Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 12:44
Static task
static1
Behavioral task
behavioral1
Sample
13687b4d3b49bcfae8e889d60507c633_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
13687b4d3b49bcfae8e889d60507c633_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
13687b4d3b49bcfae8e889d60507c633_JaffaCakes118.html
-
Size
1KB
-
MD5
13687b4d3b49bcfae8e889d60507c633
-
SHA1
d3a492bc6df08cb85e3dead0a6d059176a60eeb5
-
SHA256
6397d90c5195cc9fe0219a88417025dbbd24513067e47bf06eedb70891ed8456
-
SHA512
e5eb3f2b64c2b933d7e672c4f11d92c3d0ada34ff14b8382ec976dc99ed7235b50b8562f85937b66b99c171c58a44c5cf0e39197f73b664c2047912843342476
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434207733" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000000abfad45c9506794a71059ba5b68398660584e67e5c3053c5ff816366b55a01e000000000e800000000200002000000089d0d189d826ad9c479b168f1dec0c8ca632ea48006dee3977794da3f2a26a51200000006061869480209ae9d8a80287a58b09efb1e611a2df5de6424f7e8dac2338cd384000000018bd0fa127c4bf9c4b13ed8fbc45c37a8c785023b99d968a98efab8b514f1c01ac24dc4922df1e1e775440dd4c201dd0b9a2196484b6530fbb8f7c36ab4e0e6c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000b732d610c307ae4d2cc5f39e74bd26a5af968c0ef9a3a4dd31ff4de16c09cf97000000000e80000000020000200000008125406ec8b8210da72884983e81b8c375770dd9871fb21033b75959a455110e900000003e0a882caf3c5224a31045ad10eaace8b23e587053e3f017519b69bed8382465293edb560419852be84b27c53ebeacf9680ccf3907556a9d87f68317916ba0d7f73fbea797d795a010a5d650c12743122dba405cb500cda3c43cd41d8cc55e9affd19e15d50f613deab45cdc60dc74c80a80e8f753863d9bb9abb097869782c324d48b83befc73044c82fb914f48d4384000000056598c292fe9437a6ff2060059743158249b5fbc961e51465df81223036648c8af4c30d2e9ac3f21b4bb0267c59a3da8927cf03aea8fd0c245bf69338b6faf50 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63A8CE91-824E-11EF-9C49-4E0B11BE40FD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d4bf525b16db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1704 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1704 iexplore.exe 1704 iexplore.exe 1280 IEXPLORE.EXE 1280 IEXPLORE.EXE 1280 IEXPLORE.EXE 1280 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1280 1704 iexplore.exe 30 PID 1704 wrote to memory of 1280 1704 iexplore.exe 30 PID 1704 wrote to memory of 1280 1704 iexplore.exe 30 PID 1704 wrote to memory of 1280 1704 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13687b4d3b49bcfae8e889d60507c633_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1280
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551bf312ae6827cead22340308b0fbce2
SHA1a952c5a907d85e7386ca6d92c271ca1d06903a27
SHA2561af07efd16abb543c9441b0cbf2baf8416e778c36db5b5d349e2f28ca6580589
SHA51217ee244cd2a6de4bc00e8b3020576d2ed8bafa4d4ed1278f02bc8f103ffadf89a9f8dc2f600f38dbfc6d2c50d1629d15634683bc46f776494ba1b21928f86a16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dad9b29a42436d96880eb034a432b20a
SHA15a12c1d34befab7dafb2b08cf53b62c1c062ce6b
