Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f9f55794306673d5edb24ec1fb8be4eb.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f9f55794306673d5edb24ec1fb8be4eb.html
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_f9f55794306673d5edb24ec1fb8be4eb.html
-
Size
1KB
-
MD5
f9f55794306673d5edb24ec1fb8be4eb
-
SHA1
34fa0ede5bb845c9556547106e22b92b1c22d1d5
-
SHA256
0ac921049dbf9b2105c294a122b2fab693c60a9eca04e754dd19ecd97d628fc1
-
SHA512
53aae73c4c25776bdac8baef91c38266079758a97c13a27e85d80547c82b285b133ca3698c87de221a4a3f1e41c060b176dfb8193bc4966ba33a84439742060d
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dcf028f09861534b9265ade571e1742a000000000200000000001066000000010000200000000d24888c00014d5312745493cea8ebbe9bee8a68e8814c2689aeecda7372848b000000000e8000000002000020000000fa690911b99a32ad92017f6e3ff942935c594dde67680f72620b3e3d2845dc5c200000009bb93e91553af9d1d409b0b38400fbf2415c2c2c8033d7ee54577f00b67ac1134000000090ba99f9d08a008932555326c6ea5480c11f8b192ee855165fb4512cfc5826831e7e2d8ac1148d3b3dc31f9d78c9b8b612a6c55696ee80cf0b22631033ca79f7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442739978" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 604adae5f463db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1169B7B1-CFE8-11EF-8320-E61828AB23DD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dcf028f09861534b9265ade571e1742a00000000020000000000106600000001000020000000f0937eacf7ce1662ca3dc005cc55653577ca66099e2a65e744e4d5b5600de8ab000000000e8000000002000020000000b476b5fc7d6baa0a1470c8b9de61dfed894919ee60ae6ec98e2e2425a114fa1690000000b18033b3f77c12dcc4ca099a05a19ae9ce6a193be5dc18e0c7e992596925a52e4358db3ebbe63359c0500370c948533f32f854899eab28a88d8b4a5e91801d455c95d6c90d8e37a01e2b9fb06d63b8aa19236c4cafed8664756791be0cc5cda026a65d3ef49b1f11960c16a3c0f4d95101f667cf0eb67067ed118b33670ae1462b305bb6a1e72ea7b4ca39bb9b411026400000003efe0712eb7e24ba53e9249c38a9abb8b83eaef50ca4613e02d1dffadc5fa58dc68dce62989de7e24fd0e631e58d97b1864c6f3c7ef4deedf249086f85fc7e0c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2376 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2376 iexplore.exe 2376 iexplore.exe 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2412 2376 iexplore.exe 30 PID 2376 wrote to memory of 2412 2376 iexplore.exe 30 PID 2376 wrote to memory of 2412 2376 iexplore.exe 30 PID 2376 wrote to memory of 2412 2376 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f55794306673d5edb24ec1fb8be4eb.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d68b507d01225d5b40a33c6f03b2d4d
SHA167a2de6bb599fe6a0cff0ff58e56150637b77241
SHA256a356d9a4d5a21552eefc968ab21d3e66aa295f60769e564f37ba1e2514b384a7
SHA5127f6c184afc60486bc678a02515f92555c6475b21e54a21f5b426263810d46f2be05f860f871641b50d95e95183a316e38b15afd628e061aef571344bb7d7e5bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e33f73f11da4c0895aba3b3ce5f7f2cd
SHA15f42c0f5baa8f52e5a056419286b4693308842a8
