Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 05:02
Static task
static1
Behavioral task
behavioral1
Sample
83221b14d3f7d611412099e257884393_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
83221b14d3f7d611412099e257884393_JaffaCakes118.html
Resource
win10v2004-20240730-en
General
-
Target
83221b14d3f7d611412099e257884393_JaffaCakes118.html
-
Size
2KB
-
MD5
83221b14d3f7d611412099e257884393
-
SHA1
ec25a7f097dffc2b12ccc77ab279dc7bc7aa744a
-
SHA256
4b87de18c47cb708aa99e2da4c27142430e7abe143420254202652c81aeb076a
-
SHA512
30b4681de05231bc79810b1b475c64db2d8dd206def90cdc137e599ef5be128bdbad604226acfb0464baba11e9b4092d89e668d87caa654a7c9a240a4ecff24e
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428736816" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f49a3f99e4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000005938ba77676989c07f073bfd1e693aef50fcd4e759f4077e7b275a1fa22ded85000000000e80000000020000200000005df5951c2adc59ab949cbcb4fa673c2de77039b46a001c1f3a23a25918ffa56020000000940792e7fb5717e170f903f2aa46c2f3902dc69b16ceba593152bd3e5b2177b840000000493ca34e113ffa425a5cb564ab81ec6d08c09e001362b37744c20d8d6bf5016bdab13b73dba3403f0faab25eeeb17575d5e9f6067f370f65544a49ffb90768a2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000f88b8e5e0d229d27559237365dda4138ee4b543cb75717546b8ab7f4b7f207ce000000000e800000000200002000000049511ba2a39167a02cd190829abc5f8746828f14a58fd31eca2a24108df3bf3b90000000c78635bcce731ba7643d2fc8d9bee9c0fb31afa2f2e7f567b43de68d0ee396a4aed8ec673e95a9ed01c4251bf2bed68a83ab29a5300e7e6bcb24f8337d6cf99226988f893ed6c0b0d36b7aad19a2de49a927fc5df3f3acd2ba2ba9859a04a229fb87f8709c4561fd2e70b0cad2571029d47545a5fab7c241af88546199ccd8009c6aff6338997b67fe11d186adc4e75b40000000bc1fd560c1c3cec9eb843f3efdefee01145b50b647a3c4f7711a1853a63fe229c76963353047e9e2e359263bac06d49f02e2d5c49023f77fca9b3aae3a452880 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B0A4771-508C-11EF-B88D-EAA2AC88CDB5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2248 2240 iexplore.exe 30 PID 2240 wrote to memory of 2248 2240 iexplore.exe 30 PID 2240 wrote to memory of 2248 2240 iexplore.exe 30 PID 2240 wrote to memory of 2248 2240 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\83221b14d3f7d611412099e257884393_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5bd8b4a02ca0b5b8cc3c362e6639a97
SHA18d61c71e0f04420ed13894f0139cc00cbbb5cc64
SHA2561267debf723fb191d2be951d075d6cfdee57cf859fc73256eaa9f6950bec489c
SHA512a6df5e16c0051f276567bf9ed755184399fdb6263770177b2a978c4608bdc829e2d29558555745dfe689f13df163fb5471cee2a0de2949f5e82ab51e22d7d01d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500407289bc55dfb1055174669b3ede37
SHA1940dd27c339f627fd87947de87e3025834e25746
SHA25642ad4b72d1b6ade756db9958c4c2861ca7e7358c398fd18b60f9740b6a231e51
