Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
b9bf59b7bb902081b7bc5baf7b652f9b_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b9bf59b7bb902081b7bc5baf7b652f9b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b9bf59b7bb902081b7bc5baf7b652f9b_JaffaCakes118.html
-
Size
120KB
-
MD5
b9bf59b7bb902081b7bc5baf7b652f9b
-
SHA1
00327b1c831bb2379be2e89530226e6c727db5b8
-
SHA256
5cc6ff2d39b37dfa7d2a6b58c78587f5e56990275ae0ce4e7889f41fc945e3d7
-
SHA512
aaf20cc2cf1bc6679dc22847bb9666858bf2be705a2a8712f5d0e01d59981fc1666672d07fe9c4bbb7a5d79a612d81980006c8a356c96dae9f755deaf90ca397
-
SSDEEP
1536:C4MysvQ6Yo9bkkPyoe6p9LAGJvcdV2lEd0Px:tsnYoVXjEGreS
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430536654" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04e25eff7f4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD774A91-60EA-11EF-9E0F-4E18907FF899} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000006a5142befb88b96ffd516cac9b58d991c06e040453b01381d9d33450bb36e42000000000e8000000002000020000000779af315ff3325851e0f0c2ec67bcc6f9e19b9622ec30505980c530469bd2ebf9000000003ce226b0196977f9833a0f5b05c11edf1235e6be55f3ba96fe0d57e9f5ad272d30c9172e5e72f6d24c9421870d9fb8b3a193076f20be602e22766ba8d8918932551c1ed8042711cd63d6eafbfcbfc0cc4fdaa5aeeb39a846ac7a480e67117563c67f894699f0130355a8f17af921a09368f48678874e36790198453ebe12a664508ad86974534feb07d48142aa2493340000000a41407e207b535b80caff69a643b78592167c94223a9e7a3f1ccd9e42f494ca8c89f69fd18c0eaf50fc766dc89d854b7a0f2ee83abc2ff0f20138ff1df62d7f3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000001677c24a0a3be5a46587df43828fa6f45251765b9067eef37c434c1e23d43bc4000000000e800000000200002000000085a3222e3bcf0535594f08cce3a526ce30bd0d05a6203c7d88fbaa80dec5bb45200000007217142bb1dfbcf382e7bc254d5bf44a72c841c9d1f60d06aa76c3617d05593340000000fb5ba80ad65071c0fb2b7d11c6f6129f81f4ed05211927354723d0f84faf866ee72e238f02ea7c22eba26a71c984ef0a839b08e3688d512b6fa4b34fcca568b1 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2520 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2520 iexplore.exe 2520 iexplore.exe 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2300 2520 iexplore.exe 30 PID 2520 wrote to memory of 2300 2520 iexplore.exe 30 PID 2520 wrote to memory of 2300 2520 iexplore.exe 30 PID 2520 wrote to memory of 2300 2520 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b9bf59b7bb902081b7bc5baf7b652f9b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5450906536031c3b1bd371b10e5b18002
SHA151bfd6dca834ec548a2dcb1e065575ed7ed5f034
SHA256daba6e902a69cd39930cd540489e43e644ca65f9c20af8aa8678006d9376bd43
SHA5128f79ead311613574cca4df1ef49452d10784ac0d7009faa5066c0069edbd782aec94a60fb706ec4742d84f3389e6afba8c00ecafce25a0ab23d825537b224e1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595fb51ba3b5d10f381251633397f1a9f
SHA1ff88958f7db4f497a71310c4a86a7ed9d7421801
SHA256b71b19f1c6a4b9a8ae9d434e8e9fabfcd5b17ceb20c09d0bb09d282a0d49520d
