Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
66s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 02:13
Static task
static1
Behavioral task
behavioral1
Sample
47c9e64f98c3a1be5f2cbeb0f8a468b6_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
47c9e64f98c3a1be5f2cbeb0f8a468b6_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
47c9e64f98c3a1be5f2cbeb0f8a468b6_JaffaCakes118.html
-
Size
6KB
-
MD5
47c9e64f98c3a1be5f2cbeb0f8a468b6
-
SHA1
cd13f83e76e1f076e2b97e433880d7a6b1cdeafb
-
SHA256
935833a8e9e3238781af00d96db2ca7a2ea848a301596c2c9491b0b9fe2d1acb
-
SHA512
a9cfe058079647563ea9b1430c58cea24fc5caa640a312f43005c6930e7c0bfb30c09f9b491253ea56e78bc20eff1f8f4559b2d39e452a8bce2fcbc00cf3b217
-
SSDEEP
96:uzVs+ux7NyLLY1k9o84d12ef7CSTU8ZcEZ7ru7f:csz7NyAYS/zb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000006a5877587cf5fbdd6b9aed4b49ad77958fad582756f015382a30fb42c3d35f8e000000000e8000000002000020000000bc7180ba3f9c905fcf9a0933da5aadabccb0f63e33ed16e85f9cdada8218bb6490000000274e425c08395c4941888df45ef7389adde1c582d2dd2606490d531909a47cc296dc2f03cc98fb26d92444f29bec7ee683b0c2cdc3b041822d5078997c20ec580d20f1c81b06aa214089e086b3b72b4838351329c787f994e4ab6fb46206894bd7d2726d5bf248123d058ba703cd4282a7e19999e099921f5ddf74b207b69096e27bb21602d463cbd376a5e7ff5ef59c40000000b8689a8598c9a84539df26dde19dd9dd0368b434218554d392aa20db01785ee467ef0b62d2968243c8eb62fa4fac7856033dcd070b445ad6eb5a9ef4afd4273f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000888a86d9ba64c03d7e46557891972c6e53dbe1c586a1ccfe7dd2163ddb14cd09000000000e80000000020000200000003726cc076db127774dce4b4159726fd68e41983ae05a08346de44da5a8f2c9ff20000000360f84e9930d30c873a000b0d70f0093522098786d83bb438589d74c936682b5400000008d664b11f49aed1cb48e524a37f5760dfb253368f3aacc9b1ef01c3f93d0c939008b5489670e657fc429c5181b5cebbe59320c3b229bfdc62b3fce17de8bf73f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70deaa9c5cd6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7BDD861-424F-11EF-96C0-CE397B957442} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427171456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1652 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1652 iexplore.exe 1652 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2080 1652 iexplore.exe 30 PID 1652 wrote to memory of 2080 1652 iexplore.exe 30 PID 1652 wrote to memory of 2080 1652 iexplore.exe 30 PID 1652 wrote to memory of 2080 1652 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47c9e64f98c3a1be5f2cbeb0f8a468b6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e65a73d1b6c8cf2d6e20de61e56f8a1
SHA1ea42226db4fe69bc34174a9c3014f6a7424d5678
SHA2564c9b15d58933fe1b53b4bfc04ceeb148e7bb58617a6cd93f0b6483b121a3e8cc
SHA51285c4790c1933995bba80a83ae5056445c68a66693e297002cf16333914e9e415abfc39d73d82bd9658d26271cde5b5ab3601d3881405b5d3d8bc112f0987f9db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a3774948715db9150de88d6f560f67a
SHA1d0754353d6ef48a12ebb515f0dac77a067df9558