SHA256048383a720a44dc400a28980b9e53fa61e27e46da8c73b5ce361cff44db0e2ef
SHA5125c3ddf4ed67be887a831ba64fd82d11e57d16c802424196d068b52ef768105c7b696c3be6e095b4cf131ca20094a5dacd794cff3614237411aa34f1a6003da70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547c9adfa3c76a87eb0e9f1f90395037b
SHA12e00f22c8405c3719512a872d05b592b343b9c91
SHA256ef113d122344852645484182d1d8f636cd36db3dd00e4a0b46ef704ecabf9bfb
SHA5122b1aae340b46f09b7314c24b7ba4dc7ba4d0fd87e4093faeff8cb6e0bf334f3c3da0607161d8174640627bdf64ba28e351eab5be6adb52bc3caa49b7c7027eda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc6f3b53ccffdc1f70ff70120d9b4132
SHA11340691e3c21410027dacab2e9255f201b51a50e
SHA25646c8c4746786d9a86e42967a2f483e3413147f4db6d682fdfbfcd29685d25f03
SHA5128b4465e9fdf95eed94d709e3bbee51f4368300108b6f4527bc29bb92517229f9f7b6c580f9cdfb36659dbc3345d5ca7f12cae5e5bd59e080508ccad1854d908d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52539b26452ce5b28d28c7ef105ce1131
SHA108a3818cfde035a6cbcd0e373bd9f5c418c1b2cd
SHA256c9daa4636d2748b41966e20c59d67a5f8b97bb1a56dca2cb0f95c8d154787ed8
SHA512b421bc02588bf919ba291c9d438d86dfee31728ff56fd788976fec29d8bd46cfb878da599f880751ef61b252e2cd555639aa9cfdc0fb6997fd086b9218abf84a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57af4311fb4e85b6887d1e9480d24ff43
SHA1e6cd96a17a0ae80492c1bed7795e07b9425288c6
SHA256dd982d56b6ea3d10c88acc5dc4ed1a392282c919429f97d169d957b161fda1b6
SHA5122fff083e7ad7b76cd6bc5a5116d2ef6c83cc5f61d4578a03a958acd13b821360f31bde32308e6c9316e0233605951b332156eb1c00032e9f90485192259fb779
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc670753717443548d3addffb195d5ad
SHA1753b2e75a4a6a6a9842f79b2afeb9b02b40730ab
SHA2567af7c2d6429ebdc211cd4e123a4ef9b556972ea68ecdeeb3669d2be2bb807fb3
SHA512e5cf9e25dff839ce737d8f67f70cd58f1a288df193289a1c2f54060686b11281919152a7658e5a2ac38e4e2ec6a84cad449042809564d17c70db71572bd19f9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c8015a0e49ba2adbfaaddde1b0a6df9
SHA1a58447fca1d118107b2cbb2ee136a66f062addd8
SHA256039b97b74462af073d032090c4f5a2959632322f81e88664970f61d91a38672d
SHA512ecc1bf6842d93a1083696f5ad26987dc0d03b2ba8ff402fa506225ac3c1a3eca6e491d9ce17a29fbe3ed74afd01f4f708a401cf7b381fecb29ae20ba55fc0c35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a15ec42e6628817a081ec4b7d652e25
SHA1099806bebc4dca436f635889eb3e84852a7d7dd1
SHA256db81fb974473253948d6a249dae2b70e98ce4bd5649d0df2e341eef1329b27cd
SHA512fc2efd92df36c4fd8e286f317640ac466cf882780a16d2dce76fe53b27222b13cdb9886b12d075ef521b1c4bb8bff2f2df9ae20685781645d336a484ec69a900
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54940f04f7b9503257bd60ce38b3a3249
SHA1d0de7052923c27cf6bd9af1c55ef11613f02736c
SHA2568b8d17aa233a79a7d1154485c615551910727cbb5c6bba4125cb6432937d84db
SHA51260d6f66dc5a8dce1c58adb573bf16245a4f101bad24772bc9566c29856d3885fbfe43ce62eba7ebe9cf308391914f43f152d434eb79de0437d93f9eee85110c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a43339575e2a138d74cc3c2b6221af34
