Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 19:50
Static task
static1
Behavioral task
behavioral1
Sample
3ea7cea3a5884d1d97a7d36d1264e911_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3ea7cea3a5884d1d97a7d36d1264e911_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3ea7cea3a5884d1d97a7d36d1264e911_JaffaCakes118.html
-
Size
2KB
-
MD5
3ea7cea3a5884d1d97a7d36d1264e911
-
SHA1
92e6e88ce8faa5490ace4744e173d2c4d8205c7c
-
SHA256
cd63c81341dfe00f5e9d3eb47f5ecee177bc30fc00dd17467a4349ac95b63526
-
SHA512
5138953564e7bc8813b07f618b0e1a6f09b507c3267c4754645c29b48570d4108e801d648f88e4f76f6c338c49c33516e8237e532c00d503fdd73fa4ce0d8231
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F563A6B1-4087-11EF-B49E-DEC97E11E4FF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d3a7cc94d4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000004e98b795b89e0e2c65ece5b824b9fcf12578dacf5380b79bdb4577330f1752cd000000000e800000000200002000000049ece08d077de18387a4d74ac75ce4249c74a013fa6853e2e7604c99dfac037590000000baff3a255c99db9176cef7f46ca1621834d6f6d9855cd43a8a98ea2ee7cc8a20ea495c66ef21f0e98b6aa89a6bbedc3c092fb92fe4e69ebe977c9b3fe5d8110f76536fbccee338ffa1d0ce938f98fc0bcb2f5f2e3dfcd94f89ca583aeed508dcac4cc7531a833769f58194b4bca019804cca6e7dd1871285829976f21ea614a27d8560b1da4ed9ec73e9af0df604687740000000039f428bcc6ec1a6ffb0032440cd4fd4037607706f0bb69a65f1e2864c177d624b1c6020f1fd33a2ebf27df31fc1da3caeec32f554e60038a29ecba0ca4149de iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426975682" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000ba7c3a148f0f8e08dfe3640f6148709c2ecd38526396123b9f2a032817a248e3000000000e80000000020000200000009559350ef852097a57540cc55dd880844cc1b5e2223799c4edd414ea003c15a72000000010622ad76ccc8f729b43574cf333b54dcff2eccefda2a78b9a3933a486b6b59d400000004985ea5b7a69b57d21416ffde7b2722560e370458de097f115f78d639080b55943e44b9d64c2add090cf54fd76253579df278ebb903e3e6d126919525c68150a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2688 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2688 iexplore.exe 2688 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2696 2688 iexplore.exe 30 PID 2688 wrote to memory of 2696 2688 iexplore.exe 30 PID 2688 wrote to memory of 2696 2688 iexplore.exe 30 PID 2688 wrote to memory of 2696 2688 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ea7cea3a5884d1d97a7d36d1264e911_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bd11273667e5dd5b06ea145edaf3e66
SHA14c037e252ebdec09c4e34112c6673f75ffb9e392
SHA256f201196df48a3d2940fa24e86e8fa2dc3d7c1095e562709ea2b9b90819d365dc
SHA51244d0169aa2a0c99d5b3dc44f713a8166e94a88048258c3b40a6ca6dc209c26a02ffcbbf131766420e1e21945bcee798c20abe8fc4f2ccf648243a46683eba3a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5664af1ec60857cc16d394e07ea519af5
SHA1e44f829cd772f34fac75f2ef7dc7a907784b7aff
SHA256939ee03c617d17532f9af0710d3e8554146515418b100aaa682393cba6cf0f43
