Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 09:44
Static task
static1
Behavioral task
behavioral1
Sample
6711e3e7f08d7fed5330dbe3782a5c15_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6711e3e7f08d7fed5330dbe3782a5c15_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6711e3e7f08d7fed5330dbe3782a5c15_JaffaCakes118.html
-
Size
62KB
-
MD5
6711e3e7f08d7fed5330dbe3782a5c15
-
SHA1
cd1d093502cc25d3a73b6306e6ea9aeb5298aebc
-
SHA256
10d80e2b89e4960390d9fabf42b2179fd4bc1fb6a4b53c84e2c0cdbd681cf842
-
SHA512
d14b01de3d04d60efb538ffdf74d0c5a144fffdda7bd678be7dffcdad94e5715de8fc94b90c30415f61898bccb502a9867f21cff9510cb904bbdc64d0bbad23c
-
SSDEEP
1536:dyIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZ1e:dh1scpql
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE4679E1-48DB-11EF-8CC6-7ED57E6FAC85} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427891387" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000c62c051d49fa48e4f3d6bd357dde634808846892968f79804ce347660425a4fb000000000e8000000002000020000000d6933f5c83785f5c7c4801532c13e38452f9257909790092c447ab79b148e33420000000d85c9318ebf1556ec6faa4bea1ba659fbde41f054a2a2bc711fed66e9fe49192400000009f5d346a02ffe7d19571ac8b642124de2d69048c1fa251619fe0a77cfb3216ff9eab38c1cfe79f2279d9ffdc376a6e59819ef89f96293eb5a5df2fd933cd9c47 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50401dd8e8dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000317e06d8e0d232dc61ba553b056058e6d8268be9a93028a01243a7364f5c2ba5000000000e8000000002000020000000b47047b05ff2d5f45ae9c9e12b0466a1dd7a615219503085ddcafb37b25103ae900000005d2ad13d23f3f922cf7b11d4e563dc31e9045cfeb912e50a16e7f176b0b09d6517785a9a6288e0955a208dc3ef526d94cc28e85b9f849af3341f500fa6eee4fae84471e5c48f393068799413b2ffb9c998bda15e244c37eaa8306ed2cd948a16641befc8db9aeb3b15745ee2062e3d8d03f9983f364d21a2621df4a4502724a8a25c08f57ef95c0ae4254cf32a08388c40000000d15e1683275db0cb73c3405ec379c060c9ee44d58b502c1c24caaf73d00624056cf9f85b669c0d4a001c739adb19c74623b1c746b05f369edc454bc46af601c6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1712 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1712 iexplore.exe 1712 iexplore.exe 1916 IEXPLORE.EXE 1916 IEXPLORE.EXE 1916 IEXPLORE.EXE 1916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1916 1712 iexplore.exe 30 PID 1712 wrote to memory of 1916 1712 iexplore.exe 30 PID 1712 wrote to memory of 1916 1712 iexplore.exe 30 PID 1712 wrote to memory of 1916 1712 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6711e3e7f08d7fed5330dbe3782a5c15_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acd8d41c9a727fc27996f44c8c08207d
SHA19ba68aa36074331667b4846d4a20366f8b406a9f
SHA2560921f91889e65585c086ba72f3c08a6441bd80ac91c7e47cd02a9c1ac4668a8f
SHA512a881b44157993a9f00ec5c9d24f41c99e6bcdd3e1002a59caabb7a345ed8db4782479854e3f72dd21fd6ca3ede175099741ba181d49e6951e4b9cc1ee69b4f02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b70055fd64bc6e37e9ab21e57bd136b0
SHA181769c1eb6aefcd764948d81daf955cb42365a4d
