Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 16:12
Static task
static1
Behavioral task
behavioral1
Sample
468fed0f2e54b7edf1971fce1ccc4480_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
468fed0f2e54b7edf1971fce1ccc4480_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
468fed0f2e54b7edf1971fce1ccc4480_JaffaCakes118.html
-
Size
10KB
-
MD5
468fed0f2e54b7edf1971fce1ccc4480
-
SHA1
ae33f2f657faaf2d9b84a1b67684d7b430d17906
-
SHA256
d6862ce34965d458e0d4e1b0b8d00f6d577e947d7c9a803349e293e4d946c35c
-
SHA512
54e62b5216af6e5ad20be9bf5bb91140dd8bd65600b1d090ee2fc536dca7de70abe4ebc01bc196bc22190bb1a8fda5029dc5de0f1f764594c2c0e168dd0c6b34
-
SSDEEP
96:uzVs+ux7wPLLY1k9o84d12ef7CSTU3wzfym/Hl5mX1mtTBR8BqYEBV1BBBoB1aZn:csz7wPAYS/u/gaFlYqDlWN9okYBb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000ae119a2faed4b5f2cc9ff75cf61850a1ddebfcdd822d36468884c394f0798492000000000e80000000020000200000004d7037e9f5c0aae70ac8a45727772ed5e4a354d2ec553dddca378de522b5204e20000000cf9bb9d64176a8a94ddd448ec5183175f48f8881d09c43f573a3686f8a73f2e640000000a968812c49d469233e8c1dda804987be349e0ab080edf1c91d9cb379b656f173e6561e736b8ae0f25f43bc4650dd0b9169dc38f5413eddc4d4cddfc81dc790de iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427135405" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000c241d618dbe876d713ea7b5a862cdf3cbbb8bf9be29f7a14e6147c15e75700ab000000000e800000000200002000000098cbca22d30ebc5e78c32ede1e1afc01f8f5b02359e72876d7a8a6d631d0dc6b9000000020107565913936d410bcbf07a9c7ef267919c9db933314d19c220e2b32c735a7fd5c99b724476ecc34de76877baf2af72521b81cd07f244c02879d745908f094a2fcd675599805717b4a63051017de2f48c7172cb781614908dbcdf59a4ae36650bb198095178ddba88ec0d8baf7d88998dc2a943c4405296923291f3ba7c7a66e29480300ccceaf30ee40fa99ae6424400000004af7b64cf3591eba81a63f9c1509ffaed917b008ccac0b3085c9f4cd85d3373d40a74727347dd06be68ec7f6264293568b40adf8f023e085cf632f13b3d9141b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7AEB311-41FB-11EF-9168-6ED7993C8D5B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f06b35ae08d6da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2232 iexplore.exe 2232 iexplore.exe 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2420 2232 iexplore.exe 30 PID 2232 wrote to memory of 2420 2232 iexplore.exe 30 PID 2232 wrote to memory of 2420 2232 iexplore.exe 30 PID 2232 wrote to memory of 2420 2232 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\468fed0f2e54b7edf1971fce1ccc4480_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b381707a8fcbb159a247c3d4021c4dfb
SHA13a584b7960f39407c9a99ce74126b1a6efe217af
SHA256438d18b60892dfec438c871db19b204d2123bbb862a563ee1072d336ebf18148
SHA5123e830efb4c39834fefa718f9865bfcb05b950136c144bee769755d6e97b5b4089752a7d9a6841a9c41347d47e28079c69569a99198b2d55ffd4bd8569892acc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563e9a93175f35ec49e282d998077a562
SHA1c91166b9d0ef9ef2c5f600f9990e965911407dec
SHA256f63ff2a56926c86c2d1599cb564f74f1972f23fa9f55e9ba6950ccd33e23ba10
