Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 06:12
Static task
static1
Behavioral task
behavioral1
Sample
488e75b7eade8a4f82215e6aa97a2c8d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
488e75b7eade8a4f82215e6aa97a2c8d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
488e75b7eade8a4f82215e6aa97a2c8d_JaffaCakes118.html
-
Size
6KB
-
MD5
488e75b7eade8a4f82215e6aa97a2c8d
-
SHA1
a0f9992dd72a434ee4cad3a3d30959441a96af5b
-
SHA256
d2dda68cb7dcc48608f7c9af4d6edc9becb2b01c4835d927f0218c216e16a68a
-
SHA512
2c83e2166d0004584b6760addb673b95f5dcd4996dc80e80fcc6274846bf838b2af508027415293718f1d28f4e82989163a6f6d5abdd54009e8a52c3a9b9b1c3
-
SSDEEP
96:uzVs+ux7y3zLLY1k9o84d12ef7CSTUYZcEZ7ru7f:csz7YzAYS/Xb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00dbdaff7dd6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000c92f3888b51207fbb04b3a920acef41c5ee2d7fa005f5431f5fa217e4d1ce63c000000000e8000000002000020000000a163ba91a297137f694993e98feed3f6ee51272ca430a2cb7584e322097323cc90000000900beedf3f4cfdcf568189b46938b537a2858a2e1e9aa38927726069011b9acb1635910e7d3d56220cf28bffe9ffcddb8ca83a90224048900dc44e69eb5f08471f688364d77a5fc065eaf3e32e1041e87488359b4f6f457e890b223f62a7e7d940c55cf6872ada6542f7b124eeda332e5b9d93c4c207ce0f94df40d21b4aa1672a0e5bc7ab85268db724b55cc118dbaf400000000373be770b849e3ac46e11c68ff02abdb065ec80041e89c165416114e2c1dc0f6153f809c5b24bc90e36b3fd9ded6296fcdaad8e33b76c799e6ef7093ef65636 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2945A331-4271-11EF-98E6-E649859EC46C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000006e01b7429778db78b43fc5f0dcad60f1f38c3c7ec01da1ed5ecbcac8b890191f000000000e80000000020000200000002dfa33696b6ac0b42d8851618e503572c68de88cf015755a295881e6d1fe9d6920000000326edd45377ce85b05985222eac793099ab013fa1b0c005520066d724f1fe13e4000000047d25aa61b4107a130e33d2ccff0614703da8e0008d8786673c3e86261a975981402ccbdcac1d99c345c5025170ff53e742810932fa732384f68b4e59fda87ea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427185793" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1748 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1748 iexplore.exe 1748 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2092 1748 iexplore.exe 30 PID 1748 wrote to memory of 2092 1748 iexplore.exe 30 PID 1748 wrote to memory of 2092 1748 iexplore.exe 30 PID 1748 wrote to memory of 2092 1748 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\488e75b7eade8a4f82215e6aa97a2c8d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5163f9c9d6693c152b7ed4525f310513c
SHA1c51a6efaa99ca9c2b73d5c9c4263410f4c5c921e
SHA2560517224fafe73a3cfeb8e38081fe29dbf4527667b305d97923a28d73c4ef7843
SHA512893276184c79ad0e8f07c65bfa0122c671561123c9d35bcf5a3dec757ebd014273a694d8db59653108ae95b41ff65ae1b039b0d4530697411c79d0270c2454fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594b7410f4064fbede4552ccf34760992
SHA178ff166d79de2d0a543826d8336a15385b6aad15
SHA256422c77d266fac96c428a1ffea06b9fd83ce4fbaabefeab6c5789e87a630f71a7
SHA512d495592907a008e29aecc81b546f8ed1f32403a772d035fb969e4ad73279a2910adc13f8e810541063f65ba8dc1489d94f22bb079c9263d95260a37b8ada8438
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545e84d3ae0ae530fcd6ce69fa27d8cb3
SHA103f519ccbf9ec9d8fb0c71d670e36d1e7ce96f8b
SHA2563fce89e99083c0b87a51a770e2701b4ec2edf1c7d12a321b23fa63763ff13c8e
SHA5127fdbb42e4c167431668a867e2bc728236918a3420ea95ff31caa0ffe172b54b12e65ddea9ecdbaac43ec203590bc899ba8b104549102ca24d1969b060a0f4acb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e89e4a433af350f67aa97b86fca2d544
SHA1bdefab3ccb165a5d7f47b23402598f1da2863d19
SHA25669040a183e9d5248bb7c410bbf35615dfaec19e273dad162bd3c9a2661800d2d
SHA512049a6be10962c88891342780b84c1fd596c9ca73a8fe53b53d8c6f3d0f403064e7af1ee018e9495265bf0f9c61ac2939aba60ceb2fcefb107f3c3a9e0447107d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5857fdec9d0e7ec116e849e0c8cfa03c6
SHA1eb09df0f6fd326917bc999887c11421c77473ef8
SHA2562a81b3aeab8ebf079e15b92717be1d43aefe894105856c44a7f6c14b221f3186
SHA5125e7a2e5c1643670bcc8f575d1d49cd7efcfea3892a8d4094710831fbb72968f6080db8385481d59736d4a7bbd944eae0320eeefcd6fed27f307b67fea53dd126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593925bf79dd26675acd5960038133c16
