Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 13:58
Static task
static1
Behavioral task
behavioral1
Sample
3da7e2af468f23b5caa4594ca44ffc02_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3da7e2af468f23b5caa4594ca44ffc02_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3da7e2af468f23b5caa4594ca44ffc02_JaffaCakes118.html
-
Size
121KB
-
MD5
3da7e2af468f23b5caa4594ca44ffc02
-
SHA1
2341fab3bed25e6604d3f2c67b893ff4b303f768
-
SHA256
513c8ffeaf16a26db6fd13bb7d5e3cc0b7b2662f2674c07d02c43b7fb9d1faae
-
SHA512
b29decfba1c13fa9eccb4f06cbf5ce26b124e39c042953e34d59bb04b4bbb242c53a9a928aed74568ecf7b5c78429f01d816d56de4803fe408634fb6d1841737
-
SSDEEP
1536:8GhKt4Q2VX7iZJqh+P4vn9ne7KxmoLbcNIM:TKW3B2mh+b7Ki
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a73fce63d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000b08e0cd13bbcddbd3374e2fbe129314586cb7fcbc749d37d52137b52df152dbb000000000e8000000002000020000000f9020dc1024b99437c51768646047ce1b031b2eded9b0c851b829690ae0c57c620000000492982cbf7e2930a23ccf3bed253d7d827adfc09cff0434d2510af7b4592f7ec4000000024de73ddd6b5d7b45cfef70a099a9aae36fa31e59dcf1a3defecfe92fd294ea00fcbd884da1e645317d189f3e3951f8c20328c32240cd534eaf1c03e2ff2674c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000b1eeb18c2e57987adce47349da1d3f3907a0884a6edb8b96fee8bca56781e81c000000000e800000000200002000000085643e0301de28682779a4305a7ee69925c17d1c2e9beef75908fde42fda6ab790000000a11abca5f94e7d33f67cd5799e501202924dbbf8661017c74ba2e78ddadfb9a08a2cc3921359393e14b0b0ac83c628bdd34b97131887bc947c3fc0a6d226ed3dd88aeef920d8b10c7fef994ece3920e6e80644084619f9e21be3243543e7a1bb4e72a7236f593ef694fffcbec7da8f32261e2494ddca7e711425e2a269bcaa2c231e6cc014c91c00f49301431102b1744000000002c579d4f67993a43e114b85da714d36ea13298e9588e6adcb1dfe0b34a3574296ba894d3b6cde36e5083684a623b57d26ade4ff90bbca8ddc84af1ff93ece34 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D39CBB61-4056-11EF-B6F1-C644C3EA32BD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426954580" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2092 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2092 iexplore.exe 2092 iexplore.exe 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2292 2092 iexplore.exe 30 PID 2092 wrote to memory of 2292 2092 iexplore.exe 30 PID 2092 wrote to memory of 2292 2092 iexplore.exe 30 PID 2092 wrote to memory of 2292 2092 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3da7e2af468f23b5caa4594ca44ffc02_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537635efae9ee0660533e6b5be845b9a6
SHA1118f1dd686f47b097aba6554bce1d1e649c1e05f
SHA256b74525661c7cbe336f753e27bcb6dcdf28bcb3b12d18cdffa6d5bec8c31b0afc
SHA512bd755e9debf82678f362ca9465abcc4f4cfdfbc533e9e275fd1d55df8cface833c675ea7fbe4c37ade2adc26182dd025f83a8c5553821e09b4e29ccb8bdccc07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56779f0c1a0e74c14b030043ab07025a8
SHA178141906322b2dbec72fa9cf0d6052672ba6c065
SHA256b20a5de6d9e926decb69db087c7fa880816c9282e396458c33910089438b4aaf