SHA256c57d18714a413e62243265f23262aef82e2b23429b72ea4ebec7e4d7139f454b
SHA5120108b3e419238d520bc8edc5c55cf1c705398824ae9332b2201efd678f3c158331540b49e79ceb51cae4ce23c9125626f490608c62029a30c6c732004e0d9ebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3bc1872829c19372a95dbd2bce775ee
SHA1ded3b0a5d4fb5bb4e7e06bbbcb266cde066d0021
SHA2568e2784f4e209baa06595e5a7c0b18ba85357dc36e94594c0f7123409c69ebb7b
SHA512961840ae9e29e30925e1ce174e3bcd113d844513b727dd53be72475fd1efe0d3b37fa9baec15b32dcce3fac2d1f909cb7ac5f2704ddd0b5214d28f588c03ae29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52585fe452037f97bbc041e34813203fc
SHA146767694a3c76f874e112f9a727c204064e17d65
SHA25657de2f85fa5157d2d1834842a551ac4aa7563c78e227c2ec71bdb80543c19db4
SHA5120fe947f178548475d5bce5d3f3e66512db6e75e0e84bfed060fa60e802ef6ec303355750f8c1a0da581a0ac6c3b2c1083883ed68298ea50d8985b00e3acf03ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be2351a2cbb4a032f4c07ae73ad9c205
SHA155e41688b6291c9576d1778eaf61c594420c7884
SHA25650245a1bf6ad4259f7b0a2efcd26c48ab6e35179ba03f577f70a25e745a12098
SHA512d14af42f7f7d17742f1c215d4c2bd1f9037c088be5492b13cc74ae2236fc9252223fd14afc3f9a5ac9207880c826520cd91047fc71a19dc817983fe8dbd0e013
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a865fe6441febb3eaed98ef5216dde64
SHA157037c445024284284e15327dd04c419505511ee
SHA256037109010b97283735c390a2a75aa4719a8b1b9db7d8e2225a2940de890d24ce
SHA5124aa8cc73a1975dc4e88ef7dc9acf2e30567d0ec69b91ed2d9b946a81112bdcb56cc24a596f740c79c5c5d6bdf1b38520188cf72e49e0b9fb6cdfddd0a9facd8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c8ba3eb694b04ba52eb14ca6e6bc95f
SHA1bbcbb98785671d2dabe07c77d453664e294bc45d
SHA256bbbeec5726b1b3d273ab34150679c25d66028e201ee780283cb3967983e1505f
SHA512bf58642bbcda24374445d59db0bef5da13123ee0da4f2e3a71af5a99d9d55511bb9c7f91effba46439138220115b6636bd1625c7ce81eac62e8968270390cc35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fbfee51e7be696aa77ccf2953622e2a
SHA122a6572349f9d065db86a9f46e361caad2f1fda9
SHA2564b35e53c3d8b70ed52d4fe54af8591877ea38e58d66d9bd9ad77c7442701a32b
SHA5128fc2c521f65cc80d45c9565fecd78575ef487cbc8ae15cc920eaca17ed0cdae47c0924aebc3eb7ae5a6c98062bbd097b299f296ef99dc6f2943951ac853d3a70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5feddee95f3131820869d33923397b29d
SHA1f4beb4a78469abc50663eb77083e92057112f3ae
SHA2565369b492f970f9e21b4fa1a305e28df7a6e6d171a3e69b6cbcc59c84892c6206
SHA51233c7258806944703dd4f92ea511264a925e5ce1680d2b3ac707db204d6e5868c5cd802dc02a53f86b3bb124d42b69782e04de51c357a8267a55fe6ce2ea4121d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5133a688712d40a98e9a2fce9d0fd2c5c
SHA15e6a8e8275b89e0e40b8e20b6d3aa8164a377dfa
SHA2565be02fdb06e7a49ca3a05c8556f1476e3ff4cb6cd8bc9fabb6cfe7773b9969b8
SHA51274316d224f318e038e61d0e89d2de9cd2b97b9cdb895db9128077e2c43f9f1fd112e1173e6f7ec9e75ed3e29ec846bae2ed6cbbec7e64b22d2f72b380ad001d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52348ef966a3f8ef6dbb50d02b0a85dc9