SHA256e94807498c535f67381087e90a0b1d46b92b092f61d6e91315d147903773121c
SHA5129742f15f9973a936250a3d52bcb8dbd32e3f97d663caea46188c9abe45e9bd722765a262dd38fbc88650110cb621fa77baf35f29b7646deb74847df142d93ab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5740ae99dff83d88168ce37a9df294c10
SHA1e9410abeb650f5e69d2e060fa885983d93a1325f
SHA2569e7c8e4bf1c1cb9c0b7451c88ecbffdb74cefb41a5c07daec6eaa96c7142bcfd
SHA51254640afea687bb503d387e8400fd2927c22112cc0a291ecd18ebf898543fb8cb53e3a16b6dc4e4b684440c39263fe1401ba9589f4d496e3bfb461a4a2912068d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b90cdfb2f9f5d69cee7d2505dd12e367
SHA18f17e5a0273424214fd6a6f83790a3c557e24da5
SHA2562c0a2266992aa705adaa93a878e57aed503e698b1b1271e99d6e06ba1413879b
SHA51255b99f9938973465390f3a45804e4f3bbaab24c6aadfb16d3d45f2e38ce4a0ba4bc2787c1de7364b03ce1e620fe0a01aebdc543799489204909b7da54c25579f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511e6542027b53f65444bc9ddd59c166c
SHA14243b38d589ae31e9d738b3533c7d281c4ddedf8
SHA25638faea9b7efef14e8d747597a6011134703e03500466100ffc350c404f00cd31
SHA5122a5c5bd41d7d75534399ec110e6ae8623c1d0b36e9e6745b953faa90ad8c18cbc4704f2888a64b0151baeb745f4be7af2e90e96daee338ea5f686b92851e4c35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bd83670974a8c3295a0f40dc2acf48c
SHA18de3123cd52feb7f2805298a3680aeab724d1842
SHA256736851796727a0431f5fa734a9e284fcfcf5879013538b62d413a42dd9a2f84e
SHA51277715bf8c5645ff936719a0b787a8595384620115a48b5ec3b18d9d50e21e4a6658b8dd456df2d79902a411580d5b96a87b1429a357004abff54056cf36a9d01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d1e545e4f4dbcac06128d5d5f125390
SHA153591d669ddec9feb5e174598fc8678841fd84da
SHA256b6864cf6300d4ddf1d3acad170f7fed6788459a65c08cf88d5ba6bfa19d94949
SHA512bafd16901b4529ebe3e7da69808443b69a9b3464cc78cb12cc36d52f49e1ae24177a48ebe826b92165109f18ec92fcb9ab8bf44242534fe05292864dd605f51a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb96ad78d3f4a487f84764bea9d5a189
SHA1c2a83703cc979fdd03dfe7fd2236d9a1d6e64d1f
SHA2568b614cd56dbad0e524ca2285bca9d6cc187213182831dec61c96b905e67e1c70
SHA512ae5321f2b651ef0072375ecb07f3427b9484a3c19d05882f0830e83147f60ce5cf65803cb6fbec1f817608ed58e44e2b136cab5bb15948997471b656ede0c5a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cddb815e74d9ca3387c9a064550ab449
SHA13d42fca8431372d8bb8f9c1b91e77af5336a325e
SHA2565e5a39e1206da46bace0b68a56e31c0339ddf5cf890833dba02270efa71d1cad
SHA512dbe2f018497221ab498043f7e82cc72e4bac0cadf756a6a409d37c08f807845100d125cc6f759bbc65cae522fd56ced982516bdb928e8f3992fd6ea333259950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba3e966c881366dbe699e85de60cf106
SHA16b1e01e7e017ff893d5b038e51d0b7c065725a28
SHA256a61fd512c01254af24dc0438dca4c982fed082a6ac3079582508ff739b9e6c41
SHA51215aab290c311afb9eeb28a6888a79fa043763208106d74e4a20f2200b8b4ace8155c8668cda996217e5144fc3f59547e495a88b8ed0d15a378e17efe2fa5ebd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5e7bb9a7d22dec548dbbc81556b39c2
