Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
5f63180abfc02189bac5eec1a7bce07c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5f63180abfc02189bac5eec1a7bce07c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5f63180abfc02189bac5eec1a7bce07c_JaffaCakes118.html
-
Size
19KB
-
MD5
5f63180abfc02189bac5eec1a7bce07c
-
SHA1
a7b9d8c47d46681375076e157b3c8009d83dc352
-
SHA256
3b9ff35b1577e6f54236297d11482011d51f84bce224d747d1eab3d94c3f6f57
-
SHA512
de465c7cd83b4fc539dcda1f1f721547d080b645f06ea49b236aff5d06be3bcaf528ccdb910295ba664314e9e07158ceb678168dc456d4c2315a7d50b2fbc0e7
-
SSDEEP
384:QggPItv4PB42xCPjJeKJzr52T9GYDkuTSXGyEBbYUVs12aRtD+Eq9xPQ:QNPQgPWg3RuXGyEnBaRVDq9xPQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c001139c6edada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C765AC61-4661-11EF-8BC1-6AE4CEDF004B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427618991" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000009a9c7605d75ca2ab3c97b3fa099ff4a66a28177d0738df7528f6153ce317c85e000000000e8000000002000020000000b2e3686291004b11fc91491747e7ef58336538d85849ff7e0a38a88c8d6cf6e7200000000d061b81be6699c0eaaf18f0922e5f6d979232fe2fb2ec1132a5d63d92f95e0240000000cc3526a8420288e0b66497be463d39b74eb4bb64566021c12bdcdb02709d66eca981dceb0264b98f6d7e28ab9de43323c4d98fc30d65d8de4ff1060595efc6c2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000ea68dae6fc1f50996fb1a03675fcaa1e1a2d7ee7ae40d9b2fc82dbf13a83d1fd000000000e8000000002000020000000494c3a60ecb78746fc846e80cd9d45bdbb0630c9f1d95e86a72947c3fdb0049d900000003ec12aba271b924ba053feb7e6baf40349ad2f023114a19702ab8482065ae1eeaff9d04efdf882ec6a87ec840eabd1bd602effdbe6dea5946f162862eb326f9f040d458c2ee6ea01829366cd252f25eb55ffb2b8b1170e2e27fa4c1b04c48c2881d5a0d96acb2ab9aa95240b261ca9c97c0f821d54c6bd2b87f0cc4184fff02859fbe789e3f3ef6e1bbbcc500c423f78400000004f04d0c3818f1875ed1642939629fb2308e66965a1b3d306ce4f816b8a279f8ac4497a948a1fac3a939a0bcd47568da3b68b8ed1636648481ea79c150f208a22 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1940 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1940 iexplore.exe 1940 iexplore.exe 296 IEXPLORE.EXE 296 IEXPLORE.EXE 296 IEXPLORE.EXE 296 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1940 wrote to memory of 296 1940 iexplore.exe 30 PID 1940 wrote to memory of 296 1940 iexplore.exe 30 PID 1940 wrote to memory of 296 1940 iexplore.exe 30 PID 1940 wrote to memory of 296 1940 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f63180abfc02189bac5eec1a7bce07c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56513b7011b78fc21114f246c84485b48
SHA15bd6e8607d433036a1e9c6d7ae041d641d4540f7
SHA256790aa15f495d1e38f26d83d55f7de5998c4b59e95a22471d4f36b8e8b5fa548c
SHA512b87f54df71ac90008a79700379f27f37d1b205651e66550f12e8acbf1e3989c37e01674f96133d49e322636d4cf26297748c163cf106aedc179a0f2d6fdf0ee2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3e9fa5cc1941cf19c4f39236fc45e4e
SHA13915b0c53c9cade5551d4115119a608ca3a4cc70