SHA1ff07107ea33f72f22b6e25eacf695a55c8a86695
SHA256a5c0f3a25bb2798f7253ec73bc58b2b510a45211cbd587cd7b9ca0612e6098cb
SHA512de38634d32c721b81f12b4508ef759e812af9f78acbd40750e6551ae9c94f7521e70d23e986e6dbfa878261f321fac454e951e98c301a4b13d0f6e0d5a4fbb71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5181ad91efe5a1c8107a5bf4607c2b595
SHA1cb2a2482391bac960d34518b374c692f7f96e75a
SHA256a23c00644160180c33f09ba604600ea5b9b54c372efe59d84403975c1af30a04
SHA5122572a7579adbc5bd79ec9d0bc8913010708c8730b30ba1d0cb6b585097bb8770f36dce54ed19acf1beb692245d5f88b824af54464838d8fa2ab3ef844aa7c0a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9d82c18a49bb2301240d451a134c3df
SHA11ed61a68ddaa5c5a64dae8c11db00083610e6acd
SHA256e7468c308df865deeaee050519606dbafadfe796de3bcf8ae62f8ee6d37b6c94
SHA512463b4a60e23ca7eace1a2e1fded092ece5838cfa099af0bab140ae2a769adae3f17fb5c02ccfe71d14b8858dec4f9697d8a22f7e4bb69d2f705624dffed527aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514eda2736330516b4e706c408855dc75
SHA1b1fcc97f16f4e95610eda03e1e77a2e50c375fca
SHA256419b8ec6e7411434639f0c01f106f9bcb354cba925742690e81a4a93ed057326
SHA512708e05082356eb83b5ae5052b57882bed0e0e3083e1796ce5b8397ce67235465c47b2e162c51c41958f208668f7807de3c287dc223d43b4680fe512e2e180659
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ff0074bcf123dcd10b3560f44475c5d
SHA1beeb95338f1d5d34aed502ec64cf74ce1079ecba
SHA256f92850feb7c0c60cb925bec053e08d19fd83af26fde445d2430365ed37e7f268
SHA512e78b6ba0a59e90d7bf4d7fba3038837098d123739626dd0e86eb443845e4af192b9331621137560df6dd59cc918721d20441e45b452565f12cd5af85d674189f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543f10e2bc18c0b2ac10ab3e42142c125
SHA19616f2b8b3794cb3baeefadbc70a3ea767aa4785
SHA256ff3d014618af670d8d07e689d3c97a8c482a45d16eab7d3411195752947f4e32
SHA512c0ff9657b7d6f63ce429d757c9a1ad7c0095e7ea098a5c808144e7db9b54208b413f3bb5b4964784cf6115fa376ebe2100c2c4c90c5270de07a59a20dc82cd7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515bcd0b80534a9c28998fef5b6e42878
SHA17cbdd6eda1a034672a5762233366735139439dc6
SHA256197df6c24bcbd7244e3533553100a888c087dd59cf8bdef4e4a695e2b5694398
SHA5122b5c261da4ed60bf4ffb9bc045bdc1171ee7fc36d45b4d5faeefdf031c14e78db9fa8a9a2e466e53b5f38098d8099437070198d706ae1759f83370ffc48cc347
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57da274637b7184661b3bdfefb816b29a
SHA1b64cac0d7babea2ac2d27db49558fd9444f6dd04
SHA256dca5b25d29c4805e2d1f3a24896698cd228c5ca5e42bb3e40c014fed331e3fcb
SHA51211c934890c82361f5b78ecc742a2aa16d86ff87ef4d936f60dac1dba0e7af128d597752cc58f79af73132f4adb74c398a3ac5325295c6e5e6beae4b11eed6d9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac7e3770588a46e5f8296b12cb326178
SHA11dceb8bdebe1d6eaed6306ceb48486d95254c24b
SHA2562d3855c3a34caeab946c0cd0d9e4ed68ee843d754c97afdb47158f6375a9a9c3
SHA5125b532be01eb229a20e4b581b6d5a47be121778e2728537a58a72002f575dc8c434ee172171922d328c2fb15bc93a30472cee945f3df88f22ed677df849fd142f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b