Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 17:53
Static task
static1
Behavioral task
behavioral1
Sample
3a2aa68b58a1ed2c7a61dd5b44b8cedc_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3a2aa68b58a1ed2c7a61dd5b44b8cedc_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3a2aa68b58a1ed2c7a61dd5b44b8cedc_JaffaCakes118.html
-
Size
6KB
-
MD5
3a2aa68b58a1ed2c7a61dd5b44b8cedc
-
SHA1
585e41f647a7e0d3f9a3e65dd29cff7ffd667649
-
SHA256
59afb9f7a901803ed0d4968d306b1cbbcdfeb5a81038baf1b1d0d11000a51ccc
-
SHA512
1ff628d6cac4ce1c492e66503953387d5d843ee782baf7a61b6e93276b44315730dc8c1b705bb97c1a75191ad72343995cc3b7cdf349a22b4a734dbf894b6160
-
SSDEEP
96:uzVs+ux776vLLY1k9o84d12ef7CSTUSoY/6/NcEZ7ru7f:csz776vAYS//4Nb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000e433337469fdf9caaf30bcebf889465e584d027d1a6cf1aa9155a0282f4ceeea000000000e8000000002000020000000f1f61bb27c49f7c3443c3128ca43277c9e694e9a545bb007a9b5fd16d1233b02200000004c09117c3a8c345e1b13fc998f49b6b2597056f9a26d1ae721909edeec713ae4400000002ee9125cff3c60d3f954476df616c2a0e0f863195338698751a025087f4643cc22802f0620876f6fd135fd4fcfd17ab30d88d9c20e3f722bd0dab1d7fd876f3b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000f596e96c3a5726a99f7582b6a4e1a6aecba63c144c171f7b10d6963998c4cd3c000000000e80000000020000200000003fea8f18e71e7870137ceebba64256647b8b80919ed6e69a0ff7430889697cc8900000000f50fc5165b7eef55296fa3fdc5aef0f3e3d34e342328cbea1e1dcb53d76d68f205cdb4de6cad3dca6b08b42dc0d65c5736e0eae8aa2b58070817864291baeb66c1991df8b97a0151b4b1956b7fdccd7f9855dbef24688497f0225f800f703a8b81612e3185e7d53ae61d33f2086e697a92682e46430c3f4bf50fe823bf3e968268ca9936c523f9bb65f5f2ab185ba364000000043e694cd3e708a5c1d8663518bd6eecbd2518657d2c576e5fcec6a6660438bf2604ea404d5f7e098ceb5bf496bfd4cfc58944250589180b70a6170308f091e7e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426882302" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0828677bbd3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89F96101-3FAE-11EF-988C-4E66A3E0FBF8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2740 iexplore.exe 2740 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2704 2740 iexplore.exe 30 PID 2740 wrote to memory of 2704 2740 iexplore.exe 30 PID 2740 wrote to memory of 2704 2740 iexplore.exe 30 PID 2740 wrote to memory of 2704 2740 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a2aa68b58a1ed2c7a61dd5b44b8cedc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5909bb5ea593ade55d442d56182fe432a
SHA1a605a2b2051ebebba1fb09c8cecd37683e97db8a
SHA256e98f029819f1dd7d7b454d9f69075cac1dc392a16d6cb7d789d57950f1f5be39
SHA512998837d75af4bb41c04c96d0e92b87bea9aeacc6d4e179e0d759c11811129b8611a469cae11c9eee975e432d303f66270c2955480d9eb648b5c4afda8b8237db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59147b2c27785597cc30df24ccec0ca7b
SHA15ffd8daff56b1af2aaaf8ef1f911c33b409d4a39
SHA256c5ceecd121656a85c0781e3386925f7ec48daca806a5cda96e3c0f0d34fa75d8