SHA51246fb4c59e4224eb8ea3636b98a54ae5eef8f451cceb37c2259742edaab888e383e646b36ac8feefda9ebd06207113ba73e6a176cf1b2ec1ae2fa139a9b515b09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bca104af185b56cc70947bb6d834c5ee
SHA1d23dfe3eb098aa1ef6cc317a9522cbeb78c1eea4
SHA2567a009b8d284589baac157e7e18481bb61568b4e8cd993ef6905995e5021a943a
SHA51253401161f510e477c6d4bfcd62ab082101bd9c3ebe059aa18b5b338e226c37a8fc72230db76c9964f1d0b55b6c140021b2771bdaa306b60ac68cef3471df7192
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4db5628fb5fd5a06539f7c6aa214207
SHA1cff1332d71bc3e45c67f7bd6d2d3fa24cc8b3009
SHA2560d79d8f2cc8ab8578fcacdf23939f362d5803cc6cacaa6560f94ec97594c5457
SHA5123f93f2e06875ff055e269c2bd2ec4f41c79401d8f81861804708159b86340d3db76a866c5ed263a7f2c39b78b172fd5ecc3a2819e3b47601bfcd9d4ac2582d50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588e66697f13ecd3e1ea4f2bf992593a7
SHA1d1f6357348d8ef39b28aa8e370bdc454e017aed5
SHA25638b1ea3f0ecec10ea3c4be3f5b7a33191c31e1a7731d099a8d94a7c3b6b70a33
SHA512f5b8d9de1dabde1e8d79af0581f735aad2fa23126b27fe913ea93da71fdad03f88622e7d7563680f93e3a2aaf626018e298c718d63fb46d001cd09bac3bd3692
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c2daf687469b989603b3adff6f12c41
SHA1f2a795be2a68f0fa93258c628fbf2f7a32692f68
SHA2566db469600749efe44aadbed7aeae7ccc51f7deeaac9fe034663bbfc2dee2881c
SHA512bc3ceaaab921c455471320995af1ce0a8ede01b084cdc9c9f9052aedf9a4e3143e2964eec389c19bf9336ed35625a2bdf6c5e1a9bf6ac9863d66c27b6a1c8728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5787c7a6ccb6abe7d0f678d447e6cccc4
SHA12201c6f791b415066500d15c1e0ecef593cf7fa3
SHA256f68475602e53439b1cfa81944093815c1969e01cacc51c48ab28b32f09e9f40e
SHA5128fa2ba2d27c43136efd041217b22498f2c0d314ded3b6ed44b02150dbdce943ccaa089c01db224ecb2d99a593c56d2d2bfa9262541d4deb4d3599491a7d8adb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d0171b20c51ece2eae68a626096cccd
SHA1a66c9badd95b3e7d6e40e27b18415e07f435c95e
SHA2562f24d6614b5b141d590b71f2616928dcb772ebe43486d30d6d4e26cd169f15e9
SHA5127bf95c30ef86ed591b92c780eefc353306335e56936337d8cc5096a22161c6029ed5c3479e3caf920e9d8959f5bec80b32ed52b9cc8ca671ea7e6a1bf526efac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50afffa444ebc58b0639e667402e10c7c
SHA14dd3179d6648173cc126fb775d71ca934b017a6d
SHA2564d19758d1ca23066cc0f9a8f67b74621a7f4ee690bbfd2e8d251f50630a618f6
SHA5128f945c993de6b4baa0d8a97d9deb29e9e2df71fd7ba2725cd35ff44f8136e33e925e59d654925372905dbc2e42f2801e58f4fdd6411706a0f5bc21a6c378b848
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58518f97bb7c21abb44b5034a42a25667
SHA1e8176beb0ced4a4f52b1459a47583ec316e5b2a8
SHA256960d7de66e4bc8890e0dce374256708b0a9daf0c00b6eddcdbef7a0ab26abf63
SHA5123449fa89a324871696b17b3512ec25f48631f5bdd361113cb625102365a28a29c9b45e839399957700c884dab5bef0647d8ea4cd68753bd86c52ccd71b6b604a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6cae55b15c40ee9eb569e6c8360745f
SHA1f0988ecc45cd7f8d4ab253df1bc6d8a5753288d6