SHA25676a45060f5af54cfdf0dcdc1c65d8279e940cbfc2eefd7bcf8ea7c33fbe03899
SHA512bebd5899773e2b00d14b0f4fffe6644f3094ad2ce462a68b47c349cd4bc39e968b09e71a407e2810a6ccbdf13ccf5b2466d18ba3d1693cf1e4ab558d083b6231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c07c1a1af7cf97e138fe22388584e0a2
SHA183cde0d1c2659698e8b944f9cf2d168b902834f1
SHA256012e5f3bb0f263c05b4dc82ce8660f9a58826007bda97b61972b733b17d53d01
SHA5123a3c9cab5903912d334ed88e107429a00c9ddcd67f395f0f93655c7f198efe8da8b80ed336b1583e3259481bcb3405a00579427b39a4160fa1cf803885af9a38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c89701926c082081af0087286109bc47
SHA1ebc7ed9959d37c68d59195f688d93856f0e8aaec
SHA2568db37508390789d7676d75b61a4318da2a94de7ac27579a75be17c9e274a51ce
SHA512bf6190073b3cb5a1cb88a71f2aef96f2adaa392e7a64c8420c0c179caa9baf71303766e879d143c371436d726ab5de1eb7b1b0b6a980ac4501fabae0125f4e7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d8cc22a4c93158cd029430be9550e8c
SHA13c7e3549fc6209af40f1ed7e73f7e9a8210e3114
SHA25689cce794a1ae6e74e1ed0f45173fbd6f9eb5336489e447ecc90ec40ba682ec6d
SHA51257f3b42ea06ac32e9e7986d0b51edfbbda1d96f3031dcd2d77a693356c1dd6c5d9ee53c86413c9546dbf9e8505f08b74322d205733812696063867d2c1226122
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e3aa649e8dd7d2f49a0c82fbcd74adb
SHA1dd43abc889fde1e160e8bbb3bf024150ba80f491
SHA256bf9c3c3ed011d01cde230281d51f9cb30156c4ede25a80c147fbdb562b5ef847
SHA5127e88bf3bca714adbd3bf62a1bec4a09c53a53c35e339f988b730180310afc26a8549adf6dc060d5aafeab6f91409207ab552049dc09b245f1ff96c2a91340b22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58683b11b943a28c53e373fb6df463126
SHA10562ceec683317483212036b0ab4696805205fb9
SHA25693eef9a221e1414bf9cbe5ead93c38c3bf0f1a6670462d72d4a8e847e42111c9
SHA5120b6062c445bc6af94d094a0a881be7d7b01312946ea9f77f56917aedecd818aa7362b467417e76339accd0e8992149338592bc0c9841e3d3394e460b789ee8ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d3b0cc000a3bea3c0e39c110f321dee
SHA103e82c51d6c4c025a98fb3b589b55976f448b4c6
SHA256fe177a363a8f367560296840b7d3d88476e87e968fa24dabc1e3b8205b777dae
SHA5121833303d56a5c3d3cf478b7b167ecdebd1915baaef0840c09a4d2b2790e4e215a5fc118fa80a1f2563b84d401df8671db797539fd9428a1df247e38f8ae98dea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5567aad0be9f605d8e40d56162fc0f411
SHA174b87981f48834b4902d574a447f61829346356b
SHA2567d415b060729ba86004dfd92b07e83fd0d7eb8360b9d6149d9dd967ccc3e4f1c
SHA51204d1a03eefbc3c7692adbf0d8839f6673d16c9cb72a6a8ce2ba10b8033d1cb65ee596dc4fc2bcae6922a146a74196c7b462b428f2021446d4dbb6cd4516968a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9e7a3f0fcd9a767bae48872e3d1084e
SHA19004fef0d59a172f510181001b411f9db4686f28
SHA256dcb97b57d806211444af4375bdbb27980c2ca835fea826e83b4f87a06b57af5c
SHA5127c6297c1c9e85ef070f81fcb5c5d4508162f1f67d4117ef5f9e6106bdace082d0fee0dece0b73fcef9734b81fdcb99266dc4874aec1c841f41decb4b67994070
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b8b9af75c25212284c3ecd2068a7169