SHA1835158aee7b99f4702ee3594f1ad2d2949895977
SHA256b1037152cdc066c9e93ac36765daf6c7d30d755d21722dfedadd84aedeeb567b
SHA512186e716b66257bb421e79b412096787dc2a475571293d0301917acb27bc1176099db526bb701e08cd8a3d743cbb6ab35625a0aae82af92d74b89fdac1cbbe45b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da2e6562b3d4c0265eee40b6bce8dbf0
SHA137caaa849e86c2eebc6d375ba3593447d7a5980e
SHA256e8ee184c6eb3c6d7bd0e15fe11c4fce5e67197a5db0f9adc33ff0a121110655e
SHA512aed5161f1b8a805d837b2824af3d5f8474d72cb1027de9f611f0a1122a6cf7b55eb9b086f59dc7a64dcdb38b4a5ec91c498543c692aa3a48a4f6f8ea5c65013a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531693089e364ce6e5f8ea061157d0317
SHA1cac54e452357a6d98a1f93465f4debdce2d4ad38
SHA2561c1f022da3872fa2249f80dc3e614d22c9f451ae23f8111c8e010f8682d15b9a
SHA51281a38a65be8ea208cb92dc1fa37afbb96ac247baac2cb0de8d550fb458d5c287506e94465d9647e970f537e569657578c6271f0c24cc1ac7e184704b7b2e2e55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579f0182d5d68c97d922484d7e1cd6a3b
SHA1f0049a4456300d28e6b87f784f1dae67e0fe24e3
SHA2568fea431dc45e7aca7e4e0ee6a1f6219de5015849b94f3615411fe4898c993391
SHA5123ce9b3ac7ab59f4c23848aaec8a129a182afe0e2c2b95d4731f25648c8a552c8d64596a3d263d8317cd333d4de2a17fb5356181a0adc6ee7431525a0680aa977
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7c8efd9f55a74b3cd03b7afa281414f
SHA190467de666f2fc813a34e0273e00777b7e0fa115
SHA25688e5ed37ac408c026065372b347ffb4284d17809bcfeede60b39d38a3e2092ba
SHA5121d4349659788dd0aa6c940c7c58ecb79314c338c9d676609671a73071828b08568a5646ba90a9e806708e293b19d73ce6fba694c402b6c9959c02a7ab1a320cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0a7dbc478bc3e6b55587ff4966c9bc8
SHA1105f755d92c970369c7ee2d7d90cfabb3105c1c7
SHA256f5bfa4e05a7f5d59002a840faa631ebf567c6c7167a3f13292d180f925cfaf62
SHA51223c227ddcc9861fd40432f9d04a33799cc1674f5f76aa728591183a0f2f1fc63922dab3b3eb00d3927dcd186c9ac8831a6455836ee32382b5facd182904483ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557f01ca16d80a8ec04ca469e88de81f7
SHA165e07fc34b58c6d76bcb7c78eda6856e01ab50fe
SHA256339cb7960b801943823f35447013b922825232752a78251141282868cefee294
SHA512dec072024373108f194d51db432c1a6ecc3a1256b0c1c3bce2c5938fd9d2ff7ad1e86f11d6ced45992d1e050bae7fd088b03f604c259b1689758b0d01cf08f25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa9ab0adb2ddcced25c24e2e6004ad27
SHA1298e4ff18fa80a05da38355ba11468900b4685db
SHA25613bff7ad3364fc88a8027e1786e6eb8bd492523a77620170e3b28b8900a3db38
SHA512b370b87c20d9f4974a66d42562880449dd4628e068f2d6c9a285afc8d0d694d09da18ed7bee3ad44e9b78ab090fee268468b6a21ee5ee3366193c838261da243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5251a20e499e05d38f3cae9ca940bd19d
SHA1de914074b0b2ec33ef6c3d5a4967f95fe0de1cce
SHA2568e57b1e34c1fa972713c2664ff6ce0a066d3e09fdbc7351998a08194c9115431
SHA5126cc2e0a5142303b5dd55206849baa868d46c3879f41710ade15c374ea72dada420f89d109967c7ca75ad88a9438c4a0733f6b6c5d1d45f09a359701178afb6af
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b