SHA512933f66398844279bacbf40bf04f2f76d0f12200ca11062728d16617a0093c358dfcbf8f42cad9a2482dce28fb008ab0eb9003d2011f6d3392bf16d153537fcb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554d241bd9cc861f8c8d1235ea4b665a6
SHA106579147cd3c45d8295a7af2e371529173ac85fe
SHA2561ef37161576403aed59106c7658488219d0e254b557edebc9091b647f0f68a49
SHA51246493a428404d06fa8c610c58ae8f78c3d7ba43fce2f6c837c8c07c52d7f4b5216869a721b59b114c68eb440918cfa6bde04f3cae4d9cee597fcde1cac1a3cfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575808e0a971d936224dcb3d0bae5aa11
SHA1741941c62b5830b73ddd0053260c21a518bddf35
SHA256a72b1eba7be87097c31b93563ea3a751fee0238d174ab20f68a568c8e20cef88
SHA512539db19b552177ece4de45fa77f86c8aca1cdfcd427eee8c56c23f4f80533ac039221e7fe9d49900673f12830112380442e7faeee148b9358d91aa83ee97d83d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549046cf911816633f1e620c4f67f304d
SHA11424107f8c1c2143cc602590a844141bc5b306cd
SHA256a5fd6c81275694622569b853b9096df95305df7b4272f64b8a80ca18e967c9c7
SHA512dbf5ae538381c90f87c6591505f95c2b937b3612967172c3968bc7e0b48ccf814d93b7500dde3d755d714a60ad3d27a05503e64f1295b30ef07392ad90afd15a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bc268aecb1660194a9e6a76a5635957
SHA18da036123bc6e3d5d3a66a1f9b70c528852feb41
SHA2567694ef0484789a040e48f11a672da27aec85fb724019fc9099e996f99fde7eee
SHA512e28e42b9af4074152e8d711d13f62c71c89e5052a757cd69a6b7da8b7481dff03a810e82cc262b19d15f2d450df10c0ae94183be8385ca529efedbb71a1f0fd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5283466eb9932d570eca57cefb7a13912
SHA1070135aa61c45d6b7904dab8d84c08ecc0a176f4
SHA25610f194242e04f126777b97f9a1f7ce4616faaf8298363ef475f1a2fc6fbab51c
SHA51230e4a6a781af3f62b7df10d5246bcf358e9a176122c36f56b806670c26aeb74911a1c9f7bd9dc7b63b3e94fc30635b92c943b813786480174a0dd6212af914f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57401251b38a07196f6b2df2fb41b50f3
SHA1a42157917ff4f8bf0ba738dd4faed2eb1194f763
SHA2566d8f857bf97dc1fe7fb6cc6a5ee079014604b4228c46d8338db9aaaac1844992
SHA5125602487d6166bb51ba3eb9740d14a83d2deae48dc030e93f326e60571ad595ed833130ea03594fc6905374d431d472e1298fd65446e83c2a8301d9e6f58f7594
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f2c17e2538dd31e4fe7b0c6a114ac4e
SHA1ab4c40a0c25736d1af5ce85e0ed232498e91b1f6
SHA2562137f1d53616154d3f026b6bd94eccb45c7ac5df86cfd279e06b72460c165471
SHA512b8a97752fe2465c1d32e05e05157a26061a383e10e861b102e7e3c4726e87d1f315399f09592ce7890b8555a8762074200c749250ee729c6a11faaa24f70e93c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5792df27888bc74fe7c3d752b03a6c429
SHA18c7564167a8d8f4db36e8e42223764962fac7ade
SHA256db71a4278602c5ccb28eedf8d32417b48344e98a5968c90eba65d3ee89ea1b50
SHA5123543c6a832bce931c67e19cc860b28b427e6f41bf5481de69e490f57b98b12fd710a0c65af4170fd098ed4b3b34869ecdd83650dae451657c6e0eeba5223be09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59505e5a14d7db1dbe61d1e3f2cc6c618
SHA160771853cada4cb131a1260b23285b5f8fbccb15
SHA2563f1c866c24f14685c6dc57eda0fe1a559bf7f2de83ba0c0e7173432ce5e698fb
SHA512d9235506915641ed3a85531830d5bde49b28c12139e0564a173bd54792b9a6ce1864c0a318f06246915624e9fe040b8fe8b8987e9ae2ab7766c16616b84590ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51253385c66556cd1ec37680e80dfeda4
