Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 20:58
Static task
static1
Behavioral task
behavioral1
Sample
31f44a938c25d6ce20ebd39c4b558bdb_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
31f44a938c25d6ce20ebd39c4b558bdb_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
31f44a938c25d6ce20ebd39c4b558bdb_JaffaCakes118.html
-
Size
55KB
-
MD5
31f44a938c25d6ce20ebd39c4b558bdb
-
SHA1
c6c5a87fbf16ea6ff6cdb3cfdc5e68c36182b6f3
-
SHA256
476c8796b413f36664fe9683269f1e73bc6d647a53886e1553a0d29310e7cebc
-
SHA512
3e39cbb5ebde3c772bfe751ee7436e6e05c50ed319bb1d7bb3046a825531ec2a5819d8febad3aaa449c1bac02b32a98f74e4ad23fe4d5597afbec00fddccf393
-
SSDEEP
1536:gQZBCCOdB0IxCZH3GV+7dU0JhmT1SOx7Nzt79xvvAwi7Y11sx0CnkBizlPxlBRpz:gk2D0Ix8GV+7dU0JhmT1SOx7Nzt79xvA
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000001d635405677fd9db88205efaaf5023b1f36926fa8ee4ba3065aebbbf4bc0157e000000000e8000000002000020000000d038cc455cfbd8655e165ac198458f0e7ea2de166fa81fad479bbc4e0a37320790000000adddc79601f6befd2547e6bfb1ca5bd92b6e531b6b693d419fc10b1cf02be8325a01243c06de26fa11cbee6836710064b06c215ea967f9e7e7f513c7db7dd1ab756f3e412567c2ef0cde853170d945dc4ed86794249346628b5330dd4f78c163fb750b59987bf82cc82c07de83a14f9622c8503dd30038d05abb13bdd731ea30985618cd936498fa8843fb81c88f4488400000007553a0a36b8cba57dc9b4cb1c023535fdaf33b7fa8d13d691c31f270ac68542fb53bbba72570d302e085119b78ef8632fd72e0dcdfbf408f9ff0f5859c1c4f16 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426723697" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000ce1968c6b5bb9018e820ffd25d5f4ae585199c116fb9e70f3f594e0f2d7d0576000000000e8000000002000020000000d48b8ccb8f59cd665af317318a9aa4463d67f2782a10856041cd09662613972120000000966498cdf995f49a518ba4c9a94c6f0ee730c5e067011887da06f69266d0b59d4000000072ac3adf1e7667e56ccccc7c3339b92110f82e7e2cf4fa3c999b65cd7e4608a3f909a4b4b996620cf449c6a82d47da891cdbcb61ea05e90693bcd36249d88c68 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{420ECC81-3E3D-11EF-8732-52723B22090D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0fa1f194ad2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2868 iexplore.exe 2868 iexplore.exe 2808 IEXPLORE.EXE 2808 IEXPLORE.EXE 2808 IEXPLORE.EXE 2808 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2808 2868 iexplore.exe 30 PID 2868 wrote to memory of 2808 2868 iexplore.exe 30 PID 2868 wrote to memory of 2808 2868 iexplore.exe 30 PID 2868 wrote to memory of 2808 2868 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31f44a938c25d6ce20ebd39c4b558bdb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579557b11e3362a2100180e0d3fbf56e9
SHA120839abc16151c4e33cd2787acbc7dc24aa83a9b
SHA25680c83ba6921aead79fe4fef34ec0aee512223c7670388bd9d2f47d7edb520ca8
SHA512a59ecd3f9c0848900bfbddb3fb011710d2fd284669d195c46ca58c4074b8bab26902d3654fbc5c255fec9a145f8d07f23e634606f643185e1ac4e35dda6c6427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52769816fa5d84c6ae046386b7cac812e
SHA1d9b35e7e5a27ffb3db3e9c31c0b50de0edcadacd
