Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
4ad852a24b32a9084c628988b81ef570_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4ad852a24b32a9084c628988b81ef570_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4ad852a24b32a9084c628988b81ef570_JaffaCakes118.html
-
Size
58KB
-
MD5
4ad852a24b32a9084c628988b81ef570
-
SHA1
af45c186e19f56cc4c6e8436b1a2926d7ab4218b
-
SHA256
d2dff2fe7be7fc2fb4e73053e00b99d74ef3991803997ea505ef4c5138fda705
-
SHA512
53bd290c670c23dd58a4daab133dc662d35832d774fb2aeaa42153e94a04954c89afd00845cf869e152810796022217c9819b448b02cd195a13737538662249f
-
SSDEEP
1536:gQZBCCOdL0IxCbP/FfiflflfVf0fEfJXfwf6fefIfVfQfvfhfPfbfbfPf3fFfZfl:gk2h0IxAadtd8MBXIi2QtYXpXzzn/NBt
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427229332" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000cd7c83951e91378592dd380c6ad7d2176c74622fed732c8e0ecbdf8ee4de6512000000000e8000000002000020000000706a0274861819bef5205d18b274684b6aac8d6e0d6b624ea1ad02b571c0315c20000000b01f7e7328c907205021a577171650719ab16bd878747617d3433db1d67d3e11400000008ecc9d1006d9cac0f1ab58fa6670e4d7b0aef84c7a14ff5ccd1041b38d892aa040ef08a6a139fa494cb321f96e059ff09e2925212581be8ac2d6528186cd26fe iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40db205fe3d6da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000004d9448fe0a6625e5925798efe7210fe3a73475512928ec01ab6b52a0a5947900000000000e8000000002000020000000710226be28887f29fd1801d0b13384e0952b27298b15ea11031bc94621beb125900000005c9316de5d66872f03b876988dec8494355dcd1785ffa8cb13ed412bded93be5c441f623b36e6b80ff01a498625f07da0e2d0797e2bc63511ab1f961518278322fd82cd27463b5721b743dc67a0dafec6d2b9220be4446a690e9dd610ace3a80b33918131ee2167d8a8c07857659fbc0e4d6775dadd27abbd2197c97b48d82f23cbbc665c5b9838c6142fd102364d33040000000e2d15d2edb148ae3674f6f8dba5ab2acae35971f6e917f940387c966cd0a4070e7a80a7217f4efeae7a4c89cfdee713d1bea1138f1c3b9f9fa862f6fbc7f2d4d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87F55EB1-42D6-11EF-AC2A-E6BAD4272658} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2412 2184 iexplore.exe 30 PID 2184 wrote to memory of 2412 2184 iexplore.exe 30 PID 2184 wrote to memory of 2412 2184 iexplore.exe 30 PID 2184 wrote to memory of 2412 2184 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ad852a24b32a9084c628988b81ef570_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ea9fac16f7bba44f528c881dca19cd9
SHA15829ed5718ed0dee9f420e5e786831c1e891027c
SHA256999fbe349d8e859345b972209632ca7af4472f0da04506c645d4c1375fbf996e
SHA5120c8d2a167a3f4874a7c008dc754fe52446cff9248ee32f2eb7271301bc405297040686df7b8cdcaf504e05dfd83765b3ffa6074a6d307ce84499671bc582d01d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5400111be8c2a5cf23ffd1c6fd5432a21
SHA15abcf8554e3b396757ba184fd110a4a73a2d65fd
SHA25685ab0df2585573c89024f0be433508fe87339d1a677de490834209ae0c381507