SHA25603cb76aee1289502e7e99e3d3b6ab875fde44352e22571f9bbd09cfa05429776
SHA51204ce0af4f87801f2951366e5be1f6973a137329ad70c6bc4c7b0aef6d6648f87e0b249d5425626b12b56b9a495d45facf219fa62086e59e7a9ccf9d9ffeff955
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502403d57d16c460bb6a84bb53c256a46
SHA1f3554bce7f7223c3dd341dff4bf10b882e054332
SHA2561d0e35d5187737cebd0bdd9694a469e7e300d403f92e68a3dc59af543469fef8
SHA51218582b381be5b1ccd32679ccbb5f0fb879e0d24c25ce5ec1710b677e08171d06a02df4e93b067d2a8eb8f481062513087a627817f1ec7e37c6d337320d6b611d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b1a3a7b149993d63de06d1c77e509cf
SHA1f9ff2baabb07e44c1582c715d172c0910b5e4183
SHA256f91ae2e7c492be974f38e969a067d789db4462b5b8e5d106b3fa101e467a3075
SHA512cf7982bc7455cc696a3a8e6686610c46eb49599d2546141c27bd271772efc61fbccdab2dc1b52cd1e2ff6b3fc8b6688155307f761a173983a7eb4619f388253d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57deeeed37a26f1f120aad446d046e20e
SHA112061fbe7e971598b68f1f566c46a8cf8c297d4e
SHA2560bafb1da8a16729c278e16dcdf4d99d0a757ccdadc431da4586e4e1c3d89d810
SHA51274b6835b7a84afe016272ca8ea82d8d0c92fe6dec49ae87198146e7a5f7ce5b6d651f1307f853081ceef912b22717dba79d9fb6cd6c393d7d58d4597a73a6427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb7fb6107ca31900d4816d23781cef47
SHA1b383f07d74371b82915ebc719fedf90c528a6f9f
SHA2565f72a2a1d684fbda5db8bbbee98b44eece2b878baf6d3233492f17b67e526722
SHA5125f9b9cb2825f5672ae6d21932da2fcdd838bbdac07901af6ae7c4b84eebd26c81fc0ecfd75ca2ceb55b05ffea1e198545996062bb4e00f2e423323cb195f0062
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8084fcf179b832b793683f815abe5b6
SHA1bd5a87449a7f08f7a5ee5470d8da41af56b0a1ca
SHA2563cbb3ea5511e0fef0fd15e153a2f9d847b7353ab49650699c4fa41c006a46270
SHA5123adcd2e83ab6806b80a7d88d3276c75a28d088dc8dac3d8cddc3e401ce1322e2e1e0870cfb6fcfdd502a33bf40bbf66a8ace4f31954681d5b44b1e0fd201cb46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5065e3d01c56f4357949fa7f07851a3f6
SHA16c8636d61f9c175b788da13781981526a6f3671c
SHA25646ec7dc378e0c8104235784e5d1a49cb66a6a09c439964ad661013de2fd39c48
SHA512296f8b72f72c6d2a86033d70a84162bb7eb9f4faf5bd6fdcbd196a271e1735901a00b791c6706e30ed75c5f0cf1ecbb79bf427a8ef663d1503e3d799964f1560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554e3d88ef9988a49c5da168c60159ad9
SHA1f4f4a8d9e5fc7c896b17c307d8eeb646cc63e535
SHA256fbd11180a5c624b226ed92c1eb4a2538db80c8761706a386d1f2f45fc038fcee
SHA51201a8d51bbd79b96fced676edf0adb03beb79070bc897e27075ebe7ec63102a988626bbb108f629b54afac18c4fdcd0ca379b2f17ca2d41342aba3ca0c23fdbc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5677846dabaa22b69d32737a89e04599c
SHA10c6d3b60c421a74b2602166b0ec361ef8123f9b7
SHA256e4e6830785d77552c6d76356ac489499bc2366025828b34222bb2716458f6683
SHA5128aba4734a03aa95b7b1bab6eba08ae295d28f0f268ad7bcdf674ae943e479a13557fc9b9283bc0c623e9df61ee250e5c027ac40521d9d13817a210fce22160b2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b