SHA512bb6c08fa0a0bf1f8e78817781f251b889ce15158be1c2769c71477e233d19af3c3a1cfe87e14023eefd5afa0eebd85b5396e611be1254cbe49518b45dbf2eeed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ccff7a6d30f3c9a6689e2146c5ee32f
SHA158c86516b22ac2cd3d6640f1e47c51e6a29860a5
SHA2567c04093062d1d9904d88a29d7492e608d6397b1e92fb12e9cec2162377143305
SHA51204c37e2998a4d87f6b42a8faf0fdcbc9c5367c3ba812cd50f3519f56581686ec56fd66ef897addf5f45691914cb8ade4ea7221df1a33fb59f1aa29fb76990640
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5816679106f60e6ec79e064aa236d21a2
SHA118560525ae0fdea5c2f2e9e5132541e664e19e8b
SHA256a21fdc7b47376fe0878acce2c52c1d216f13a704149c6c245fb0b662b2926267
SHA5129bb73fcac50cd30a9aba497f0b5f8d79bf56183e1278296601b3bc5b4c33eb68538dec3cf0d2ce1251310eb25e1965b91b738e7d0e288a6ae5107cd16c2de3c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f05496d40c673ac37e5be50d6dcf83d
SHA1a2423cb95153e9c9685d4674c2ccf67d6d29157f
SHA2561a144c087269ab42213d313c714ea5d1d0fbe15450859735100c8e1cbb5fa00e
SHA5129c760ae3f6e3bc44118b5231efb707e51286ac1c959d1eaae869ac82f03f74e5dfce1e6b3cf17ce63744092f9e8bf7de7f2b6a7d97c1a61a3cbe45c6fdf25453
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b74d7a2766eb94bf8feff123b51bf9cb
SHA1996c79f82c28056a287c1e373e03e5c877435891
SHA2566a9d911268638d0d868412e481ba8ee7f66ab19c15c527119659cef3bc1627de
SHA51293a503bfed8a5995add16b6009b65c23711cb848cb68f420c7b95f56832e7882aaf90d3484019700a38389557b4b7a90fa41170005db449e0131e741d3364c1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5970567a55ee1df1cd79de340a3673f5f
SHA153802bbc6a0de16699bb7cd7076eea469d974d97
SHA2567ac862ac66bfec129ab5c259e9210bece9497f9de59ffee0ca5bd47c4c5b53b1
SHA512babb33230d6b9b0e1c5d6aae70e97a558ef6722911e5ed2dcbaa6c9c6c3f49dd69b868a7ea2a9ea7f5d1990d6a7e3a689f21112f62e3b52c977f044455a43348
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4d0ab6b577423aeacb5e941e78cce13
SHA180d2a08b479c793e60906493bfa13668e5be9272
SHA256c1794943fee031ba50b873dee47b77eefe5f42af1ecef06ab2291de7b6e8aa51
SHA51287026046e9fa0881fb3a22e1741430a804df9ebebb89b1bf147fba307fb99e13ee553e73f0bde199f0f420da58a069e228d37ea5db3c0145414f17ab11333b52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e0a7bf20ee005e64baecbafa4414161
SHA1aa39dfb47cf7609e1833a6348ba5b8488f3e6730
SHA2565922b9bc5a50f22ba1d72edf9237602cd5cc0b03037aa468a973dc5fcaf2cd85
SHA512001e17cf24d5384b497255ead3477c9d00a4432bba12212e00561f2242f476d828f6cd0121949763f3fd7aad039570ff888085b53d8312738f353a60e65e3d61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c28ae4e8af71196da27667b39423c74a
SHA1ad36fd6b87f8bb7c209cba820b488e1eff909fd1
SHA256ee53a8a932e53415037c35435e9e614b3061744ed62a321b38f295d76af0590c
SHA512e7f7f7b461a4af1a108007009e4393a4a652e66a88b0bad83098e54c6f357d7d87773e449d57f9a839b3cf801159caea1936b87b98ace7e9f0c790a18f23c9a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5478592f75d2b3cc1f32bd56bd2c5990e
SHA1f1f1f2bb6a1c32f2c671aef2f70c112b529b5862