SHA512a8393e6442b1112f0a40ee268cc2b3773178924592577552d48aaeb26954da36468d3ba1c6d0f28c124b5e4aebf4e57c3588b2eccc334c50da4155953400efe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512f85f885031e7d838c7e9c6ab3edb7d
SHA1c7ad09bd6cc028f0b6abbf3265cfa19b6a154cd5
SHA256063f4ada72b19c99c81c9ccf4c9a390a23de7a93832239906f4850605afe6ee2
SHA512f32f368110e658b36f6d6fb7252a827442e9fad81670a37aed38fc60215b9c851af29b8b11b6003e2040c9602503ae34e8403c60445508636cd46e95b0624d23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c17cd5d54a3061dd040b1fc17593e32
SHA14ec847ccd1e004eb6553b0f91542c11887eaa0bf
SHA256131da3fd961cc4da652deefb1b2ade5ce164f188ee9f657af9b453a69f5d1d34
SHA5127282289470bf4fda144225e606a5e42cb64570a0d8699dcfc393e0b56508a3b348497bb86c4044583ad9d00028a2b58d2c7a9ba35673d3373439ed29785ea4f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c897a529efe00605b451405f88edfe1b
SHA1e0839a5f577dd08b2ee7ceefe54da7671a0df343
SHA256d4276cfbf41383bfdbcb927077384ac75febef0b9a1fbda54bbb559ccf5c51f2
SHA512039a5a1fb8c9eb58617aa03c9ee9ec163ac3756f6f68c0fbce0791e34b59919f27b2db92ffd637974aa7e6a7c9cfe9060be58f66279a8cbbc137749db1921c66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529e9afd411422711eb82521927f0d9c9
SHA13c07c0024131f2091cea32b2a7039e52a7df1d2e
SHA2562e415f0fb6d6ff780f4713f31aadf35b7021e4edf4ad61e75a48e116d8cc60b2
SHA51229f38bf8eed0bc728d60ba93be7743acb4db4e164f17d538a171cb8438a71a481685acf4f243faf5112c9eba4b97d5065ded4fd20b4a4bcd93bd4b0a550db285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5230a4e68be0e9ae41454fcd054a6b2f6
SHA1700101c85001df99ae3e6adaca24abff5dddadac
SHA25684e307ce212d8a1969b7bbd8f9c4ba8bd1e9fd49b6d7270cb0c945e4e399d94d
SHA512ccdbbf3a1644e4e43d84477c3bd7522a1040280ef9a332e4cc60d1b04ea4d96080603e2a4fb2826e14bd1a311550ccb43f6f6d3b758d86aba1ede3dd148b9122
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f25803e901a226a6bcf374ad04ded5b2
SHA12a1c84894a1b4c275e3e104eb6c51cfac80f0aee
SHA2569c9f35c093624d26567ef7c912a669ced19d8c6c54936991475c9c6e77fa7150
SHA5123ea9e3982560c7ed4e1baa2e54d80e39dd79b72cbca1d29c19fc2adddc69efd322b68b65d9546cd1e344b1748bced4f3a01a57b377ada44ebb6358801c42b416
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1731a2e72fce4099659ccd76cd15294
SHA1796a642467b4b81c27596082ba0a8ab851ce3bb7
SHA256cb0449246fcc1fd2fd682241c8638b9b7a742c78717d887314914552f7cfe089
SHA512d4aaf264d73ddec816325af5560e2786a076dae581a5b1b92c8af688f084615e133181691579572a903f8e702b082ec996343fa6dc948ebd6ae8ed2921f27544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7a3c6f8cf9c8cf71ecdcdef7c878ef9
SHA179647b55a0a06004bd7d38a276f8c653c35dedde
SHA25668945ae63d5783f35db8aa8e863add6000ea258df28283d74dc25fcda6bc5872
SHA51245cd3c67da89bcdb90bd974ff511eca9e2c4278548b480ba7fc5314e3373a7b4430409898b571a6f05673bb6a0288b67f492611aad0a9ec305311939fac6973a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53eb80923578ab797ca462b18d27132ac
SHA1202a661fd6e833b0bde4ed4986727f64257d2d64