SHA512979e3cbbfa1b6fb4637bf5ab975fba6786aa890e133489826c1355efbfdb78fef58fca2f603160d029dea3796caebb9909e8b3b9e3c7a0433ef3d1e3d0d74aff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56789f01bc95eb8c21303fceea37384a6
SHA10e65e68447ccc4aad98ba7d0db1b6dc17eb7794f
SHA2562e59896f2e3cc191b5a977a4e1a4c336cb33e8d523465fdc7fab0d440cb8ce20
SHA512bac72687d5ae9ad09c3b02ff98b2948da76decf0eeaf19d93fd434740988dcce9fe47b20173c6629281994210fdc244119f9d56db6853a47c9f76fd405018b09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d702442ca1f8eee22deb0590c7c7c8e3
SHA117a4c104b423d9f96f4a8e21b57f27afdfa6c092
SHA2560e07128c4906c1bae793e05ca2c3ae205ddf517002a96b91d701d6e67ded7180
SHA51247533faab618d535479c7e06940a23cc0080db8bd6245b6dc74cea33355f35a08db8e3ee42e28e056ffbd8c865614c655c16b4661680565445241f5b6ae74f25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f57cd1602fc87298ebb587ece19ddf3d
SHA167bf30f03c77bc234aac1f50978a48110ab41751
SHA256807e2ad1139df9b7e01a36f225d0b3e5f3f3ac2492fe200c3bd5de7ddb9db7aa
SHA51256f3a6a8ed3548d448b467ff70f740ab6cf6842989f867a5938ae87f10dc3c7732e6af80460b8988a4d895233894413d95f526ad72bc7ddf34561711b66b01f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510d7243d77d82f158d8341499b990f0d
SHA103f4eab43f283884258c6382a83cf3bfa8e4b013
SHA25686d556fa926cf75887601777e06a5a5b9144fab18d936cff362040432b7ab0e3
SHA5127e6557f3e22643d42a754f3dd1dac82d684146218d716aeb01409d3e8e2f8886140f19ed841aa2e95ac974ca8745ff313fb11f011c48656b6a7a689c846b958e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c329a150ea3e323d4db6fe151dcb0909
SHA136b5c07ebe609dfb46f56a001ade935e9795dcce
SHA2569865b9571e5b5ef929d6df61a340dc8926b2b63eb5a37e83f3acb5cf269a558f
SHA512802052703186f44eadc83044e23e37b06ec84a5dabbf636e3a11326c7747cb5786f49301dd0fe4beada64a2525ac725e5dba7b1b8be97144457523f86b8d0793
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5947efa8f0d29f1c6ff2b0f16b7923afe
SHA1ba15a04bf175b2ef39436cff5313e386fb17e70a
SHA2565f377eaf60a8ccddc7c414c0d4904131d7054a248a29911176d472890f99efb4
SHA5126e9f330ca02b96a88108a945f2f0fa7029990a4bc269fb54f7bb8026cff9cb715eaa9b3540387dede5ca35e6e93ca5d5cfbe831883e5808ba0c2c76367c631e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a886b05297e441696889720508397afd
SHA1b3c0b4168eb03164813a2103b963aae8b85c5705
SHA25669d661008495301092d31f7f6cadf8f048a677d1d6e495ecebd0ee13ed640fa0
SHA5122ca6b814408c833d892370c805ad01343eedad0f5326f095be7dbacde7038b9a3c9fed579f6c4161e3ed53c2809cdd93d14675b37e5db52c20a55557f52ba720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef54b82ff66270f42d4d744d4e3c417f
SHA1a1a202f28554ec3f6967b2093c3a10371d380e37
SHA256ba03aaab83cc7fbc50ca7989efc4393a32624dbb77ea8d79f93e2f51fec5a31d
SHA512eb98fa6945abf5823a7311f43d45c535cc960084c1e495dc6e4af927d4e309a9ceed1d85fab54fbb65f9e2d277c7452f7b5e8ad0d0e9f18f88a864fbe2a0591b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5825486c41c5f879c7d51d59e979504b1
SHA1a14f4c409c98b9f37744cc79bb414953bddb31ce