SHA25658917368353efeb2c9ad96c8d9feed8c3568ae0c9f3364b3877fa6d652de1100
SHA512bf676c59689855b095de16ff794b7d2a83710100cff855e94a305d4bf44afc59fc9980149e4d4a486fe87e8c5319d61121ab3caf98154d859d539448c96648ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6c7a1fc42bcb4ad980aba22682042c6
SHA15cf439a7feba514bfab139261a1d17cfd4b6a76e
SHA2564fafbd31b2b5953571b1d9c34bb032831dcb16cf53ce3ea9eed56f73577c5d92
SHA512c83fedbeb1bb65bc17f2c41292ef164b40c8dc4ba829b00a426dce984efd771dc4d42911e15cc0daced67a7c94ab2b66517f51f2a894166131341c4dc8a0c982
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e535e7c8fc1652f1c9aecec5f7041a06
SHA120a684232a9cc66438ad7b0e45068240142a1bf4
SHA256172e505fd713aa8c003c69d6bbcdc850377cc74c4efbc7466aa6eb32dbe5fc44
SHA512e20a1a29280d300485490ec853240c93970e1c187255c76b706aca61f3c2cd2078ed7805e3767b6c1ea0af33eda3d185bffc509fa474205bf2fb2fd883bce886
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4295ed45eb10672bc53ae3a63b92a6f
SHA117f40107f307b080522a91d76f9212da9e62963c
SHA2563793aba50d7e2509cc8903fa4b3cc23e077b063c92828004ef465bacb83138db
SHA51263cf10b97183a86b25a7ffce0d863f86871e6ca440cf866281f3495f4695307d1a1536bc44a219b3612271ae490b7dfe6597704daa93ff7bff213d27394cffd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc84f30740101ab1819d166c4413db13
SHA113af0b21ed6f9016a1e0c39b6cffa23243b2c2e2
SHA256e5bea556399ca5af6cb1cce63cc31fe8a980a6e49eba8d6cefa30d2d039c8aaa
SHA5128a99a06283d30110892b37510eb9163052890d8a630f1cbcf669cad53a1000e84e53d9c3147e6a337569e7226e90d2bea1a44e312d4646b52dcce3b78454608e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e93b2dc44ddecca898dff72e22b46de4
SHA1e52ca62dd45e21b62402bf608b45f3f86a30ccb5
SHA2565040eb1d0de036132ea95901bd60006465f8ceb6f52614c2a3b1442688113cf9
SHA5120ac5029cb00d3d7edf256c3d4a7f0ae80cc286f9e102f8a28176e58b78139e756ffc3361cb9e29d90135ad601b497956144c4e1b934d3524bed6f48c05a118d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5048f7fcf6b461959e531dacadb1a8fbd
SHA11aaf085a6014ff4c0285e03573b635764bb94620
SHA256196ef54c317283cd97654fc59fd90bbc251b57bf016614c95df9f42d2e9b373a
SHA5127a29864b5923d8f8cd3aec097302e7af1818545562f39191625177d65b722a8a898d974ee7ce7f6c89f4311bdede348f345799d0d7aeb523e13646647628d2d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7869ba99b2359780104a553c3a3cb45
SHA14327f0d71bedee837bc89644fdee7e9fa10e1f31
SHA256f7bfcce2f3ee319dd94448d18959819f7ba65dc31b7bdf7f93ab7a2336ed9595
SHA512dcb64665b3901d30a2245b8a1c181c5543b713142c43d6a0ed76cdd98df33fa43aaa6a9bff982f604a75738c830c19c0b450b5adbe4bbd82526b03b1fdc2b726
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad8e3c64522f8f608aaef19d95cde18a
SHA1fdc50692c900bbe51b8a8b1af2f83dba40411710
SHA2563db08dd6109ea7c21ba06437f66f00636155db2864656a52089656afd8b80125
SHA512e511ffb9bbf8fe56492ccc7ac5ee82c61bc39da0501a4530f80d479dc36e6a90bd1a8bbad864cda6a523aad9be406eb08812b15abe69e206352a992fc4473d34
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b