Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 23:04
Static task
static1
Behavioral task
behavioral1
Sample
b134cd2839e9fac745127a3c143339c1_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b134cd2839e9fac745127a3c143339c1_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b134cd2839e9fac745127a3c143339c1_JaffaCakes118.html
-
Size
8KB
-
MD5
b134cd2839e9fac745127a3c143339c1
-
SHA1
b22e477d8b30c6d0702ffd654776af0af28b6b3b
-
SHA256
73aeb80948d5cce5e78d756ddaef1aa6d7304302250c96893ce90f1144f9f5d9
-
SHA512
2408c5943fd316771e10ee9a3c326466cfb54f08a22ad480a7a0cae07816283c764c4c931d971629755260ed22f4914d450150f1e5c005d0e72d723f69ff93ad
-
SSDEEP
192:XhppaaJ80Bh1C0Eb4xVLE0RUIGsVjvZrL+EMjf:xySnLXCDQjvZH+EMjf
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97F23E31-5F48-11EF-B585-FA51B03C324C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430356954" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000ced6972a665d0321fd40722b4af98f2e7350b4d2e1517a5260bdb8607457ee0d000000000e800000000200002000000025eaa75763f55e8fe8b79f5bb43c269fc4852c2a7869eec5fdff66be62717e8120000000e7657c61ba0de4a6971144e5bd17840dfe96831533d5607eb4ad233882954ac84000000072c834fcf4ca0e5d0e29583bbc631b0bc48851bec0c4a2b6d9c8242440de07bd335e6e6b78f9fbd414bfa484c0dfcab8135b2b6e81ceaeed566bb901a5b53bbe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80fc7b6e55f3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000439bf18ebd233b1f1d599e561ec08d426a8781d43298e8ffb499f01fb284e8c0000000000e8000000002000020000000daae69020d70bbf50d8fd9794ccf6933653254b4c05690358ece53370dc2d1b390000000c9951921c4fe551b78f7005d06be6a6b3472ca7d2fa5b55f73e58880b2ee9238e4e72467de4db8c886e69ecf04ebffef67ada5866104eb03a8a4b0c1d4a05bfb2afba4c45b8a8cf2acc9cf4f6fe27a466c296e9841ff67c38a6c2f07d8fb28fd13e6d6795ca9a0cffabe581d3afefcd745d5ac61401ee68a9ae1c7f3146e5781692678b7a1f8cdf14f6c62ea43aba11a40000000efa45253ccc9436935427cda02b6ca9e632cc9fedf1e6c9c0cdb75fa4bf6f91da616aa2a9f420fcfd0f7e02965ce03b7e03e27ee273c262696eeeb01dc9a0592 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1460 iexplore.exe 1460 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2216 1460 iexplore.exe 30 PID 1460 wrote to memory of 2216 1460 iexplore.exe 30 PID 1460 wrote to memory of 2216 1460 iexplore.exe 30 PID 1460 wrote to memory of 2216 1460 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b134cd2839e9fac745127a3c143339c1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5102141f9a1eb93ee71426012168434fd
SHA1bd3611d087a5d3bb742810e1e418727219f97d0f
SHA256f1ab630b02312b03d1dffe831b581e8c054f8c2cfa6090727cf5cb92565cf57b
SHA512952e0d01636f4928016e320c54b83ee70a156d392db7dd5ae2f941083090f1c28fe97b207b8bd56d9480d55787e878d49d2daece4349db621e903a49a8f77c70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5127b57c21dc1ac8e8193a829877193
SHA154549e25db13e6bda79cbcc3a39c3337b52d01bc
SHA256cbf325d666d949af55be34c3b5a3527671ae413dee7e4e8ae67a2af2aabaca8c