SHA25619d9a1a9dc09118e1f99514f9b4a874658b26dd0cfa2dfc86b721c547f729da9
SHA51225b0c5bc82cc2c30880378d33d2aa6db909792916368cfe6a024274363a53f115b845fa6260a5b2bc5c7432ca3bb10baac58f5f3428e28dccfe20daac636d942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578cf576da9e7f843cb895b8b851355b9
SHA1c91bae6b7506f5c1e77298db21f0614dd5216a02
SHA256d8a47d3e2c1a6f83b7e9f1b62a6ace520df7600dd9b2b9ecdc5ebc6bb8deccf8
SHA512fdcea0534416dc28f59484296a267f728d4670c2980064a542920d799af285f7b08b9fecbe036da7148d5139f132f77eb557cbdda7a9652033d1365cd37c64f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50957214a2aae56ab55c21765b50627ad
SHA1ffbebccd1e858aac67f07b5e64cc94a5099872eb
SHA256a67ec444dc9a13332584355e2540d8a8ee92a7c64328ff1d487b5619bc1db94c
SHA512df6d2189adc29e076ef5ce395fe1ad409590bea3213ed98b49b70d50720c098fc5083d9a6eb692f08535a7276903ae08ed18e97260a1d7ae8a04a1cfb9e0fb30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5048fd7dcdb42130e052e26bdff04f076
SHA1abac1e0460398e4f14dff8433e514ac517dd6bcb
SHA2566930ee9b463f568a8927bf701d93f05549db5240265c690b2196c4e3a3a89470
SHA5127fc596971752fe0cf402e1d7b486fe9e3f7842fee296bccc95c3b8f2b49931b0309e6812d0c2f9a1b27517d0fd0215490ce3c599475c555c7019f918e24703ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cd37079d5d0409eebed3167dabe9f34
SHA159e4436c07ffaa2847437f8045bd3ac9b6cedec2
SHA256a4cdbe49f34e1178a19c2553b62cc06a8120d848226b2f00a69086033e1b3830
SHA512d257a1a1fd01c5d2c61c9e3aff52cf303aec4613205cff0caeabb4ba6a61e32e205dd598b33edc8369b8218107c7d89033cad9e45147e88ddb98c8ddd04a8027
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe914237c279b022714941a94270605d
SHA11af60593bcdf8c2a7c89d0a0c194831f78b7bba0
SHA2562b4633da5d12a91770716c10648c8493bef50748821c91bb7ad92af127863ee5
SHA512144126b9cf7b7c86d8a9031fe5228ce73336b1383b1ab71d4d9580e8ed7cd2e89fc56f2b7cb5efe6005d15807e8fb7fb38d4b53c7861ade73c4adde31f9d8ede
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cabe20d552f8ba885c3c3249a16276f
SHA108e32799f19d8d23134c143134527775186282bc
SHA256655548d6407b192c07f6411a8ac17e4108ef74e1c66fd69d680b6a25585fe356
SHA512fe9dbe609da4ed3f02371ca7a8eb41e38ba1d3f66fcdb85836a9f4e8f7cb0b7deccf4d55280b5025074555fdb5b5830aa141bc39b0b338feb58763b7e053b75e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5214d7b5430faf1f6b2fa9d98b27b069b
SHA16b725283a10ccb7bda2b26ac93d5c06624507386
SHA2562c963d345cdf2eecfc6e7a55f54f9a5c1222b232915347338b4f8011de928c58
SHA512d393c3a771c7f1fe751d44824c73a7dc7d89ef3ba2a078bc30874cbd19a4d17a14742685d2093680c5a73291af5e318486f28fa7fc3d2dff7d7edd7cb9e0d6a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52765bd2f8912d6362426b6955b016bcb
SHA13892cab541ffe89f65c872c5eed81a0b23fe767d
SHA256b9310f21327db7443f46764b2bc9e904eba3d61113d87479aedfc3bc47a1539a
SHA512d420c45c3cd8d46ce70c8d55a4ca4b2b46735f6110f2c5b17761c5ca7b8c3a5713577bade458304c3167bd1f5916c401d5a85b3c94a5cffb0c5d61cfac50806a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51fdb9a74d373ef45a8373fa68cdeab30
