Analysis
-
max time kernel
72s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 06:29
Static task
static1
Behavioral task
behavioral1
Sample
5ad1ff2027b61a0ac665d3d8c27e7ebd_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5ad1ff2027b61a0ac665d3d8c27e7ebd_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5ad1ff2027b61a0ac665d3d8c27e7ebd_JaffaCakes118.html
-
Size
6KB
-
MD5
5ad1ff2027b61a0ac665d3d8c27e7ebd
-
SHA1
dea79c42f858fcd4e7a2f03ed130397864db9e51
-
SHA256
d7d30399f2b756ac90161aaca06002613b7fd43361d1f9722b2623ef066925db
-
SHA512
b742b0e04eb69d7dbc6a0f1044d2ad7a9a10be8f8497b0818887f6dd423980f84041de4ff8318f8e1e92fd4b94e42c348fa84fde204d5143821fc71691055c06
-
SSDEEP
96:uzVs+ux7U/0LLY1k9o84d12ef7CSTUi9/6/NcEZ7ru7f:csz7U/0AYS/h4Nb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BED7F01-4598-11EF-9B29-FA51B03C324C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427532455" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a07a39a5d9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000015811415466fd8b035f914b9b97b478a1861dbd2582494b8101d5a2cef8f171b000000000e8000000002000020000000f41a7c96ddde3a47cc06da2e642f86c3d06ef8338ec97b98b1ee29c4cc62b1d920000000a3c71da7a667617acded382095df7e11306ddffa92bb843371dad8bb31674475400000002322cdc4b18a84bcc48db5dbe5758b7f2475fdd0b13515cd619ee350380400cdabcd08bffd47d3c7b36fdc6ca26a7215fc568075ef6864a87ce66e27272c1630 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000001c1d02342f35f70e869a5591a0c466921aa7e08ef8c34c4799eaed2bc846ed1b000000000e80000000020000200000005a1e229720fdb419126dc23007543e2db7160fd61fd53a523315303c891ac5df90000000b5791d95dd1db33442f31cb3d1e80424de12714c7605f6c4e9f919e7565fb6f54b3ca279a8ada48f71840a8b74179bfe0d096dbb8a3b65e32836487ee3fb60bd01d01cc05e059913531a1f58c5ff60790db34e898018cdc7f090ab2244c961023f1e242bbae17486a46ff143b2509a903c38dfbc67d37048c1bed3596c5a39a78a4ed6f1ddbb7862d357d53635433098400000003b7644efa5a028802b78116c13a121d3353a1def075b2120452dc841e10c91c82b405611ff629f789c27d3dd6651a17c3167b989f3012dfdccdcf5b619a06dc1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2788 2116 iexplore.exe 30 PID 2116 wrote to memory of 2788 2116 iexplore.exe 30 PID 2116 wrote to memory of 2788 2116 iexplore.exe 30 PID 2116 wrote to memory of 2788 2116 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ad1ff2027b61a0ac665d3d8c27e7ebd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3560d2f20089ef2100b3f43f60f282a
SHA13d131ebd8f59bf1b91b4616b7ce7671cb08698bb
SHA2565398e47a7deb5efd6b0b3182ab59ac616e49ca122916e307d7d337125aad90de
SHA5126c5813c77cbb1e46996f402fc257e53fc9b6824affc93f8b4afcc800140009ccb3457facfb070a7f185eb572b1802ca60b6b5584a7fc9bffeae82e0a58000827
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56dffedcb5f2448b5b0d6e9b919106628
SHA181fcffbacd80e34d140c37ac1511132bc05f160b
SHA2561883c2edb91325eee0782845b4bd1867c5b042bd3017bee954ea54c361ad9a04