SHA512bbd5c34b59b5d1d8b2e13c65c42ebf94034c352363d1f890cf01a7703a5521d45dd561c7c614b06b9175101c3048da7573540728133dd2cc09b1c824bda8add2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5772e2bf01a5ac3606b49ee81d43701e3
SHA1dbf0d9081794655a75cc7fca46b9d9c3836de9c7
SHA2564544ba4941351c33af259c07accf5179b6d1a02f507e98ea57f9d9bf678e234a
SHA51281f8ba6687e2a8a0d6f51b054fce985a4cac4b245673d0f67072ab59d0f6b01f6ea7f8330575cc9f93e794340e0c3578d61b34385200d94693b051fa3b3d587b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5718f86675ebcacaebb94df28a2f91e26
SHA1653d23545cbef4dea152b0ae0c2735bc00eb7658
SHA2566ae2be83d0758b7727655d55180ed3531506b26015038dc2adf8239db2dccb97
SHA5122043ff2c3824f00ffa535799f696baecaa00ee77223eaee2338224836ff38771bc9ee3f0164d200560c072b6c8b056e37c1b86ff1bf68e03519fda559af4cf0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a191d9d0ce4ddf11128e73bf3446cb5
SHA18fb2d4db1b0a4e5c45736e255abe4eb2437e4d77
SHA25688c3b3e1dc5eb632f30d29ead1f6c24c415133892ca9c4fbcfc331d7c65f2eff
SHA512a4f7a61733d5ec1c94600926429d6cc7587612e30c0aa4478d4cdecc369107b06c851165a3df47ee8864eadcaf9d494801565a7f842f7f9190e6680deaddde8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed919b32e8a2a925b45ade4d0ae72594
SHA114542c18398714a9a554c5324ba1030753f8a55a
SHA25674017ddacb6024f89cb3925499347d0d32116110ee6a7b89ef99a1ed34dfc4e7
SHA5126a4c7fde73314f8b6cf24984dc983e586b80c88232fa2b50ef120237eb6ea79709eb592bdb47d09bb60eb887f2bebd3533d1b9093f0d03a64744ccf37f954643
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524715f964f36a954b65f9f011ff0d6f9
SHA1a397d280e9220a4daaf51c6267d547e3b1bc0159
SHA256d42f6f26d926698b5df3605f02c145217af8ab6e706eb47ed90737d6b44d6c7c
SHA512cf3c13db29775aff1b6f1126d7da6faac8a2e36ef253373a6f9f7930bfaef79ef522840b55680a8e23794618cac2be5c488c3a3df7830a3a9d15483a03f54889
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5caaa6be399be1c49190b0b7d5cb81d4e
SHA19d1dabed354a98da08933c46ca68aa637c562551
SHA256895102c3091dbedd22feb04a49e5fa1e4d7f058c0c3269b50855bc226d2b3d77
SHA5123ae1d0497eec01bb692a1e92af59c6bfce79afb92b5989acb175cf2d7587e25f125f827495513e75448dcdd2e0ba2851d3ea1fb8a2631697d437507dabff25c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5c86a8921dc93a5011d5adcfa2399a9
SHA1297d2a049625759504654de4be1bbfe0129cc7d3
SHA256a4bf24fd1a3f6ac036116fd414e8da7b24b045952b5c76d93f3a457ae673e667
SHA512367a5e1f9ba9c2e243a2f0de9af4180bf17b655fa8bb3cea18eee33f1a25336c12472b6eb3bb3d721e5696960cd63dd0900fea35fa4ea5fc5cfecc6340cc45e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e88bd07858e8ab820cfbd911658814c5
SHA18d41f7a5e332b2aff59dd7a7ab580979557e00be
SHA256ffd5a844e011c5cf666e34be60e6ed244673758fc32a92a67b0c6f72e0b5aeeb
SHA51266aef9f2cad23646fd374d7ac70528b460bc9d66e5533986e3f367644a1dc6a1779858a03fe030ffde61befb170bf5dea123fe89c961e12a1feed6dc58d427c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fd97f9c995de7c74c16e28f42b7b920
SHA1f080667859d5234c7dea88f0b75ebf3d45db6257