SHA5125745dae94d4de6518e55f003cd08562e1f35618b4ce1c50e7ae0c1f9ba5f6efb1f1784905174ec7e22127bc8094a693ce6626ded77deffb12b2ac2728a5b90e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cac99638743c8d89c068ccd37311991
SHA17baebed5300f6c1b735b545cd676eba88864f55c
SHA2561ea3b8eb19e516e962574fbf1c4c60c325da2314c129dc576f1b5f35266e5a43
SHA5122e060e6fbb26dad8542c4e989b13a6ec8c9fea79059ba70e79b88d08cc8dd8b87364e99a029ce906a1a1a71d4000d1d5aef78c1fab1fad24688af12c7cfa4519
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52aebff6fe819cb7eb94b54db47bbdab6
SHA1ab4a57321648b06d671f1756f660e43a7852330b
SHA256ee150bcefb8a97f91455404823299bf9b61b9b265d563381e797f7a6d36d8ddb
SHA512945da5e11d2944eecc83c0f7df4b0e6044b5b3c8e4c4954dad3a9ecf2d7fe49353d83c80c425c15d686f9513a9ab70fa27c863476e4abcda9147b6d651204be8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58202728efdcc824efa33d7e03d2d20b3
SHA183b31c5fc888ad09c83e39a3c0469c0c85a5a88e
SHA2562bc04072fa3f006eac4a2ede8d0d719114593410749ded49dcca7c03bd75ad15
SHA512331100854f15d07254e6b1f5159b7013a25148c72fed2fffadb8cb1395a50a91ac9ce0a23315ab4267046268957a4d150c8e4c97eda07caf07ed490b1457fbe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8e0c7527233a50eedbdfa0e756463e0
SHA1d1d9b50cf1308550da65785f8f764650c4cb02a6
SHA256ec9a48ca15bbb9dd259d6bb78ee61529820a16e1827b020db0002e5ef074cc06
SHA512279a86ceb38c1364d942017122aebcd18fee96db1dbe39d2d7d334220813d675ea505f67d91ef674ba3f82b85ef42208b6e8310068614b704b3ad490ff28c8e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b76976276b9c056e14557154901652e6
SHA11a4460156aa419d14232255fa690772a8ca00889
SHA256faab2aa29b4007c42c577b16f73acd6820e84b898cbcce616b0c2da4df58d60d
SHA5128f4c569449c0e2574a7f65690bf0da1ff1021b4a846d03676eb0a6483deba444f43b59aa203f61cb33ab49e8d2c8a4497bf2a1bfc2f64d278bd42c7fd251f531
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a39585804e25823a484f1a8c83f6d060
SHA16c8c5653bf648e0ecfd32480d6f3d425b3b4586c
SHA256c69a0690a0c19b7134fc3e133bc495043baa4ffc8b3bbdf16faa43d26da3961a
SHA512695a781a83149b7222bc53dc6957a7ac1d9ad82569390d7f8699362ad67fa8e1f7203991dfe495858232b583942d873fef44dddc1f9734966c86fc16f089e2d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579a6547f15f8fde8aaf1f3f2085ea25e
SHA1dad58fa53538b37fdc078b622df14ce0916712d5
SHA256d9b8007ad2b481a319a1608745a44fb4db354f5ee61b5790880f8363a68d8e4b
SHA512c70d79adc7dc1f2e2628412f43ce37cb4b221d6a5b90241c0b764e70b7b2b2f40ae619f62490b975d28fd36033e9704b52fd3fbf2a68be3806af5e9fe944cd05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a6a80a191b096abe118d6469f6af2cb
SHA1c0e6fe344a34aade4c17bfa1802747945900b355
SHA256ee9993ae4b97ab24d64b94f261f3a74fb9fab38576c086ef30736a249c80e8f0
SHA512aec1bdbd2e1b1262d8b8a5ec6e84f808fcc4e9aadc47ede3f97d4d336a2b6f173a14272d18fd890c384f662791835d693e2aa4ddf5a8d0722a366e9fd82604d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8c2d18f25b03c7a196e50f42487bb53
SHA1975373f940c959bcfdd652923a05aae623f48a08
