Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
46314e98efd0304d429451b95447493f_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
46314e98efd0304d429451b95447493f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
46314e98efd0304d429451b95447493f_JaffaCakes118.html
-
Size
70KB
-
MD5
46314e98efd0304d429451b95447493f
-
SHA1
2f080608c68c2e2a9534e935972cbe10f2a96c03
-
SHA256
925bcd859d49ec5121476d655abb304033d15433af2449e4c56df79d8eb1c370
-
SHA512
c94ef568f8c9343a7757b80f32b846811ff92f0158d4087fa276192ec199a14eaa337e0590d598393faf59ff7439ae692d3c9f96415cccbce0ebed6bd3c416d2
-
SSDEEP
1536:gQZBCCOd60IxCN7IZcxdbqrzPecLq7xnheGI+rAqk1MHj7IuJmuJ4PIOEI/JHoSb:gk2g0IxpZcxdbqrzPecLq7xnheGI0Aqm
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427128865" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000bb61e6cd995117b35bdacfcc57cc34d3c5469da0cbb69dcf2285c5568d1e6cd6000000000e8000000002000020000000dc6b55f0144181c1603a251d80b321a483e8de9c7af73c0343aadd31d314d4ae200000006f4bd1f3fa5f7878377f7d6cc9d14f650a2a8d4a0c00fa9a77bd5f8e0662dadc400000007e3897baf17746e3ae4b3396272b92efda3bdace61c0b77d2ce7f35a16e0aa866752563723e2a29e32e45c1d610201e30bd5ac1cd1bfb49b55ad0b9976a217da iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d97674f9d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000006b61b5a6e265bb2de9e9944cb4b3eada2018c8670eb6c505300648c5617daf23000000000e8000000002000020000000046aa31227375496d0e8a7a6f019eacaacd3563942667c648812e21c60919360900000007cff0f21a869d87cd4d73501a63cc798b5a5cbea6f99d6892cbb633e488d0e7dc065da070b7a07d544f061b54cc88076c109f1cb9df672c9cb9a4e7980cde3f95fd8529abc739207408588f4c17e4dda3657969ee4ba635dbb9fa9852713d9f352cc1f344c2816b8356856132e7d3f8df8878542b53f7ff98087ca8ef7a5027c6dd5f3bf8a9e3d3d979b80a37a060c6f400000006c41df8454f33bd2bb836056b08cb6c743e973d7636bbdf2daae065c8f2b08b422c839bd4e91bf4e5673c58e04c3de073b4e974b3191d3757adb35ca6b2d7cae iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D912871-41EC-11EF-ACC7-DA2B18D38280} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1512 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1512 iexplore.exe 1512 iexplore.exe 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1512 wrote to memory of 2012 1512 iexplore.exe 30 PID 1512 wrote to memory of 2012 1512 iexplore.exe 30 PID 1512 wrote to memory of 2012 1512 iexplore.exe 30 PID 1512 wrote to memory of 2012 1512 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46314e98efd0304d429451b95447493f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e4afeafea24bc0fad65871d772ae66a
SHA1f89a15db539bc9625a6493fcf1f962dcfd5ce585
SHA256bc77c2bc156320d681885c78cce241f24846bce73d1f5501135e0df34fb4864a
SHA5124e2ac37d7f223979ac6a4736b6341946202958d795a0bfcc1b51c75e5a4fdef51d5f468ced3ef8ea93b96dc4d2bba69917efddf9aec278c5b5492574a1793f7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cde51c9530251eb09ce9d12fe93d5f11
SHA1c294fd169a9bc7d6370294a1096a689dd2eb27dd
