Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
61b39796429b06cd20b223b129c88cb5_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
61b39796429b06cd20b223b129c88cb5_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
61b39796429b06cd20b223b129c88cb5_JaffaCakes118.html
-
Size
6KB
-
MD5
61b39796429b06cd20b223b129c88cb5
-
SHA1
b4c34170064caa0df4d566380aee908cc8a57f87
-
SHA256
97bda72fbe1f35a11688a26277d3e008c3fbf87a075b2227c36034852cfeaaf8
-
SHA512
4b07c4f6a92dfed26c4766ff50e711df417345827f16bf5c8ca9d62cc2714a121a0007839c560ead9d71376f17d95d5c9a073b4b505675b5c609228dda8d194f
-
SSDEEP
96:uzVs+ux7eLtLLY1k9o84d12ef7CSTUWwPcEZ7ru7f:csz7eLtAYS/X+b76f
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000c1f3eb245101c5351ef2ddc41cc61a59b3213397deb9d8b74b61a6e6ff3f583e000000000e8000000002000020000000a4de52dcada49343500340bbbe7049a19346a44a447f59bd17be13f02923e64c200000001ae4606e2b914f297fb68a3327f23bd6223a7d280269a19d719ce13b88d84e3840000000a4933cb520f82f3293dd2ba39a201efaae41e1399728eac91d58ea162c06bd9fb80d03de253d2d5d1bb3f40884483202347e8dbb72d449f53a001c2fb57d86d6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f80233bfdbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C7745B1-47B2-11EF-95E0-F67F0CB12BFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000003f90b9691b5bee280ad492ea7c3489de982db0821491459bbad57ffd0f7b94ad000000000e80000000020000200000001c3d661007583dd8028c0d01e6ec5a75ced8ffc6e739a3629c7fbc96cefc7eb090000000b78197a6dea56f621733156107b37a64c19868d06e568763e96d6b2a353097d5d8ad43a39533798acfa749645c7c907bfb3ab2ccd4630773d74c83bd1ccb8291bf98550a8c41a5ebb1d393e2e952a179f9241d80fd69b4d01fae0df2a89f4b90a60567b0a15dceb752605e2a68df3f901b9b7b5b8ab1957d38ba2a7f8a4337849fd7374b42cb8107fe433751ad817c98400000007e0cc9cc4da9e07ba88bcee98d7b3b57905a3718fa273a3eb9afd0946270b0c3d5e398a0d9b8f628a05a371f7a6b6fed588a8fc7a5ec79f177e47b08a70ed778 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427763552" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2120 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2120 iexplore.exe 2120 iexplore.exe 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2088 2120 iexplore.exe 30 PID 2120 wrote to memory of 2088 2120 iexplore.exe 30 PID 2120 wrote to memory of 2088 2120 iexplore.exe 30 PID 2120 wrote to memory of 2088 2120 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\61b39796429b06cd20b223b129c88cb5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c64e619d78917f18605b1a69a7523ae
SHA14955204d29844ceb8ee5d2d5c19995c8175322dc
SHA2566851bd2caa9574b6283aa16609432a1dd6178147c1080f0b1a68d05abd4f0756
SHA51297d72db89d8888a67e157e6905c20a040bbb06eb4dc8108c852ca8d762f8200b482b5f098f9fe29c5527fc67a162306ef9a82acccbfa5d035cf6e03a64f519da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a49c6154f6f8e9e034861813bff9fec2
SHA1eae0bc4d9511fab2564b313d130a7cd2d4bd1c24
SHA256f3f664d41025f4eaa20d33e51463636c8eee10cedabd7368540d8547c2a48024