SHA2562ba2e8ba16c1226cf163c5bd3021e155522bae1b1cbea90ff4653ed3d73e8fec
SHA512d5ec3572734c20f56d9bafeab53ccea41f467fbd65ffdcf1097af96b26f3adc3cfa5b744cf26a44de6c34c7aa4d7628e4a59bb9c7e873d6870364eb6c83d3c71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a40c8cf418bcaf639739f1f3f2f2404f
SHA1c03150b07747911acb518ad36b078a242f109740
SHA256244987a5db40125abd23b29c690e1f7ea7d38968c9b9cfdc2d883429cad744a0
SHA512206a1aa72121ceeadc496677ed6a9cd1b05210a6ae7bc9580795998638b48c0fe9a4502d9660b85bb83a490a87a571f9be73a754a43e64a9a6eb176b96a23157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a447d77e0e55cc84ae9fe36ab857439
SHA1cd9b6d081b74b5332c2fdbaf4f18eae58a8a9fe1
SHA2562239845c7394bba8d18d5dc99ebc1bc5efce1f997b9706089dd03e781262831a
SHA512c561a6f0500aa819bd7ebbc421b17c849119dc0ed3b57f0cc9cb2d1f49018728ac7da76bc85f7e3d37a1c4cee63a15d1765f172e08ed0f957db76b02752a7459
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3ac45cca80839c35f158077aa5fe53e
SHA1315920742c02e2108390ca21ef9d645cdd5b6c32
SHA256a742ac0cd27fd1bb08c7a854fe1e70b53b8ac571ed6a472ea6c63c1788b9dc2a
SHA512ae5d468131a5057ab4ad68eb785fa014ae02239fb70989f39fd339e2145d86a41305e1beae00ba0cb7f4e0fd48905eff35ff3e59fda7e6e3d217755343b7fe04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5131b68db2b92688b3627efa186dca9d6
SHA14c8d9b519285a5745c01d8a959f9ce8914a577db
SHA256d365ebde6269be20bfbf018b183bdf3ee2d6fe2ee4ceec37c435c2211cfc804b
SHA5129519d9dacd0f0b7467e8397b2ea800f230d1cd4f431af36a10ba944977dab1db04ddeb1561213d31b851f999a08185ddd75a55c6faf2b113010910779479dd3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e64c00fad225078861ef208b13ea80d
SHA1f46a4c24db0aada0107c153f4a72d05e8e2f1b6d
SHA2565873c81c19515921d6a23b2d5aee11884f7dfd4f96b6c64137d33337c0de4fbe
SHA51288c3bf1d10ca7f4076920df5c7a0f42f4b0323791065249d058d27c92fb7553f6f55ee5d071fc389bb985710c8d4a6e2d6e0a5257185dfc32ebda2a6635fbc4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a91bcad75308e503612b5515ff7bf47
SHA1e63d1c370ac71c4c7cd7a8bc6815361d2ea0369e
SHA256861161d2aa68dee561d970727b19892aa05cfbafa70cf940141798e0edc81118
SHA51298f5d7dac351dd99742caec0b06ca6d7582bc7c97b7d11ddbf431371b180504869c91b0cdadc168cfbc4e322abca7f619593662892ae8d4bd132e447489a378e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5887cd7e7913cc1874fd7e94ce39bc4cc
SHA120b5d30fc6da67f8f4558d59fdb4e91af58fb2ee
SHA25651ac1a6bbcb34668b4cf11f687f7aa8696dc6aafc4a194c5b3ed110918eaab89
SHA512491f2435ea58e710e5fd959cd9ec3663432d01f2e6f8a6923ef34a05d55cad7a7869f1d4baed683d4b6a4c2ded0661fc0e66adec2441e8596f25cd1c037669c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e457032466aa62999d4f3e31d1f6c922
SHA14ea7c6019483f5883f57849be44eee17580640a3
SHA256a513a54f2cb0c178fc19887bb77c7eb6cca97b891c7253341314fef5bd1e961e
SHA5127d797e84fedd09c84489de660387099dd6fd58e8e8bf87a12fdad73bdf96e3dc491626887911883e6dbdd1e457054a90b9782c2c671c4cf7169ca30da66e9a74
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b