SHA512c0202f499331948abb80a4d385b3d730a69a24da83857f5259c76cf0b33df9b88e84ce580d8524164ebcf7a67221d33b49ea72c12948e0935fb9cb619cb94471
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54707f3453c7dfb7fb64de179ba79a5b8
SHA1f57b51fbb4d5f9872889e4a0a02cb15a635f57c0
SHA25681cbe96c8456456afebc9ad7b721dcf75783f3a2ed63bf9273622545d663c3d4
SHA512688f20af4f88ced4267fb3f63b21645dfb2069fe63f5f274f63af01a20b7e1dcdbe6eabf87962c680e0f8f836fbf9d9e40348aeb58d70274d581dd1ef8a70257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1bb9d303faa4a0562fed987d1b9ed7a
SHA167295fde51889a7f8b9d7c70d6b001d672ffc5e5
SHA256d00de02dc976c10cc5435dda7f8e207a7c41f257fffff4db82a703d2516acf2f
SHA512622a2e473e67df592f500da8f3d76a6a17cc5fe99470cfc75f433af16e8366d828828234800198da09a60a14dd97b881936c735abc6a628c3ecf6c7b7051cf29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565c3d031b9435022e6efd887b062f2a2
SHA1d673e4cc1c12370bc007c60a9c906dd673c004e9
SHA256dd279babf10fc1f84b386554469532150ca4b5d6a924733e31af7a1bdad2da9b
SHA512d922082585a43289a268f718ac1cf1d45de5b38b79318257fb8249647c0196bcb1b29b0e8e77b39e1be0eaf4c4ef9de7d389c07da292ceae4bb91ceb757f068d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528915393edf8a0ffaf6f831c3f9890b7
SHA11dab2e257ae620f11279aa87c23fcd8107904a3e
SHA2561b6ac3fe76fa4f2e4dd41da767d995ff5a42196dd09c0c938a02eb978dfe6aad
SHA5125c7b5674a1db5436d27785f408b97ac799361fad2cb76151a20f706d670461aed9962d975cba9afe32a45651a8da1341fae30a16830c0195a70313a487b02dae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc6c1e3c5e5a8f628a10309032f2156e
SHA147c54543f5fe95bce696176dfe680ca558eed8e0
SHA25634a23b0110ae74c3bb98e6c28e994ff32a9547be4c67e99ad126328fc0f5cea5
SHA5121f8808bdee3fad09ee921e09858e30b56848d237173e85489d434b22b682093cc1898674a4b7f07a6a7685a7f1ac2339951c77050f146141b47aab39da61450c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f15baa4bbbbc0ea38355b323eeff6e5
SHA1873019d71a9bf395c2ac258530aa0d867e4bd2b8
SHA25691f08a3d964eab60fe52bd5a361c44ab80ed3e3c58f2c67fd18d6c5d81504870
SHA512724c8c2a401e091cbf828a7c482364cf49caa9a7c7c8d1125cb4d545d70761cd652fd29d63b961a1a4fac7ca20d263c0d2ed31a6e8feaf0c2465568144607e73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c79cdc35184a811a78ccea1f1950fbb
SHA1d4ddbff25fbb24608a2d1811b5791a3ed641b7f7
SHA256ad0f1febb4d099d331700da13fab572738b4aaba0d6ff35abaea5e51a125c157
SHA512d42ef6a812351db4c4f086b27abb7d6a62f5309742c87a03b7aa72b1861dafe024eb73d3bddee0fe59e9df43d70518c9fa72b212d6d4b7be6eb84f3f4b96b141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad3c886017035cb1f23a0372a17cc331
SHA192897980288dc5284a9fd1bb606e82382e8948f2
SHA25665a463fb45bb230579844557f45ef77e71ca3a4a78f3d2c870d6fc76614661c6
SHA512a6fea35410406fec094387a51955fa4018bd9db58ef50ad1df1ad42be1eb265efc36302b76c04e0e5c9e6d2d0151880c03da06b165de5d4269846801a1a51f79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4f50602908024d945f0f86db6f50458
SHA11b43669bdd5e80bd8ac02d0f75adfd338373c02c