SHA512fc8b7de9b53582a22993d6882445e0fc2ca1c65f8f51ca8813dd95ced1cde3e16e70ae8745eebf62d6628f9d1d5a1cec96ace38c1f451269b2393809ffe362cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a985a11742a1b37cd366aed51494084
SHA15b85c044f706ac8db14ea91a1e50bd59c100405d
SHA256a3d61c0c6a8bdf3df26b99df32a77dc282eba6ce17e9e9cd4c7cf907a870cd01
SHA5126ae5b262c82976f8c9f9d34318a0701a0305adc8c3cb4cf0ca15b3dacd74465136f33d13a66cbccbf5379481c1a1ecd9b59ab2d8d15701a868d470debbb14874
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c70aa4b0735ac6bbbb862f6d478f209d
SHA171dafd1e170e5d3c1794f6c5c96fb90f1d89b1dc
SHA256f0f28c4cdc3f05e44c5c7dae6e39f4bc5a54429728c98835416d6e5a856cac83
SHA512647176fe89fc135ba214ab78e09347c7de3a32659790cf1b956ab5d97dd8625792271548f1a76e61b393f13906ec25bc38082581f10df2b30cdb8662386cac49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f830aada90e20020b087e97af22233ed
SHA1cc77e833ee1678567285b85deed5d49cdf8d40cb
SHA2562e064698c3b6aec02a41f90a9f953e5c745065c6ebaaf856e895e7d215367646
SHA512d43015b21bc159de792edce17bf7c7cc094480c224e722aee199161bad80adaa7e754bb386278a39c47dd728b893c1d65d41d812e9eaf602ea2c1c38a5cc2e70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5447c355521e55327ace6cc36bad797b3
SHA1ca605339d58c5c521a4bb36d1ececff3ad5d6fed
SHA2566dd892620f4062ca42efa9f09d7a96e98b6491b3db456b505b6b003dff6afb6f
SHA5125b495a3a9ea9fe53358cb97b846899b7b46d9b34ecc4f4ea5cb6ea10b99a313574d15e6e604b18feece4570a2e55fc9ca2904e46207f04e0ef73e113f6a4ab2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aaebf028a4a5b7e0744b5229d6cd9962
SHA1aab415e2932095445b458ac055a4db73097f638b
SHA256608aa05fb1144fb4d994264cab15d0a1109d487bffc0ea97f559a03302a4dff3
SHA5123005a88ca8831d70feec45b08dbef4b4dfc1299c79f85f86f56c12a5819783565572efcc005db62abc427ae84c17a7de673d17254cf78432a93a4f5d0b908ac2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a514927716175e505c5fa51692cb61fe
SHA138125e24f56318ca9e22c2bea102a45a1da76f8c
SHA2564c3231c81fe44bfbb43dd18085d3917e6baad4b6101d36029fe7cb0f43ab5258
SHA512f158f9fd9dc698fd6a8a703e15bb7f0e6aa87885f8c72afb238837e5229a114519a673a217692df0c921b4a43e2547b563ba062501898addbdfdca59989d19b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571469b7ec9a32dbb00f0accd4d6c9e42
SHA1fe84480da434e8855d8a59a526348809e11f0ab5
SHA256e6f40ab6899505ea4894432b7fbf206a1bd335f8c0d5e3f03e82ecd1c15e9e59
SHA512a0f168efe3365acc2f634e03f3bbfcf8da55f44662790b2780ce54d3975f52efc10f366d98577b52aa661450324d40e5f1ee467c9610321b9b5a7e3f6b027af2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aaf71619a632748f31bde4247e5e27f2
SHA15fc7c645242b4e145cfcab21c37f5dced1e3135c
SHA2569b1b09109aeabf217ba1dd40d2e737989996cd08ba9d06cb8734d8639cab9e31
SHA5124d228729fe79275df191e6e91118159462c2f2c631852883e62e8629fa2652b6079ab433c9376e279eaca9704a5c2e5a88995a003717e6ad737b922508103df0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5444b09c7418a58f2b3381155366882c7
SHA1dc891f8fb7df0fa4ddc0d469376f160c240d668e