SHA25697ead83eac7669836668b1ae7dbeb1d6e4772e48c85f9db920e43d7d69895d36
SHA51273b2618eff50f6183dd8d72248e5dfcdf586cde51841b25b10fe4c740ebffb7a6fbc20417a9828335c2c46e03924799074a1cf36e8d8ad7c7ef5b88aff7059ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a76278628071ccabbab4f1571567afd
SHA184461cce34c40aec617e5f64a3fab7565de3ade7
SHA256b95c94ff93d91eed5c5ade4d9b16eaea4350dc352fae08ca6e0d2bc4d58b1619
SHA512562e9ab0e9add0d2936330a1a161a23f4667e1f7aef5a82efd231d0f4b986b531ecdb36750dab99078f2ed786ee34e9e7b3fa34d6d80d5c3f7af1b109d09b83a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be976b60748314ae4c0ae366ed4d0eb1
SHA1ccb494720f6dc3c94ff3a2827b29719c841eb62c
SHA256ac180ec5352bef7669a58e9f45282af6dfb5bc4fbed3b9224f5ba3619109f3ba
SHA51269a2f9d825a1ae0d7a912e84ec2945e20c90eef28883c848e3b6eede4e8d314ea982415aa30c5bbd80015a54200c47f787b8c109da2394f7e75f29f42c266590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ee5964c1ae9e50d6946e39647a5ef32
SHA10198b5aa1d73fafb61c18c407c16fa7e03a3842d
SHA2561d97c5a67c5a57fc17edc6f362678ce9461bf63dc2c3007b2ee833230c1c41da
SHA5124fbcadbe253034f1c4abafe6bfc024a19837110f6151b0e94bd0c82720d0de6d89912f4d0cd3d36029312fa52ea41702399116eb2e14ced125bf9b9cede69e2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55757270d415f97f6539fb76cd7197c7f
SHA1552520fbb9814bed3e321b1d2fd9993a67f2b868
SHA256ac868d946515ed03f265eb56bf9208f88590d1a585a482783f6be45db710c5dd
SHA512d5b464b016d122d62cc9d0b8214f278197e8668aabcc6188c1ad8fffa554d0cffc3688a672fea154a549a6b72e51c776a3261efdcdd4db60dd865aa064ef79fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e2af0509ac640c1c8d57ead75ec84b3
SHA1988edcc88b6b5b8b4a2b5d4cd830786b5ee743bc
SHA256db5b042b9452a835978b93a0c2ce89af737c55090649a40196513cc958c90fbd
SHA512d798ae6ebfda935444aee239afebd6b3d342e90bd17dd0c9ee091c74817d7bc4e88f83fecdcee310ee3550be15b75ade02c517ab9574b0c9356bdd61a8444df2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ed08460f6f2a4100bd6496ad953b7e1
SHA11528b0519d599d15954fac11e29dae3881fae99d
SHA25610a04854fa963377cca2118e378ae720081840d32e3a70a583fceda1dff2ea16
SHA51295fdef0be931be7dc7ba5f780e486cf384870c32703ebfec8fc27769fa61e2fcdb368ddb1fd674a162bc62be59c12f03a1ce713a4862fd95fba442b83a7f60df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5301a3d19ad19abe9a0acb975998c98f2
SHA1915ebb721307c49889247729a64094a24f6d6a96
SHA2567418967d99b20dbb5084be4cc86d2b68255a654baec53b19416c66ea8d6cd569
SHA5124adc58cf77b4d3426ae1494af97f2e58628a3245f65eb8b1921349ada1791622facf35a72053bb8c7b231e0736b3dfa6a989ec5030a72dff3b6efdf15bbbc009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a465c5186a0e2d6a5b293be8b6af4e6f
SHA10bf7b87de9699d10ddd344fdadc299ec7a0d1dee
SHA25645c9afbbd66f575227ab4b8a5507b873deff3eabfb14e1cbd7b536e9335938df
SHA512986f40d478c202df916e0f6ba2a14c4af38754fff97ae73929636dfd3d4fc1070f983ec11741b95e208523696768419c3e2c0c5675a34eabc909ae6f74e4f672
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52667baeb3bc7e43060374d7c28e6e14e
