9134b460898df08d11fe5c38945a9abe0cb19531dd7d96666be0cbff6b915823a65d8a43ecfbd00569740fdc8e69f8d82614fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598b8c7256ae11ca815d8ba1ae9a40f73
SHA1586149bcf092374c8988cb70fe9a032b50be4830
SHA256e32fda0a97c4f56b69764784191ca6f2515c759e9686fbc573e51d63503b22c5
SHA5127d960d6a2067cbd59dcfa65789e2517dbd92b1d90d168d5c2c2aefa548951feb12f5a55aea9b1e4d0e89679c92cdc002e453bc9c8b1068c3486f2c46c0fc6790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d869b6e12617d6dca54353b5f9f03d54
SHA11d91f47d9e74d615c8789ec8a66bb89d414ffb45
SHA25630e45a1b44faabd312df1ba23eeb59a1d08f4f68b553664b41d253e6c71a1ca2
SHA5125c2498cdba16f5e2e338b9125403d650af195b26690602dd3695a300cd034529e3eb3c6b77f908771ac8228d3695438fc2af4f20654f2b1fddd697c780bac5dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f1e1918f58a7b4deac0eeb3dfbd4d0a
SHA1b1b23faceb98e9d2e06beca276e401113b03ef04
SHA2569815a2d75fc8049173b8547f322d82f90e765039d06ef3a9408d44fd8a193c9d
SHA5129fe91078105633ad9b1384ed2a1728aa1e483e9a463eba43790b341c2d82d493659c1a8cf3ff1f6d9c9521b1e8f094a74953c76e1fc479ea602196be23c99fba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a61de4e0b9ac66871f2ce755a3cb15ea
SHA19149facb1d70511b01056ef0af3643ab735fafa4
SHA256313bb6523aa894c7d86593b4d6848833531e937a93727894f2241995fcd0b93d
SHA5127a8086cf09a52ac04f8f1de197d36fe13905d471e0696ea15203e982d81e6c15a6e704aab2be4a9af10fb76187c81ca986b82e4a7a20601e3bcc9b93521a752b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5def04342a88fbf7057b6a125957da004
SHA10e327cd2a61120547efb7a2d0133167bafdca7c2
SHA256639c6c87968b6e0c7c9ff03ed5a61387733d7866bf3e0d7b2cb6f68ae1b7ad98
SHA5122ae6bd986aeb7eb79969a08020a5e926cd5b41f628b30cc9a7e8cb2c7a529698a641552f31aeb463e9613f5820937e0d176df0e02d141744293a4de1e92b8cd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565fcf5fc673b3ab1e12bb2c0df1dc652
SHA16e952935d38ce724fc12d0637838eb5aa5a36f9f
SHA25611917f1b117f1e5ba77bb20a386dedf6697e65fd54a0a3cad9918ab2ef6965cd
SHA512371fdf4a21327aff0ff89014d7b049edce3e19903886a000256feb5efe41013e7a8ccebdade3add7c5de7b3a1a24604a9bfa779531ffec96e1dfe8c3c639c829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597e58e3b06b2ad061868e8150ba719fa
SHA17ea205de2abe72e3c1aa989f2f259b9f421e8978
SHA2560ed82dc64ae52ec21eabeda61b351535fff103f85421636b42bd526c7c7497e2
SHA5124d1316ef84e5b75baf6668c2f2b7aca6aeccc3b37fb1a686b5587ee27812ee1fd1b727980657eefaf3cb82eec1584854eb732373378a2cce769f66e4843bebea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d00e96cd3bad3ed9d7ea07e89610a2fd
SHA114490dc9b194a02e83354c30915390ced273d9f7
SHA2561b7b2d071e35601e9639ad53f2653990339287c92922749c2c1ab40565e515d6
SHA51232dfafa371b0b9a2875fe8ec27b16d629b859bb4f633e65e892674671cb96dc17761c17cd27b3338237c2651866f48c3457cd17e1b605a4890df65704df1eaa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2be9bc5b6e8909d85bb2cece3929e4b
SHA172600927822eae03c8a8893ca58db65d6e93d7a3
SHA2566b4b148cf965bc798aeb2d8aa350ed4dde192a0880bc768f8402a37e62f1b77c
SHA51261d964c9fee370bb1aff4e4866a7169496be863709d489b1bade8c97de4232e0bcec43504f6d97bdcaf357ba025c538e0987a43beb6423143ff25dd23ec0938f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbab142979d75b2e1482144bd30558af
SHA101ea47ccb7ed8f0540b018bed184a1d10628032f
SHA256f1c2ca870371793217b4c53b04812f48b82e54d4bd0d9675b981844bbd29d427
SHA5120b9b2dae07bdc2a110f7dc32e4a9c71c950fb4ed341dffa4ba237d3c229d83cbdc4d3fb022d096678150dc5daa0f4eeab4b4dc19b2f461d6ba74cc6ca4b1a171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b82a2130e2e2ddcd693d40c5373b0e2
SHA13e31cb63dcdf245249fd6cfe8b98ba872404a8d0
SHA2560d54599721fcd54f5e9ea79f3674121f0d2192e1bc6c9e856304de5f2670a7cb
SHA5124e9ecab5cd947f4eaae6c4957a5e327812f51a12a7b1a36783136fe221ece4be8a6fee7a6c498fbe001d1c30f31f6559da7bc4cdf89c8b41477f51e9aea26aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cf3fd4424724847b1ac74ac2746b8ce
SHA1f493be23e6cb20c3c9d8d46684ff89b718c52d9b
SHA256e19fba8d29c7fe8285705d358fc503bc04b23f32972129c1aba33b7b9cb2797e
SHA512e0da1375bbc1e1a45a7ce230204f5c3e73c9f18cc92bac65fd41ff5495ee9045f2994ef710a9f3bc40008285427df30c1251a651903192aa3216adfc7d48bf91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a5383d8fb48b480a2458c8624768ddc
SHA15a2c9982000feade62ca18d28764b9b5128047f7
SHA2565053f9bb475cbac3b03ed853f9413e52ef20f8a8a549297277ef7851b3cd0fff
SHA5123aa2dc187c470ec2f531dec8df9b7eea64501e1c2ba903e155905339193060d13a73375a24c9d4d0004881234d781de935f62ccb2a2adfd53d1543292c091530
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be6a86c3f9c4e1a52735b297c735e4f6
SHA192a0eaecb2ef08ba3580f5ed4ac027995a61743e
SHA25624ae8191ffa7e0184845dee892dfebf605ff49512a200aac9c0c3b034cfc8f6f
SHA512151e4bf7a0dd689b3c7f83f05aa30ecef1a8f501108da7305638f603818020e1d980ec9e04c4c7088e1ac17081b61ce5d40c1cfcb28f2775b67867e8c8b49dbf
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b