SHA185ef2fcca285282ace45dabb2a7b06f8f3551642
SHA2565d39a83eff3aee98d55cb7f5024be288acfd7dceaa76323a506e521fb2e2854b
SHA51251f43bdf3f1b514b1b756a8614d29b256d48765a0af15b14c1f9d1c5f1080516ede6ba73a6f25f5b772e9f113793dfee12f27a0003c34b69d3c6f9e1206115bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56774b2d122bb37a6cf19ce6585de1865
SHA176c6e778c3a50ad97b99328502635d51327e1779
SHA256830dec20b52564d1568edc7994d38ca323224f7115cbe364f71d197a5f6249e6
SHA51213ae557e752f0cf03010fb775c2faf24cccb3246d3854416efe3fd46b28593dfb00c2ec3bcc9b60bd009d69e0d3e1aa2b7eb3e39a646d3eb4d262a38619c335e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a92d1800a964477c7c33ea7f5d7e3f9
SHA17da81afa0b473461bff7a882901277e1b0fd8cb5
SHA256493f2da194d95c7ceae196afec941d91ce886a3c0b5f68a4b08476d818dff613
SHA51259b67e2bd849a83465bdf02ec7736963f5c3aba343fca000d64f543e66c92fb09cb0596592b3d7d173123266237c31ecac48d041d456a4e82cefc79559a24ff8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0323f1073443936a3f02aa750fe71bb
SHA1efc3cfc4f84478b639b5feee6f5f54bb75e6ffe1
SHA256ec1608ceb7ad7fed484d1cd3a15cca9b308173ecd1d8fee54e42d82295bec002
SHA5120a68093477d7f3c92c71e7ce1dfb9d6586fbbc9bbe3744c4f606714eca338409b937bc23ab2fec01f227a39b8fc796dc08eab5579134095c006e402cd57b34c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c8d0bb33abb6e90222910ac48b3d036
SHA1ca9ca89384f38564b140c5fb6435617a5c3014ad
SHA256c8bc2f210ff24367be9e80beab14a027945ef0b7177f7ec164e9eec71df7e888
SHA5128c2fb21fd6b7e82629f1722616a574c0b601fa220b26ae4f61428afbd8f2d1dde301dfa32cd0662ce7663223018753aa56cc75d58e62a455d2adc743d36bf6e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515177a051315c63e8d1f580a90bf77af
SHA11d05c28e6cfaed284483d308cada7aaf3c284c91
SHA256ceae7e6c514ac7eaeaf220d6fd7b2d067d1ea48a7323575042f7ee31d4f830bc
SHA512b315e9b5020af8bf2d3622c22fb6b66144286aa6b17531bd4d0ecf836ad9bf2a6a70eb7187ba604c7df725d73112d6b3c3825e22521fa9bb5c234d82918c889b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550e74d43521978a24e88aebb83e8a6e5
SHA16aea3c0dfeb61f79f47bb672d3cd37dea77a567d
SHA256b5acfaa459fd59ba00b3de2b4ea5f04479a3d67fc316ca0f965dc996372c5a6f
SHA512e8978ea6a606d8b7613a3a23d4bbe9531a05eebb748019a8da6c05ce7cf84632a21eaaa7dcdeb2462ae041b4950e045bc3c1ccde743f3763a8fc60983aeb7ff4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501601d41c00df59318651a34a2e71fb9
SHA18010556462466814640e3fb1cfcc02e2c2ee28bf
SHA25697ad69d79257ed6646b452f3fc2a29853b6f944b83cc081c4cefe86ee8d27cec
SHA512629505e332bfcb05ececabf9f85d00dc20f4c5b20b0e41a705ce201869bfb3c975266be57b0b745829741852462dd0aa52109dd333f964fc3128a8e252522d2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbe25833cc2143701d0f7e3486f66cc4
SHA146183517486c12c342c1dc800882e0534f2b3a5d
SHA25699b7fd91002f289ade5dc9decd2e07f7d28e33b817a3c5d9925fc6022aa00088
SHA51203117dc4892acd339e88980b1019de0ddd88c0808d4ada82fe04923668432c788b003795cfc179901021470b803eae1f40055df273e5e20b734fd24b2688ab06
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b