SHA1ae4d59f24697e390a757b6838e9d4dcddf899bb7
SHA2564dd189480da5cd27a24ae9d8171f38c71317168ff123980f3082134545083e3b
SHA512459cc67db31a46f845542125f193fcbae7e5e53ac1a9c72d47852c39be21fc9e46351265d024d9154ac09a77565ae32da42daa90958374e57cbdae637547be12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50183c211ae44ee773b0aef046c627d7d
SHA14da7bb05a26f98f3f093a0c628ed7bb9b319e877
SHA2561532df5d5fe6e0a74cd1a3d1c222a5e96d58d92776e651427e7c14749918aeee
SHA51257e0fd809b6bb999a432e4164f30a81cf11eef9b5d9a06284e1fb2f9f2173dba3a995645f0163afea9b9a20ed26208306afe86cebee945ed07b65c8d09bbe408
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548c238912c9b3907f69bfc8df1350ca0
SHA1c2c9720783efe8057580ac6a89392dafb03a2c4a
SHA256508488e0e8ba91a0b7b9354e8fd61cc2e42ba0db38e1066c050c680173b1170d
SHA512a85a048247f30a0ed4ac5472cc41e584371cdba6d213be7c0b7f2b8b2dce96744e05a74b02fc86cb1a61e54e7038fb2b6f7857fb61785ac7571a840cb20adaa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eccd8a68ec7d3e91399cb580403665a9
SHA19737ca01b8296acb6506dfec9503ddff5b22b1ff
SHA256810b30efd85c6a3f24cdec6b15fa88cc444b59a0f2bf8602ca9522b6ac4977ce
SHA51228300b7df262e5f5310b2035ee390ed6d22973d55605344e25e416cacd5b6044de7ffa8bf4e0b0ff98c9f7e402bf6171b029784e26675c75f5e3132d942be843
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5406bd29c3e1807b1b8c729d47a567a17
SHA1fa3b98e6b90c863b7c182431290bad55cc1b19ca
SHA256d15395312fda6e2d19141a53855c3545f5c63539687e3c1de7a98755f75cdb96
SHA51206ee2719dc5660c5fa01db0c503e20404915573a29808a0c36eea1137c8284460479981ab6411dfd72c27ca182abc87f3a85b57fc1d356eee261d06894a4890c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5daf74838592ef579bcf32e6537b9f29a
SHA1d8c02c7db4f6c178f41dc4dc674f8735d68c6bd7
SHA2561cb4bff307e1dd90e1c52255bb3023eeb002ce4b3af7d07f0c8b5f7b8c5acb9a
SHA512f86543737b05778c1b488ce026f2428d8c0437dea3a21030a8310b7a53bc402a5b6334eb7ecb5886cbe6c34a36986ff904c3fcd3755377d06f2d503bee4a2a6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffa8837f53a1f98dbe4967c6555da869
SHA16521a0d76f2389bab463cb9f4ee67d5cca67da68
SHA25653ef0a7d4dfef281fd5fa1f1c5e16d36fef5eb0edcb4c561100fd8b5cdefd47d
SHA512dfd15621bdac53cfb040869d42e593d20c05dc517fd89da743c35b40a775736a9285dd9bf320f1586f6ca439841774b9de7b318e4f1822d7a37d23b8b01d6df2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516b77a00b0a245dd88a04672b3de305c
SHA174a8a2892e5f32f8a80b99f855423471645f3163
SHA25610109b9a42620dfe7cd3c938fe81b89bfe904d0b017ca0bedd8b98fd0ef9276e
SHA51229a94d3d56712de643ad1136fd5973cc070f7988b53950d4c427de736b4a300d58ddb6117d75b45c2586c6c5b310ce87407de82176f19f190ed1775787bc48a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594dd0e22cf059088434d8cee44b98ea8
SHA1b68fcfbbcbd5cd8d295bf5d56ebd81d8533114b8
SHA25675da47b6b8fe92c3e7b429712fe3d00bd71c060d167f5e6264c1d2ccb7848d4c
SHA512c9b70d2e5824ec1cb09ac85c5486d62a42dfe0aa9855d7e5dc2f58c44ae0555c74df33f4df2a3e78536a8d9df22b022800bf7600c311653c570c3e90daa25c28
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b