SHA512f3b6f17e1ae7c0d9493c2dff64a0bea7645cfe2d0b43101b059bb43ad3e7a1a61f5f34dc112c718d048856ad5dfaa4d45916eae7ebf9dc129c26133226d6f6ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576c7eb408159e3d2b3b2b8b2a5c059fb
SHA1a7318642b8db6a1594668f8f6e363a20c6b4c359
SHA256c47fd48e7da88e3a5c15aeda022bb24b3414da1f2f945cdc2ef8098c3a2591d8
SHA51229f5a864076bdea6fce5e65bdeaec9810023d676b3468916782dd579a303acbc8b9d764fb588ed26b28af85c61de1eb7929d865279fd139e960ddea2a499766e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594d614c2afba2c8897a461f48a1ca7c5
SHA141bad85df33077007f1d9cfe8cfc58f1d1084647
SHA256becb5cc3b04847f82494475a40006cc4387e7cf4b89c182836da432f374bbf63
SHA51248e54b8d4f09a299bcdc6b20de65a841ff37119f8d23460b9964791c05a937f5b48bf682066bf38f8522683b951e1306e4dc8559401df8f042d9f0de6c04bc83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c6e95b4507de96aed8ca58ee701130a
SHA1f8ea0af50d95f5728b9842403bf53f8eb5473cfc
SHA2565a3a788ead5502d64f036017bc791f3134b088325c3fa0b5c6d222603b098a39
SHA512083ede077c820ca75c841a7901bb6d539889ded33f1cd659d44419b2af80ec4a0ef7520f07b4e461e192bc3a12401bcc77da61fc6644d84c27473769d3400052
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528550f5f9477cb01c792a68e303c5e01
SHA16ae5184c2e0f7a3dc3497f698b84641b1b770533
SHA2568f21b66ac42cb5cc76b6225a05d427b85f2157aee6db285c768a1327ec2e1aac
SHA51286ffb2af62f3110ed387005deff8fb6fc6e8c45b5d700597d05c13d4b19f2a4efa92ecf970437a53f30468d495d69f295363bcee7178b674b0248363905a862d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9dafec1d2659f5b4e2a4e80a833a144
SHA1185bdab37e2cd45c2ff2a33fa9ba3343dc3dd203
SHA256f0cd08674918036477d2d86116a047298acdcbeb5b47d48644dc146e2f7407e2
SHA51259452414bd5abb9f7ae6c69e66485480eeff49979fd951ad701285dac56ab9fe7d7ee4f5b581941d078d96f974fd21bd8100e1d2f9fc8b69c598f557ad461a50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528a99af0563528e6c512f1e366ad48bc
SHA17964302bc62aa32207cc8224ea785f6f51cd5e4d
SHA256831b3da9ba0b25966009f969fa4308ff6a6d33e5b77bca415d96d13bb9f1dcf5
SHA5122e02bebdd62096131b830d2a7053d57a52e90fb0e4d10a0d2db3e6b76eda4468800e03f08b4bb630a59185a303862ae4969a1b9231eca5fc61002a43334e5b99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1becf8162f69005a1182ff808dde37e
SHA12a8a29a35b67846260f530821a676ad9190e355e
SHA25648f1b1b0f4548cfdda6db6a43b35024f56074c34f92155c855ecb62d1d7131f7
SHA512bce0b5340e4928a161ae08bf69cbfd67e9b882a8548a5e5f28b3ecce90335171fc9ac1d8d59b6c46785a0fe54bcd8e6fd91cecba0b9ac5cf6ef17e232ddc5bae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531f635f9940ee28f5c17a898e997b17b
SHA161859234b8efd32816d73f829f28035b0d606e9c
SHA2564cac418be4986bff29f7b8b025eec4f4052c2063438ff180d112871bfcea8a39
SHA512d9f5103c58ae62414379fd821724eed02b188a28dd9cae4ac4f44401aa0da7a29bef6808838d04ef2ebfd97de19ea1acdf9bb6ad82e3bd90364d4775ec5334c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501622655d0809e8a0151b0bfaf2e91dc
SHA151f33cc0fd15c9143b516eb997e0eb282d36e8c3
SHA256a90970fe1bade78f9e9027a1dd189be8b58f93514efb8447e6a3760080573a3d