SHA256cd88e5abf503062ee9534b4f16a06ca6a01dbdb29824c55c991df664adda552f
SHA512586ff171536acacf62a5f5f14b65ebaffb5a2462b13b14983d62d961996d9be3037c00b93d5192b0f66b9bfaa46a8e59754591bc06a62e9d83764dac9a84e201
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575c0670d12f29db0ce1f0f2af618b77d
SHA13cc8acfa0328864b1fe4a79eec7e3eeea24576af
SHA2565d5eb72ce3076c1dfabcde62ebf0a0e82e12b1e3e85d6e387502b09ae0a701b3
SHA512267b3ca15d0c281e27eee4a2c1cecff1f9721f7d9370eba1a82c679badc5271c16899d21515337edbeb53f94b9fdfc46c24ea82080ee9a88f1b1a6482823f413
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8280348f45991eb6e091beac862805c
SHA15af12992a56ef8474d8a80d38967741b198a963f
SHA2569b2caac8ffb6c8b74e8c83acb351faf4f5463543040079188b38dfb43530ccce
SHA51249119f4777bc08594a187184b56eee525ae9fc2d8294c5cc69381aa23db32348b9544e977de703166f20039ca16baf514a8811ce2c625ca76f1f87f3c4ae2966
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4f66c956f676ae22e19cf9f57744a4b
SHA1952e6fce0122f2448c0296e170cb8d0271b96eb3
SHA2560f2b67332b9bbe0f628bf28e23fc4350b17d95f203810696f172651557fe7e85
SHA5122ddb4eac28b3be50cdfd1de6d587d88446b649d5085f6d9a701f85a52b349e4eeb75592f6965ebed8782a61cd6f93cedffa322ecd2156bac7058de012c13c1f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541117dc5899e6de15047fa83932bcc40
SHA19dba05d8bf9b200105ab2caeb11e49efe9b1411f
SHA2568c85c9b947eae14b541073a19a2e3e33469c0958707fa40be2be1e103c8d97d0
SHA51251905e2ae601d5d27d043e50386cbc82ed372e4288575bcb42b4171c00e5b5f723aa4eafb020600f5fdd8aeb45ef67d19e9d2b76079735b87036d070b0be302a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc5596f4d0a45868f6cd723867676bfb
SHA19ee65450535a5f6be3a0629eb88ac846d7f8e3ae
SHA256eb762edbd0879f806c056f85f1712b341812a9d6886c93ebebc943dd3c538e35
SHA5122a085c1454c037e2afd39bbf580e6880194376f736092f2a20b8f5aafe60031c9d06124882aa8c1399efc1c6b4450c316f2c34b70dc49a631fe386da87d2af06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9877e8556b9a28d8693ec90f93724db
SHA13c441b217bf5543bedb634432d6c5a5abff6e51e
SHA256206db18f7c3220d47b75c76bbb1bcec22d3d91ef763c06cf02b3ceb82254eaf6
SHA512f372c2294f5f369c17bb7d618b4a54c723dfb2745f66317e4d16ef9d0840aee1c1d463cc796e744ab7bde42e5240b72b1a33d36fd7fe7b2e78875a4666d4e15d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b8c6337905ce1e7007d277739332460
SHA115228c0411482e673f80963722d023b87deef05f
SHA2564900825e43c1ae666c4cafcbb3f4a45785cb4e276e6f5800a4fc1af33fbebb7b
SHA512aa08b0557b9a87ae2630f25da8aa0c037e0e2525934efdd7c66c3d888c347948c39423770a6365a94692dc789408a5e02a457b138654b11d0ee02efc99fb3897
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7c3f9b50a1e75c26cde0d7806e9a1d5
SHA1ba7f69f9fcbe9f01ae518814c66e02741fc2d325
SHA256c6d3840ed73277d0cdbc35639b536fcee28ecc1f87d51de0ee25a93022521a93
SHA512a57e18be608b527189ef74b4fe03307f8571d5836a3297c3f7ab0858fd1e633582b6e0aad1f04f67b41488032928b57dab22c2ded1496b568e6ddb8bc04bd693
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b