SHA25607de4fff320927f41289301414d1cd38d723da302c5027bd78e1814e1fa35dec
SHA512db6324a7679da3b4d4ed7da650b065788750ae593ba84104fab0c2aa0a71bf910690181e7b09235c31d0a220321771260dd86296713b040457138bf25ad69d2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595779158eb13a5e6541325fe50ac610c
SHA12921add2e7c00ecd5f6d8fd75384f8326a420dd7
SHA25671abcf61bad59c5d20afb0246dca8622b5a8275b83f360717536d5e83a45b8e6
SHA512a866e33af912d41ded15293e52595cc5a05675b9066556664ccb0a4e1683db920a9e8c3a77265db003a468e47a8a8a2fd2e23d7ec41184df64934ffe259701f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536c5adc71574fb7893a121dc16e64f6c
SHA1ace0c2aa4357f66c48bf40d58052a421903fe674
SHA256ef9e5fe269215f9acd3327dc1ae6720f151c5fe72605ea018992595d20a886a3
SHA512af90ca6824ea5b7a9a976cace57c93fd9cf11eb497599c959a6951329f0ec23bb905f0e30f96902b88c76f619b45565f6ae8ff26be6de791b7434815babdee64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e10f2c3b410ce6bf8d4df96b2f5a94eb
SHA18e2b8cab2bd4389afc73b32d39fa33063e69d333
SHA256f8aa04538282bde612964d9f0ebb08a0c703235044e0f94ff15600fe91ab7a8c
SHA512071405d368181e7ed666c1e33848dae9729eb842904e952f1fbd2515a67c33ae43ffb17caae9efd3cd8f33b486a4b9480519cbf6c1364b0e8fef9c2eba726d2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3f8fbf2dc0ba9483ac3c1bd8be908a1
SHA1ce0c8e2051fd86261c782ad1682213ad75523b5a
SHA25610c63e74f584f78ce9b00c12d5434429f0dc110eb3dee74a2cdf8528a8d44f21
SHA512fd7cad04b1cade54f8ada8ac9055436518f67af445cb732815cc76898b8aa102a305e9b9a5ee4249c266dae06664c7688fc5d59315bc6c1848af61eaaaa84b8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0e128a113158cd0a14b1eeee19c7c8f
SHA1bdee8c0b3ffcf96dcf9efdf1a419acbe9c594c3b
SHA2564d1268f2826fa17f54a703764944e5cda7a6b33337e82de58fe5df4d9edda111
SHA51268970eb135e6853a120ea53499a24a28cd589a7747e17696fa1270ce4e85ce114a0c7b1660515049ed6584f6848c086865e8172290066ad51e5ebbc120b6489a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f8fd5789abba6767d423efbcabf27dd
SHA149a7aaeb36d48d7d783636742c34f6cf1709c084
SHA25630d95bc93c9460c0d92877f172e0dd648573d8657937abfd23a1035368e75fb3
SHA51294151e9b521468f0f8b8e11f335f6204547baf3985b2b5240127ada7d326355319756639511cfb7a4fc1bafbb274b165a116d13d049acd09b1151c57314c6cf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8d363311611a1d238f4336c3978f980
SHA194dc9ccd22517b56f548caead47d7755fb88b874
SHA2568d947ca499475427637b04d3b638e00ced69d64154cdf07ce67cee4a6562198f
SHA512394eb2b5d0f9c141b348b6f13ecbdb64e2034666d5e9ad7194efa5e94b3030538ae9a2c72a7cfe2afa8dded8e36273bbbb0e2f8d611bda6feeed99c3c800bd7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dac1cc3bde624e7644bec3f1192b307
SHA16291f811f402912df27ce0c54896c540632381d7
SHA256ae649e075f3b7121988163a37ff442cdf4e9c00b324dab37ce7adb14f45019fa
SHA5125d48f831802eed7ca5427439168c46c5235d274b7f500734386009a8ebba3f7b0dac1462f0ace3fbfe90362966cca8bda977a8f19c9c5c1242e74030cdbc9f89
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b