Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 04:04
Static task
static1
Behavioral task
behavioral1
Sample
5a6449b79a2cefe6c609a854d61d3b68_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5a6449b79a2cefe6c609a854d61d3b68_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5a6449b79a2cefe6c609a854d61d3b68_JaffaCakes118.html
-
Size
6KB
-
MD5
5a6449b79a2cefe6c609a854d61d3b68
-
SHA1
06c1b4b9958a052328a0a5882c40f595db1e4e61
-
SHA256
f0bf31ae97fadb3baceec99ad2d87bfbfefe911a6c93cf4b0aabb5bf37f9c4dc
-
SHA512
9686063e92f4dd830624dd8d779c83432f354a6cedba8e43824cbc1b1d45d01fc5ed4fd41ea478a56df0dc9e7bc94aa732ae6d640af67557f6aea15bf4a3a33e
-
SSDEEP
96:uzVs+ux72HOLLY1k9o84d12ef7CSTUBZcEZ7ru7f:csz70OAYS/8b76f
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000f2b2720c91eb91b2c6f795ca08769061336686595ad30d1cad01cb50f3e7f022000000000e8000000002000020000000fd8f39fbef758672e93856b987a89c11db1d5d7fd7cf11fda2141d8f1d50bd87200000002480a00b0b5324b13a7fa3eb30e85f0b7fc147e71f8672a0ba9e2093deca3e8040000000944125f1bccf1a8f0e760e4c98006e89d80ea64ebd36b3bd4b457847dd2a44e5209c95da8d6691ed527322430327d731ee384b631a263a44804e6f7a507f20cc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ada5c890d9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3AFBE21-4583-11EF-A2BA-566676D6F1CF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000db2cfedf51f2f3b8b0d46ad1f78e805b20249adadf5ec92ccfbcba99eb96ce20000000000e80000000020000200000000e79c10f2e37c8efff9e38092b8f487bf18374741a7d1e9c2d4b0911ed7a252090000000df71adff49cae27fa0b43e6abe533ff8d890c09b9bfcf7b1325d973cfd573e1bdfaaf17d521ded619f2680558e5a508cca22f0124a5721714a8b256805966f2da67d89bf5948b2b5f537bc3d1d875fb3c0ae49841fbb80003a93b09205d93f1abed57ff7d331fdfb81e733577546651e0ff0cb28921577a205103d177016876656abdb708da564ba7a2044495b0775ea4000000006a95826bb08b9a488616045d0965016d51095abb0df89f96ae339a9054ddb224adf94db2c9717722fe4293a58b37c36c871d614e22ebdb88e8cdbfa0d8cbfbe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427523717" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2216 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2216 iexplore.exe 2216 iexplore.exe 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2968 2216 iexplore.exe 30 PID 2216 wrote to memory of 2968 2216 iexplore.exe 30 PID 2216 wrote to memory of 2968 2216 iexplore.exe 30 PID 2216 wrote to memory of 2968 2216 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5a6449b79a2cefe6c609a854d61d3b68_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569c44124398e7f24e382e778f60b585f
SHA1af5dc08e8204bd59b272ce896ed4abbe424f2218
SHA25648ae00fb94e18dd7efeae652a9aa4060f7f2cde52c2336a325d29baba2819ffb
SHA5129532e1a6eea853914e4b10315a97f08547d70fa31d3f3dcfa05910a64dbfebbff6909f96fe58d49ff539624f81db11f9dc12fd5047a88ec65e53033c2df833e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebef7e32534fa9175ad72677431a3764
SHA185e67dcd4dda77efe353c65c69d9762d90b9f8b9
SHA256d2df53a1630a5a2a92b3fb978984969972af13eafad58abdefcd2cfdff98b1c9