SHA145ad0cc5615144776f8d807a39478e70b3704071
SHA25626c73725501cc283a2c00dc36b9998b211a74e0fdbf9143c68dd5491c49f2238
SHA512777004514c57c5e3277b39e1d02e159cd40f1e14ba45f38f7880e6beff59413967aef63ef57bbfcf09948b4acf9c018a5a3264b663da49023beb51ce7de42245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59acbd82c8b1eff4fe6c663eb8856db03
SHA15bda02ede11d10fa12c422731ec146187956abf1
SHA25663bc994d71a226bf665bf35c6f41438cf984ab50b6dc6fb2a76adbc64fa16478
SHA512e20c9c2cbd758fc948de81d0b85430916ad047c5cf0cf3fdea93aadf3400eb63a4206a55ae4acd428ad60d4ffe902a79269cde99c18a7049a3e750ec5e086eda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dd0f1be4d5ec0b7c74aa22f45e1b0c0
SHA197f526cdc48dbd0c5b54ec6e2869301b92e44b0a
SHA2563a2bfdb6f7f2e96a00193955329f80d9d8662e907e5815b395eabe073726f840
SHA51200b6c065b49454817294585ecac80df0f5f388de0372aa47af8b50b42e76f48f64602070a6d94d60bb38f9e307b402620d5a857cb3ea5bd7edaec5193a01c8f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c587cc41de3e860d6f6a1bde08db648
SHA13bb9addb065cf6afc9fe53974d460b0b62a3e0c8
SHA256e3ec89ff4d7f9bcf78182c73f70b720b288f43de15ec527ba922a74911eee6d1
SHA512bf01b82d78957a4f5230ae507f8326444d4e9ce30b831b0f0783d9f35735710176cc833540ce5ca1dde3a245806aba37e90c4ebf79d764a1c621c7acfc5e9d0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500878decec11dd4236172182221c260a
SHA169153ebcd6bf726a4fb1c4ddcd51b796c4b239c8
SHA25636beb01b20926b864cbc75ad959bd9adf89b7f2ff1ff955eeed1f8707a9f33b5
SHA512691e2ef95b5d8fec01171b32cfc01e68a1613966b9683119dea2c1fe171b02847a014f5463fa0f4b345aa92f96822dec1bd4615e877c6d930efcdb0bfef98fe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dd2acff224c345be5bb2acf182e4e2b
SHA1370199f8cece3ce19eedeef2c97b383f6dd4c2e1
SHA256ec81cd249eea6ee71901168145aaf07d21198526de3804ce79d66c2feb0a2621
SHA512a524584878a3c0abac17ebdc62965188e90123ce0d3bc355ab236e3bff92de9ccfa1f30622116a20304fa4227af84a8b3d7365704950427ec7e346754958b0ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563b0c25239b46ef52be4e7e7aa504aa7
SHA1e98de5729ebe5f57ca5f89f15748e64eaef205ca
SHA256a311199bf7b42487b54715ab8ab011802cabf0ea41b7a393e8f8864badf69673
SHA5123e26631a11dedc2363aebfd75da9e69e8d68c36c6143a2d7de6b3be62fb924a526e340525b521ca164634262a4aeb059eb40c39e1d853f63a6344ae443778745
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58eb511a9f3a2f1e2309409075a4a58c6
SHA152be01f14d473bd1eeea728182d5e754004f6c4d
SHA256bafafb5e9d32ccc8723f8558a15af77a1d3f9e46598872bc06a8c678fd145b2b
SHA51241277a036c1e02bcf130d05bb9d0d03a26953986b7d5cdc3b02e54d367ebe5d746e9ed65320fba611c76952fc627adc7f33dad42670b96705a82dcf2539899f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589b42cf62bcdc9c839f151a599830633
SHA1e460debca38bf0a35dbeb54a16145db8c1ef5c12
SHA256ac88194234f3a96e86aaa0a15f85872c989de7d2a6a8edb58f5033aacba753d0
SHA51251d3b4c1908766b8879e6adbcd7fcf07f93c6b3ba2f4a87220706efaaebe36423498b2a9bca17a9b3fcbd9437e65975c97eab796d772e7870be5b9b5ebf799ab
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b