SHA2560bea30a09ba390a18198cfde3ce0cd30151a5b327a1774ed1ba21f477d1c54f2
SHA51206d7fb6d9981aa98ee7f0450eba77db694bf445dd1f93edd7f97b95f6e5cf680866813e34261c234fce70aae6773d7fa6d5a73fdd2e3541c1c8dafc8101e7344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59de764e16d6b601a3f15a5ca3dd99ce1
SHA14dc31917e6d0bd216e7653df31e9de6bc24e0042
SHA2569e4a4f57f00eebe796054ae7f0ce293c01b8b0b454b81f7423268b6e4551dcf8
SHA5124d83e21d4a729255a8b7d9cee6152d6b0bdaaf548a037d5cfb967e74bc9518f54a9d2ce5883e95691a8adc361928b74da828abeb065d1f673dfee2b0849399d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bf6164ad8750384f7287fed3ee71c39
SHA144d60839b5c3f66432500e000dc9478d983a2200
SHA25627069615ddb71f7b33d293b7f50709dfc153f0842edf5904fe0fb6edc7d8b541
SHA512c616e4747dc90dd2cbd7c32606d29bba52403221e59d67a3d2104e297338b8d421de71cedd31aff79f57b2dbc80b1113c1143c7095ca639034dfd0ef97e00c3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509e1805ef65b50a88e080628d2666a51
SHA1eed09fb496433900b6ea4adf0cc12c1d6666a85d
SHA256d415ac5fe97576c1d9ff74f52033f0a88ea7b7933ff917ed9d722ae875482f58
SHA5120c2225fb674d926f2e5df283c272f13418aa9cc14a624f8c3db4304014e07eada4a0e936534c7fade3ea8a839aa05959a8aa16d430ec6aa669f896f096a2b7db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c357a024a40d6b51848b2075e76d42a7
SHA1002d67f2db66e5e16e20628ee78e4bc070faf059
SHA25674cf229e2aacc2735e769239f20852cc391398b4dd075a8cc8db7d6786e479f5
SHA51258966229535a4b405988b6cc1baf57c26e41ad9e5a5f1e1e1e42b3578105a2875ade3803d0f05d6855b2b15c72608513120ca705db41f815a24e035d67b46a2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5699722cbf48b2caa1e1599c622e25107
SHA1093e91a535113f173d19452c6fccb1de14d1ff42
SHA256fb0635fef717ed6a8874e28f0145378602412c3d237fbd24793c9a7ccb4442be
SHA5128ab25682c47c7d4558fb17b2d61780445a61309b0bd3ced9e9a0f13ad68ba15b559930abde3112c156a07a3780be2731bd49bb3423f5da2fe9f75ddedab46f96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5177c305e39e891cd3dc01a8a77572849
SHA1d7f910f1801a8fb5cbae3cb20c9530704bfdd221
SHA256f98293d5b159eb6d13ae136541dfeaf46473aeb910dc149cbcf5f8458e84431b
SHA5124502f8aade1f4cf3098dabdff7ab610ef291fd6703d1414ee901557eb77e439055a0d7e334954e2db6735654eae3748ab0dd1d6173ceeb05f7f8863befcf5b3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52290da5d71d17afc8b36089bb15b287f
SHA15ea7b279223d3918a6ce01303373fb3359b13f42
SHA2562ca164dc165f3b750c93488b44e4883e92b9bedca2b7488e71915ccb67ab8c7a
SHA5128d4aad32570d2a3bfc627b90359706a14444fdc86a50158ee9a38b45a6503fd67f02cc7f8f784b5cb96b1ec5493136f0219f264daca728a4c7543097f1796753
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa5826ba87f6f6c003a205f47691eec3
SHA12cc7674d7be81d429ea18ff1e9205d47530ce54d
SHA256a031512b1f605062db1c4a89d40c0a909b5b7f937c11a039d71094e77261e0fa
SHA512f14fea29a69922c82ae7477e66e51aafb77a5761e8943494233f1d3cb9184603107768d6bd98d3c1e5a4214a6550898f6126996847e4df58db4c988973793fa0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b