SHA5128b4293f4222dc3c98d141ac6da2afb90ded0743ac8d730c6026939752f715c81fdf1cbadaa49b9e7cf98fde2cdf90f76c325a851f93c84b480e7a0ae88139f91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553514070176a5212f76e39a27862b5a4
SHA101fdb8322b13920830a81f67ac2b06e9980e64af
SHA256c39fd788e134c3960cd2cb429528e54b2a9b316376f71eb209d97212bf8f1012
SHA5129b388e9cf2422cfa53163d4020c460a7267dc071d0f00d31f2c88075658a044f3c78f3e373d16139851a9e4c9969f3aa69d923b55940698b27bac4f777547781
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d69f1fcabc5a700951e06d24528282a1
SHA1e8bb7928521b50806ce24e92c5821fa7620a6eaf
SHA2568ed17160e4b326ec2f3f14913b1b303e94fa4c3733a0f41c50cbd69deb3ae3de
SHA512d5b69e8b92cb712159fb1fe32dc27ea16066570c3f6f895418ba572e1215e3e20f0ef38fae495a313d77dc55a1f4c9e2653bc96f8e597f66e3aed82ff375dab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5293603a58aa6efe50d67f5dd6709a2ed
SHA16c98225da2b720c8aec5c83bd4c9bcf1f54d58a9
SHA256cdb241dd81d595a04aa3fefbe182e97c91c6cda0f480e38682de4a015d7ef541
SHA5126f696de617a1b7b6006dcda2f0da6961ae8b6ba4acb884bee6925471a5af0f40ca61611510c825b1ad326f70b1323e9a302638540fc1443552ad066ba5efc202
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553ef5178ac4b5d991640658aea2d4305
SHA15f460113a9e5f048e64b3d7786d93e1c14fa6615
SHA25694e8f90fcbaaf95ab2e23ec63224473857e71cbc5cf0cd509c1c7b9a390cbba3
SHA512600d5eca43b7069d5d38dcef3bc0301a119d79628faf222af6c6ad1eb736fd06565f5b648906955689c513f7783e0afebbba979b4183f409a251ba21f804dd6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b141ad8d9942f670352d8a084372fcbd
SHA11eb9968c7175af292177a714696bfc3fa3ee2469
SHA25692d5863eff0436944600afd377298accd154e0b12a3313d103a5a45b3e8e461b
SHA51220c93b9fbc38eefa28ba4be9405d451dd2995db73e19d69e32f46d075f1b202be3b83206c1fb26042430348eb15ae5f507ea15f315f016323ff64d439fcc1525
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3149ac36c5e85738f92710e64cf7518
SHA1c4415c40e53adb1be930a0147f6432e6bf077500
SHA256132dc04845b01979dbce5e4e39715fc6978308ddedc24d3c222d3670a949c9ab
SHA5122f93023bf9135d986900c722543671dc0ab983bc18e41f5e5df275b8f37e9c19452d9d4920d95492a3d3366e213a803d3aaab214ae9d489f55035c8b6f11c9c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532276ee81bc6021730ed4b130d2357f4
SHA1c449d94b7c59f1416b90cc8bfb40be4639743988
SHA256592840b210e52d33274d8ea05269580bdd08d73ff94e2df52bd9f11f08050a63
SHA5129da1ce2f781fe8150f6e01512a429c4bf4ea4bf7bdac3d556641aac2b15de8e9d29248b6afd339aff398bd9b8b514180748223778a14670452a6c921be09b8e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535ef5ddba9cebf11ad8a79289372b16f
SHA1185d64aa58f8be800955ac67812c721211c915b4
SHA256412897218fdf350f69e66d30872dce05cd34a5dd18551d7ae2ee5ca97bb1bec7
SHA512b9c703eb1089b5a8fdb39e64282359b0516537bf60bab99faaa724fcb0e50dc93f594e61ab949c0a4d30bffbd075587b818287dfacd3cc4797aad9b4d465b7a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f70368d447ca1996e78862494691dac
SHA19856a4bf6c4e2a763ec92c457de8b88c8a7cd7f1