SHA2566dc1d1d83bf5fece5509302d61cfd556801c1605a82cd07e0b84a6b363b89acb
SHA51280426afc3b2d74c5a20ca01563bfb415f3fecc542a14dcbde644a5e0607e4414a0e4211a26c60e964c159f467a7a72f060161d48a1847142a40bc0603da27bf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eab6dde8cc9c75ae89e269c72558b7bc
SHA190153786ef7e314974b7235b5006dd3666a74f4f
SHA2567c593da35532097ddcfbff35387d3f1c9dbebde47900fd13a1ed35f374df06c9
SHA512db5c32b7da3f78b8ff2fc29158ff133bb41542df797348ccb648f784fa2d48e42dba6926ecd679a5eebdddd6f4499702e07c7ebc90d442e6df0ba404c3515d79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c695caf66efd0eb3566cb7e018896597
SHA1db6d80eef622999c0eda8356d10ca72e3b3e4adb
SHA25658deb81959ed52c041e8bca9c8adc00224a7829fe304c714d1aefc1809c23a72
SHA51211081eaf729b645d60392570e74c49c60cf732e9e1f866779f6861127639792c8740f0de8f73c6e979340933ed085c367375e1a6f83583863c0363ca1afbe34c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a28c4acfefc593a1e16aed24f15f65b
SHA1e4a6a2b8c3ff2ca6bee7bda51fce2e748493b25b
SHA25698a9078eb1b6bfcb7948694c7f149f5e474816f0611fa6acea7d68cf8f906727
SHA512b28693ca70753dc83b1e0446a6b86328eb38267e362ec8f46fd5dff7206c1a19001262e53af069a72cf91e8fe1a7480b31ea1f579bc2f98ed9b4e0370e28fd56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558f043bd85fa7743eb3cf51448fa7afa
SHA1c65a324fddecf416fd552ba08a4d69f3f94b0cd9
SHA256180a8d99163eee854233eba5293d5f144265986460c3038592b446ba3c510f3b
SHA5124fade52ab0de7b21cc1488e0572fc08568af4e17fc19a5eca85890f5cc3347a8d48f5ab43186e0fdbf3900c7171941e0fd45efca37a2718b7e14ca60c4894ff2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571da1d4f0d87c200b43c00398aaa4b06
SHA1f974afa1502cd75a36a4902a1e8dd69632db3040
SHA2568df99b4fe6ad93922d97484bb0e34c9b3ad40783f82a206c4275bb3b11710ec9
SHA512a43292d3fac45c09501ef9a1908a89b88a26609cc95eb35743384de538420e703189f86ba48abe2eedee33ae8a730a4cabd98e5aef7ae40abf17d5c39d901df0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b533f3a081ee5e03a977b60ab194b64
SHA177244f64ea7d66285d63334e8c562575ca8c6caa
SHA2562775937c88ac9f2908b134135965208ad2d02173f26c02613550115ce9bfa775
SHA5129d88a8597cbf952fcab1d7404437d07b078201f2d3016541a0e4dc5a5940365b7f57f551ce5574c5dd9919a758edea73f856eab50946f3f0f6d8b0c2fb0264c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5458dcbff2e749372629701af3302bef0
SHA15eb639c76927b03625b5ad25f9506afe9c50c38f
SHA256bf66e3b4956ed15e01819eb99677541f4ebff5d582af4fc188ae52a7ca6dcdfb
SHA512b13d26e99f741f764bde34fe5d2ce17e7a2db546bb17c48707af49d3656f8cf96fe0bdefcce81c9a42127312b28cee5a93d9ffe323e9b377f0a064e2f9a065d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564a4c2ef151ac1840e5ee675356b8361
SHA1c29382b6c1fd72aaffc12142599e0298416e7b15
SHA256b1feea70ec4cc726e9c55f56bf74fff859042412dfcc91d1f68e8ec4cdd34d6c
SHA512a5d121732b12f4c6245c6202030f243bcc07fd7efd7a5a125ed5d0f3ffba917227451aaa653f32ddfd777321756d441f31fb3a886757e4f4b52ea91c484a5a81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ebc72a5c37ad6be3a383b65246cd98b