SHA111d320c946d1e7aa2f84cb78437b9da226682b2b
SHA25657e17c094a8bd3397a3df03ba5e28f21cfb5925a94d02b541c4f9852041536cb
SHA512325401284e050e61748362c30c69f107d6d77c7eb9c14bdcd5f7a667847cb093584655fdcf685b0cbe9be03a7132c71dfcfaaf9c8fdde76ee79fa8cafe91fc0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514d41ad628f2a8dae7abdf33b89f8dea
SHA1381fab4fc263d4519b9b361c2ece7d9c7be8652e
SHA256eae042bf50c0016a2f17549d3939741a488c737f5e702d2e225feac9b9af5098
SHA5129f7cf8c9b37aefe94038d65c2e8d4d62e571420b84e8a77861fb4fa71e731ced2435ece6041fc325cbb4ddbdc1a14619702b94bc3cc0a929e0eee5a59a0dd31b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b9cc5dcf2a5cf932e4a9ff18e829607
SHA1753952546366eb29c11e048443acbc6242497754
SHA256195f2235607960ffa6adbd6f24e9be150c1a9970cd1860e424376597a40f9c43
SHA512e364b2f47616d03278a792772e09588c872f0dbba39df3ad0dacaee01e224615b4af9066959d7c211162d075d724e8b81ad76d10e6878b1f44fdabc39cf15702
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b01c0ef7190e81b921b9b88279a6cca3
SHA1f25d00138e807d50896f03f7f941ef4f2230f765
SHA256f4cfc4c0d33782ef5891fbfe35c30bb7f4eb100b3acd746855a45baf4179f7d5
SHA5127508f2aa336470260f422946390c8fc0bd64efee75b338f40d050b995d0b70c7e7f194f8aae05c4e4a66ea7c1cdf7343fbd3164773bcad6a17d25d504e9750db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3937a97007bf607a9fd360dd1758ccb
SHA1e2ea8130069cd1445d73d19f12d226f1b66c69c4
SHA256679f73ede741b3138572fb41f64d4564033f3c223a9c4a491c628e84242d9068
SHA51256ffebd554a2b195c1628a9c73185e46cdf9f0e7f26c6b545072ebb8627d15e50492e8333342af73b3b8ad949371270c74bb9bca1fb5f46a9cf33dde9e1e53fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6aa93708c485527595831438731fac2
SHA1dbb81b8f29593cb85770f412bb40cdcaf82e1e19
SHA25635ccef9b79de58d846479db67369101db3901d56216feb8d8021a476b49be283
SHA5123301b49da35e76963951cf73854ada2ca0ea6453805bde5f0b946f523075477a2de5bf78a38a2b5f674bbdb47d1819130e4e2e7971b35b2e72d6f759f066f8ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bb9ed8b7449d033e923af327a5f5e4e
SHA14592e5ad79adcdc2490ea1fb979015db17ab643b
SHA256d2450776be6d4adc881dec38e76286f85750d99af52ce916f40bb8df5663064e
SHA51251980c8affa7730e0c073f99e8d5255834ca524f977495cdd03b9131a93c39fb0aecd1baa482d07795b0d6494f1959a41e2975fcfe4c23ad97dcc36bdba2df7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c02c17b2584dd8c1d5562a9a8fdce5ba
SHA1041ea063e20ebc656be10192664a8e1ad22b67e2
SHA256dfeca9d1b042c229314250d1b366641efcb2535ea9910b32d348ec364fb3d564
SHA5122783e346beae9d43689ebe56506f1acca53d574bc434bbb09dfe77176908ff33a0abda6a48c9f780f04098b86cf4e5ea417a79b37e73b12b638b4f9745dcf812
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548d79a1eab7288076e62a67ce0fbe92f
SHA17a1306e2590b9dd72e0a01ae4356996b654994c7
SHA256851397291b82d30414713b5927711977358b7730818fb97f6fcd65773284e2ec
SHA512a6304cf26e35346d0f858f7f790d207c844ad529305e6b2cf973ede7f4f388bf0491d94bf5c5c0c670bfbbe8367605982a3a2cbf68eccaa97fb7aa3768e0a0eb
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b