SHA5120775357ddb492d1a3ee9c50d9add3893471a2b336b193a91685d3ccea66d99d2137dadf5fd2e36f1654d856d762e0712a514f18b11e8f4e93d4efd7dbfc66f17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53624d1f002bdd1f7b557b6525c1fc0e7
SHA15d66c661dea338c85afeeb15a8ff00dfc19d887f
SHA2564682001f6d035befa26ebadae5cc3337b033906d8a3494ce894a22c05342a698
SHA5120dfa3762371986db9c8721ca02836831766f35a41549d775f2f1377332a6cba9f24126f5899ee9a55c5a9dffaff1671d12f250fc9cf2e8d66f3a45c5dc5f19ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534d47eba9f7da11c177f63daac2702a8
SHA1739efda82e1cda9e00f4da5010b92106c3916ca3
SHA256939d308b4f9dd9edd225ea6a7605f20a3ca700f3eaba7e03b668b95fcfe20e79
SHA51236cea4ef6ffccaf465af56e1a03fe3eee8c327ea97faf0f83e390882f256c86b9378e5955fbcfe47d65c43d0ea2bb4cbbc27f52f00a18f8ac7c2f62248e9ffbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552878421ccd2a5580f38d559586ab08e
SHA1d3af58e5e531c1b0fb881a1dc754a73fa73a554f
SHA256287cc48281432306f06162a8d9adcf198bdc76c15cf527fde951c6011c57b000
SHA51278b98972128da5c7d5fc6f56988b2230c9147df82a17c0194c1777b8f36957d36ad3b58449c07c9bf0ccbaba26a0d142220eb6956017695b61ed9a9b0725cd95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b95988a3b5990e12697fc034464ee3c
SHA163d21bd0e5f7ff9d6813af8af6132ebee1467a21
SHA256c2aadfab258156b3bbddf52e661e63a5d098e8a3321768e903ad55cbf11c2e2c
SHA512614f73a18a65bda95492a66293fdfd697650e3a16bc38e66db6d282b8c3bfab1026870251ed541670bd0fd0aa93636da0edf946ac6b678fcfac31e2b146da07f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f6844b2f1b7fa6003d41fe026558721
SHA1ee98d9e821247ca7ea4c77a0cea274b8fa2c91c9
SHA256cfebb05793028f633b42346885a76f2bc6999247031b815281d1a9f2258437ca
SHA512dc2a0d51dfa0e7f9d2cdf555e247d66ff899f404b164ff6c1a1eac6b3615e1e7653fab813740301e7400f8ac2d471d9413f8f291d888056276611d81a4ddbb5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597e0ddb4199984367fa390eac23bd6f8
SHA1899fadbbd895c57c57adecbaf531f2590f30877b
SHA25639a9c08ed14f8297c215da44daa4aa3684976466e470e6385a2474390d26880d
SHA5123c4f28fc551d67af32812eab5c1339ffcd19fc0be74a7f0ffda2216f8029106cb6989f67fd5757c315bc07996c629d4c519932f55c016e15481c9cbe12666ac2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fd285f35aaae336e713ffb7049734e9
SHA103e41808948144105484019f76cf12050192ded2
SHA2567e81ca19a6c31f0641909c4271e386979d1b6b52e8a0ea38f3acdfa6f8ce59f5
SHA5122b367ff6d1819bfce1416872ab72c68b5293b41c8e9eb43965a21e508e145b00fd4d908bf3018cbaa32565d4ecb44842a184ce6077b4187796de7f4f90c75a06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517e6da8f989ac11e5b169fae64db943a
SHA1295b3d953ab9d6fed8c72691a7bacfaf7c4171ad
SHA256916b8222a8e41677241b2e898e564896ae68f8dc8e138cd1dbf38d653a13c474
SHA5121a8d37a9cc244d09c065ae0e2dc083efab51dc91cadb2e0a278ff8d0f2d7a7b4d45f15abefd27dc2a725aed71e1742a71217b513e3569f00eac67bb70592b569
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b