SHA2561c0bfeebb59db61459d2c0bd366b5fa561a5886edfaa83a443ce661b191e84d7
SHA5125bd708d32a0f36530dab0ee10c23b320a1114e24c0713c625727214fddddf98ae32fb1453e6e7604143b32c68c056bd93ebd6df5b890fa52ad2cfd6d52549f01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595e427e6f97ec9c3262a8421ae796be6
SHA157d856ee4a9b5146b278c5fcde84f249658bb4d8
SHA2565f84c60b2fc04e3f30be80474334e1418bd264f846eb9e79a2ecf8ede822e881
SHA512b0791dee709a6399f47c5d8f99fc8991d1daf478881e4c5c046e48257cf7285f97324f5364b7ddd8dc53045607988e0b5c90c73b498092ada519fed1537ba1eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c7fd72f8a4684ba30f6d3df70bd7877
SHA1d680b362ec874d8e4c28912dd838f6929c577d87
SHA25610f6c0f010d352d6e4ed392edff857e2d21e638a43e4dae055fc2d4d83e0c5ea
SHA512503298fb43274b2e98f79912c5b0c8abfe52ebf18488a5b3e6b8fb7718a5e7cfed59518d6508ad45a7a90990f780388e0d1d4163403cc5cb7d00b7791d26dc9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f838a399fa5585c1bfa272f56a820937
SHA1816dd0c512e150ceba85c15c9e98eaba2aecaca2
SHA256b96b2aca1143b46057bc19c6f13abd2116e05782b3a634b1255e4c8327ad3812
SHA512ee433bf4aa0ef25176ffe24ce25ab31dac60e12046ae26a0b251dcae09ab4bb45a767b71e17705db5cce3bfbf3d09447e7c693297ae203e31554224d22ed2816
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51689751dc4d1bca47e01869689b94cb2
SHA1516cfb481e361f6e222e501bdee2f1eb75f5f961
SHA2563914275d62665ab708daf8f24c307fabf28ea9f36b24c3d6480f65972e960bc9
SHA51268150645869acd2b44f1bb9c83df075d671c1c7d044e3ae5b9c9bd177096d5b9dae5709d36274681fb05498799f3677717f9cad699daaa866ffb9eaf28cbd43a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5246e67ff4f9397b4edceac576af57120
SHA1786634f205625856830d4cb9f45dc93d63c5f5b1
SHA25605a97e3263f47622fdf693161c7ad49b8bace85f7ad2648370bc7f40ab07322e
SHA51233532c6a9b13ce4c02b84d932cb522a466d4d5a08b12cd4f3a602978dcbe1caaf74ec63771160ba560e1e93c328bae7ccccee5eeabb7af42773e7badf63d7aa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557bbc55c7845b440bdbd06e1d6bafcdc
SHA19c98fd16b8ae20dc497db03b03fcab4e2c03c725
SHA25685f833db8a4b288daee9658dcbef7af4c23866034c0694c43fdc5d23ef547bd1
SHA5123d69a0e50ffb06dab881d02e3bb14c0c586fcaa839ac5598b7ddb03fce2e0a4adbf5d80a6c0a4dad8314b1c8309d9029178b0b057b3a29ef17bb04b0b205a63b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58228baba70267eed6bc594a115f5aa97
SHA1c1ec09c5c0119a9ef6b3a8c145760a24a11b5d40
SHA25694028fc5f726b29e18595b6946540cc29ae2af37f14fd5dcf7f95b25c5606b13
SHA51238aaebeefddd43dbe3dd5e12f8123d2d3bcf822e8825704cfacfb0035b29a9035cc3ae4136fa8ba19701558b9f6f7a513569dc718cf84bda4a56fd27964ceb93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e336b6d4f94fa3bfb4872186a96c073b
SHA10405721a08df5d09c54aeda6ac1fa76b658aaa67
SHA2566176aeeaa718734c83cfb0e573df8b8b99bacdf4b9d3d9a8650d91dc599133d4
SHA512d7996d7966bf9045551faaa68d6e83e781a3caccedba5be170df3e922560a218b0cb57ebdf4759b6e122af412024a60882a4558b5fb3882a390ed54334b2b35d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b