SHA13e1fa4cf80a071df410bd849cad38a601456147f
SHA2563ea986cac3f9a71c863451d5d5f46705dadb7a3b8d9806f7791c4e610574f52d
SHA512f21e256671f36a2f179a344ceb40ab0bf0aeba8d47cf80002cfb07b390a4adb88054d7d79bc8ba2339a09d181ae4c26e94c19ac8ca80ac20d0d2b08a2f4cee87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528732ba7bffc69bd2343caaf0454158c
SHA1f1dbf59526e71402371283e701ef872919d2858d
SHA256d5bffce3ef11eb6e17d4b2f438f256bdce50259b56121caf1707b55ea0a7d052
SHA512052cf3c137fcbc3df756353f3f36bfde5c42f6896006ae57e04737250b3c34cffe3c0ba483accd508a38784c4728d20dd32204b4cf6520b07cb7a6a38fd5bab3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574eb949e818e13729569a4a62b35cd2e
SHA142a087b6cf7cb1810898617ac2edd458debbf453
SHA256b1d6a20741063ccfdab5ca5f22aec22c538b4359a329254e93810e8151b8b16e
SHA5127a8e00b08e98084e883de7947fa19116f3f25acf9069ebeb0c28beaad8bc0db10a9d9628f5d89c71a2eab0143a8b864d99b5b05a30beb8f3daab3838f1979d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535a6f3072118e60b6bdc8fe2f556810f
SHA1a5cbb97077ca836b7c77266cf392f53d2da88ea7
SHA256bfac5a48bc087a246d7e28f23217c9503c833fda5549a27b5c511e454e196bea
SHA512288f376414d03efc818d1e469f545dd743974253eb3ae0c8812ebd80b5fe2401f1ab21008fecc721803bd93d8bebd3e1d9bc4ff199908944902f150ea6cd032a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5127c871cd5ab104b1fc2e0df4b246a59
SHA110e6e90b9f79283a20bbb1ca6b0d7b8ac6f7674a
SHA256ae679a1016446f632714a56108efcfab4e75d7050d83ffe64fb3133ca1067756
SHA512b98055d749c20006a28076ff654e402072e09c9a78492389e55aaa9727e157e6634d4a6aa130c413273817920b8900bc9026515a7c8f9b15993b6216bd7b1aa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519c177d886f1795fb52b2854b6090044
SHA1b2c6951cbe64a2b7ae3e693a760bb13b22138676
SHA2560062d425220c054f754c835ced5e2e43a0d29f0dcf57d2a31f73395c8e98da8f
SHA512aaf215e18f1d9ba41bf36ee6b747222e9793124e3a381ac646158b7e2b3221944115190a53a62358eefd8be0ace4e155cb1db4871e51d53896455b83907b462a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511c0d5304abb178fe247bebe11921f49
SHA1e613b4b31c2b2042e42b3729aae67937fb2f8090
SHA2560241fa62fa323d25f2837134c3c8953424a2394cead330bedf793b7b2b9498f2
SHA51215a5924d0e421e210c266ef02658024bc2e62f17ef1c95ee009660e1774e78ec405e530cef8c49aaa1fbeaebb6993e25ce18c603b76839aab5b959b7e7b07ea6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f3cfea2d2fce59850166b6bbb19b9fb
SHA1ee1c9c03db52aa668793b72dca802d8a95b8ee69
SHA2568adea6ce8a833f4e6779aa39b4fe17a4d0c503245ae7aa74be32523340d70958
SHA512002d2f8a14afeba2149c1cff686f03144060302754d5660b274d1ed57ab9c1eebccdac2e98dc32547ffe41e2d6fea6c662d73e55961e1ae07dd4751832d4c46b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5642a202f1a6f2a3059947a8b3b42b501
SHA1b15bbf5432d6c54d3a49f829e3293cca6283fb2c
SHA2562d63c3285f33db50749411e3fb1c372685d3288de00b0084eef2c036729f8fe8
SHA51204c4e7992ee8aedf6198ad5f008c38caea8a0847992082fd5d536b879ea97967060fe7a626885f285592af0db39f314fb9221f3b14fab259b5abd300de3f0492
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b