SHA2566fe79e97c83d5c63ca15f558c6e9429ada02a1d77a6a71cd9c6be1faa43c52d7
SHA5128394aade0bbbc7db4f90a2cb680093c367087bd71cce569331e919bf1b0bf370ad34d18e44f4f7864279a546d3fb20b5aa25c780498815f991a42f0f5829ae1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f7f59ac03e747f64c2b9978d11ebf70
SHA177bb469d75da23eb2c33c52b3d48998e053e09cf
SHA256c24294dccbf5aeec9fac775770f9319404c9e6945b403bbb708777092dce414f
SHA51214f4442be2b853e94174d9ac6198ef624bd8392296ae67b732bcc1131df5f5b2f3c79a0198bd2774774a854464d74593fb40e22cc86a4b77406908b295397d8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b1ddc8e8f626688a6f8a8aff678b28d
SHA1272d971e056385e262f11488048ff41529823b69
SHA256cadff8170d38f55fff5afd6857bd9608ee1ca0fcb1ba4ed8d4d8a35ff611fb49
SHA5127178f41a12655337c78ba2772fa480d49fd05d7b167e1c31751142b6320b6c95765252d980e7f349fb1429a7b90e23f194d8c8a06bbef486045c556e354209c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dee07010da197af9685519f1478c52bb
SHA1e4c013211039abdf77298bb8056f8d667d6ffe50
SHA256e423010d42b4363ac5a78e4e663ede112438f0f817bc5811a1e8e032d415f69f
SHA512d6b4c0fa2ec6796ba21448b3aac2e1de4c85da4633136fcb35095ae3883241e58177abfd49c0f187e4daaa3c700024d766fa84217a4e0fd86acdfebf816dd6b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af41052f6f87cfa29f399a9cdc42da72
SHA188b853beee41723cab8be098a456414603cb9599
SHA2564d0ac7ef2512bbffc7ebe134872a830123fd053ae7adb947aae35eff642064fd
SHA512f8684ded57d7768c06f92e5898fdb3ac5af8762efc9cbcc67066028c0106164c65b38475bc3b798c18d71528f48c2c8ea8716ac10687638f37bb5026d9e5f6ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554a9ec2bce2dfa6813d39127f6ee6bd4
SHA1d2b71ca4ddd736e1368871ec9d519e7a5d738f5a
SHA2563e44df339ad602d496179693a6cbb21becbd8074895db13c7cb0355d259c1917
SHA512e5f50e8929fd2d58c674664f50d8ae982e95b2e2f24aca89f4e4fc491b8d922fc63caa2d91a63b3107c4394a20b3effda6d7bc97e5b51dcfcfc3369aa205253e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5a3b8efa7d906b4653ad00ef1ff203c
SHA1afb7dec15403a43f499e2f0ac4c97c05936c5367
SHA256febcd4ab61f627013cbde625f01454b0040938dddfba6e073ef955294aa2c792
SHA512ada6e4b84b81a774b5b317f25bee81a724bb8ff6d90535a911d14d1c483511b9e95aed3452d4b9b2d032a006d11ae4c6527a26e52b6e95e211abc6995526aae1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5650e0cdef5f33b0fd2672510ef16be8e
SHA1e82aece38cae01f24c9f28454295179af6c0125f
SHA2562a43a033c9a8df8b188c068b6d4488834d88d2040e166a7d95d3281403606d85
SHA512d80d1b7eb6eed1455ed6a2d686261b4c293f14ff0b08c71c0a460db15c3329cef8933ea3d9f93765e877a05ac5ce382aad6bad958cb8ca72de639bea32a5b2d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531da6f86cca62bca0c1c1ae246b0222a
SHA1e1211eb42244c1ea12fae153b1e7a263129475d3
SHA256e00cb84dfa032b7b7e6e37556efe9ed1e91d9fe3a62846f3dde04c9f22b9a430
SHA5127592beb3013ac196b13e2d72bc2614be9b24490b3975814701e4772772ac03c1259d05b8a5d0fb75a0f57ba77bf39b7dce8c903e7c11884a8b1a118bd7965b83
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b