SHA256ac645b573ba68f7a9ed73dd3428975e145cc00687d09f860b6b86be487475d7a
SHA512a8773d4b01e2bb5768fc4729b1519eed2fd390c11db619e9491eed1183ab7db372bc4512e2c4eef5c0d06514ac5ca596b31f91633802af04fca60d877aa9b10a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1966a2063847807441283224cbf2ffe
SHA1ecc9704008a6e8f45c67f08af6c09682ab609feb
SHA256d2107b031576dfe565d1a36b4395cfec9294e038ab7ed61d9a4b425fc37a917e
SHA512d53588ff3474d81f5123ffeeec390df16c7bc57f0d11aa1fe80bb469e7b5dbeb1109067f5f167caf38e206a7c2e05fadbf61c2a31fbd6f5bed759556b486b64e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5715d509c91d248cc8ae9cc7b510568f3
SHA1d2589ad62cb3bac38bb7e001e04df706c56340d0
SHA25659e5943057618a9e7e6c5321be15a72d11bdbf857a0b90bceabc27cc79fe420b
SHA512d43c4fc7e6fdec2ccc39c058eb2aa7ffb6bfcb7174d8aaf43d346cd162bc405001f1434b2f42293d59e4fd3a51c7707b499f76a2fe7549dd7280662e6c92d058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5853628c6eec536e2a0981a248c2e46c9
SHA13c37aac1f2a42bffa8ba4b83b8d80074b58b184b
SHA256587813f7a5bf9b97361933cbbc616131b2ca3a1f66c63ba915a89a1e4240f356
SHA51231e7677ebd080ed9f5d2c31e6d2f58249cf077729c60680225b683ea221f5489ac2aabb367bd4e607f6b28d7ec46dbfb976e590e6051eebd71a8e57ebab98abe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee0630020c569e8e99e4d72e40573962
SHA1efc751b85b8de7ca65e83df93b8418e2bbf08da3
SHA256b3a52a8fed3a2f1d22fac6f64f56f028523e26c12d70f4cec4237c4a424c7a48
SHA51213bb326e46c495c0775dde2f6e3863eca7b5bf3dbd84cc953b2b1d410018b72730237a2fd8cfdc46c96197db886505035047cc3eb39e0e1ac7650cb2a78c6d59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f4ee13a888d54c0331b412da8a5e021
SHA1349431b0e9cb2e0dcd2310df944d313ca450a9fc
SHA256cc25b6e5a1eeb50d50d6b1c290a6f6d65eb2ef9756b8b2f156f9135d400db574
SHA512712e538f8584cc60915318345fffdeb27db979ebf3cf0dd2a07c52b0ce48b0deeaa2bfe6544247adaa729f076bdef76ea35314b72bbbe3419de10a7601ac7ead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f65432f2d6464422d70d9b3df6beb8cb
SHA1b86104d0c2af0e07a8075e6f41a9edb8a9b2d34c
SHA2564a1c186e0255ec3bb0ed4480e20630ca213790bc306d87db9b229da057cc5c4a
SHA512da97f4106367133926d1e8a11d5b21d84df272fc522cce7734fcd35119da14be8d81ee1b1d0d946a648703be7744941a3cd03392c24c6ed1ce331e001bb4f040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff31ffca34c1e6c164a751338ab85eb1
SHA110ded70c1166a74e3822b6131b3747e0a37e35ff
SHA25666e109015bad1e975ad8a22d910d81d35bca790edf32778e603564b71b52921d
SHA512525c595f95133228cc231229a6cbf8b316ebe0e07827c3b8723c3e16ed207ce4f86844027ede1f4728cf51daf81893795095f6b201432f877cf6ff71b75ca64f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a7ee53028df2a2caeab3a3c30290a67
SHA1a6f8db250ebf5928f01b3d619cce8dcda336785c
SHA25629f49fc216adef99ffc5519913be6ee2bca3616633365ea87d0858d9e386d4de
SHA512849f60fa3a1a640f2eff09bbecc73aa8d669405818ca5a6a61b9c87d2cdb935a9878c2262d7a2ca0f01a945f71aae1bbd24cc34164cec6d9ef71c9495781830a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b