SHA1853f9b3767a8d2c7fc36f30987d8a6a7e86b0b7d
SHA256c6d296517019514a4cdd1e1c05b4fdda48d62e5b7ecf12c6dbe0498eba5b7460
SHA512c28783d45cbed5ac5de082f08799be9bf86deadfa1ac1ad4f2a585b2ed7541cf29648bb7f7c671c7b645008e74e693c958bdb7747cf860286e93b5dfe830fa7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5741d01eb1293f466d5e43b246e6f1130
SHA1cdf443c58f780d68b57f527c8801e111983d113e
SHA25692aa93b97ea4300ae75e52523a4d4618932abf0f6ce997891ee490dc2b1de0f2
SHA512e33da756d349f77fc2745c7efb6d108df6f624a5afef67c2dfd8170064d6237e549355ed96f73c67f66fc70136db9105438a60d7edb3c4f7bec20b429c46e148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c211e0f69849281791c33acc1e08640d
SHA1ec097d3996ae1c881db4c62e93eb0e969a479806
SHA25655ed6f104a5ef8e20d90bf3d662df2982934c0188fcbb0496cf5857d2db70c77
SHA512ce7675a4c5b6c8dcac9d18fbb7be70e42420956fa8683e77d8c07bd2065d81131fe0bc3ea0d7502dae0785fc87df0d37441f0585b5d2c6e5be51a3fd5112ddac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b92babf9a88b43892900d48c56b84cda
SHA113769e941bd70d9b6d5f088aa5bb18271216d288
SHA2560ea0bdb1ef604d3042d4969b759fc4e5bdfb95bcae5bbd4acfb013b68c82dc64
SHA5129532a4557223b773d015f64204ccae6638834e15390bb973d670aba9644077a02197d247a496ccf3ee56cc06124ca5dabedd34c333a16802806c9cf5382818d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ffe114861974c5d6b0cec57c63b3bb0
SHA1a80401f017a0edd1127ad434d9c9d48eac1c987d
SHA256f3a6486f664f296874c32c38229ac7b8aa18a25b184eb74ec913fe8012a11414
SHA512b21ad3ec62cd18b4ea6e4c84d507c0ca9ab08a2ab710e84989ac87b78e5dcfaf2c37795edd89367ffe257ed17a1deabb158847ba881a919b20ac64876bdb5622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fce94530810d0ca126d2763a8ada3c5
SHA1926b180e6c5fe69c6f7652cc5d9735239179c387
SHA256a4907f08a240fedff72ce81d6ccce002af7fb90f31b5a2398d6344151aa06840
SHA512e1d65ea020a25aedf8a8ea84f797e7bc91db36dd65f5e40f6c18d6b1d470b2c2e7f0f1eae03f5b712930f2475c108c494abdba50fb7cf93e4b0e0c0eebc8d813
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5585d67dc1aa360b1321de41158b68de9
SHA10116e6d8b059fd238238c935d792fa3e13bfedc5
SHA256349c5b57af8156dce5a0625cf9eed4823edba6443411c4a1b7d9fee3c6597d3b
SHA5123c548be97d7f7e2c449b0c39cb07c34c25e3b6b101f2accd823f6dccdfa4be2c7c5cd51dc656930614a801d17aef8d4d60f10e58c3d297c17823192337f07ab2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b711276631ed296fc66fbd0c934e5a2a
SHA1fe9961bdc4738874893d65afb4256819a7b29e5b
SHA256dfada12d2ae4a5287a48342dc36f4d01a7b285a09ab966131bdf88701164b0f8
SHA51280cdc3b327e333467634289a57494011e05dd174b6e85b573fddd1cc22d2fd09ae8860bacd3a9fc03b7d2c912b665bcf2ac550be4651e35f95c3c6bb84e7a943
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df253975052d57f08bfd4f3d2087ca6a
SHA1cab45619c3539659ee5d331caa539d96e3ae976e
SHA2565e10d4050309afd2d77079b46045273871a8607482f6ae4bc9018a75fac0e758
SHA512857be4d10770c5ca55db13c0db0515f98795e8b8fd56c1d5dd75e9958a18b7cd995d949769fcef7841b7fbd76729b428dd77ee8f384dd8b21b4fe7306dc0062c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b