SHA14e80b9ff5bdbd6eea1d0463cc5b8690b24da0205
SHA256b67764ce84c75a8b8a8c7f2573209573b41def69bbb134435074a44c38b0ec04
SHA512bdf812e85c6271b7ab46339bb83a93840dd8f2cf7fb7b5469c57a1012c0d20550ee4460bd4eca2d856f0b652b8aec3f753fd6a40857255ef51e779deafd96d38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545687d416828922c9e3a22d5945ce8b3
SHA1653eb17ef5c5b0a0223c56d0bcc74bae8eec136e
SHA25609ad8597cec3131b61c65a4a52d940f2af11cc85c8ba5a1cc4c0d4f317113629
SHA512c14510b7e5b40f6ebd4a798ae5cc8f54e25e6f7ca0c7df774cb652873f70d3dd790398c7ce6cdf41d8d2d77c1dd56ef5612fad4ad6f4772fd92d093148968a7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e5fc511bf6ea086ba0aed92ba0e1560
SHA1c266660479dff24a7c980aad5fcaaab0c2ae6df8
SHA256774e838109f5224c796478dfb02dab562965d5c3f558ce84be77f3620c2663f9
SHA512b972c13332e10091cd33b2e8eee3d0230c4038c86b4a6d379e60f1303639960b8e7d368f08817cda8d8efd425eaa02a068919aca5662abdfbd937f21d78a8520
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0d183fa87b6357faca6dbb8d332fba9
SHA1cb8e0dcb02c33e2c7b497a5c1d32fd40099cd065
SHA256a6c238d2f4ada5bedfb1fa66b9e3d69c30e06906b94e05ef5dddd59fea96204e
SHA5128bca7818ce08b53cb9f5cf58c39d17120c7f3b1b7b24d28f0767f550d3e7e84d17e91c7f6b2f9fc3fec089593edcefc265b462bf943a1ba41c435b4108b77994
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d173c8356fb6ffa451ebf031156606d0
SHA12375e5db80887c809bf1b9fedca0a10cea724499
SHA25638b13caa1c2e5538c624dce4cfde12b2b4821d8454ed200be69892c8e6ecbeb8
SHA5121c23a0fe06a7fe06553662cb7d2addcbba3633ff31853256784ae21543a780f6770127925860bf31874f72c8be52ee95d7d71667b5f122d670dcf3d100efe131
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e782593fad0175db4cb5a79ef3bfabf
SHA1aca0f4da3b79980ac9b4700dd1adadc3f61a40e2
SHA256c398ef2539615adefc1136c8596a9a616fc54fb6b349521338970a2b12980b7e
SHA512ccd5377e35f6cdcd3a5664862d21b4d97c193af1d77753f7817a5fb2abc5d6df991e89c967926306f46c2d2227cf12041bddbe6ef8fda907ad26be47c05c1dba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc4723f2e89c6a3d75bf192372d2bff4
SHA10760eb360a95f8596684210b53162eff5a5fef1d
SHA2567ab07abebeec2ccddd5cd888e742c6200aa1a8136b6be1eb001ac05a500ad520
SHA5127b382b2a3d6251b2b379b6a1955b3fc5c752bdfa3caed183f0c7c163bd0a20f70654c35958625482d18ac654bf05e4a4758b6f308d9f97cde6df416bfc34c409
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d54423499ddf2d6d9e703f397029eff3
SHA15f040e896e6f910e876684590b5307fae7ac4e82
SHA2563643086409f17397253a55e9b8a6e5f4a53586420cd74e46d6f1c2044fe9f0be
SHA5120a1410c5a7a3339585656d9b435a16a0c8846297701b307f808bde5c7b70247ef6f19b4256014986e01c4f0dc391e1a674a53e7d61e08ede1f29a1f008bf9a4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3b6a9024236239630673cd0920958d9
SHA1b0b01649fea0fd630a6c1bb0481eaf9789ecd7a1
SHA2566787b56a7cf2822661c6928398e85e0417898278c21fbee84f2e89c10d1a08c9
SHA512c1aba4621cf4cca1f23246721ddb3d4652ad9ef4e878f4f6c975a188fa8569839808a713505580637d4918e7a6695906351aa341242bd6f80722fad0fdaebfa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564c29babd18d9d62a3bbd70522a13457
SHA119f7f5628d7228a844eede8c455d0c06644a40f3
SHA2567fbc63169f0a8df1d99167f6ad91adf5d02717f804f106fb8c09f517acbee7cc
SHA51241eccb9a21a03052fb82b90464ded3c92da1d8b1a21cb4e442a3a4c74e4ea84eaa32513dd7ac9df930045a8b9bf0447802a6aae1b8e00e2045cd618eb7388566
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509d9c157ad1e79e8d109d7daa6b8e3d4
SHA1a748693d4ba287cb7d72d518ff9314390c7bc52a
SHA256dce83b160eb6a6aa3db2dd65233e5661e4349ea0f69841460f9e5bb7b1098747
SHA5123d2884722589e044096e21bb373298f0f51091b7b11e98a6933e6e2d7c66d1e68bb8c678f82b4e78c038b3a41e9b47da2b7f98c7b463bdab64e178a8766c36bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595dc3964713aca1b186f3d47613bc84d
SHA1968502d5491fbe4f70420cdb751810d31c8b09e6
SHA25612ed1dfe8f48af6e227713a2f40ea3e589742e934912897cc5f0923578ce0085
SHA51261eaf811a92ec78b2648fa580613be7c4fe367a7e38df9adb7c3562b5c4d4a0908588382e55f6c504b467d6969b1a74aba705b9db3ef72570e88f615e316ba8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5522b88f6bd20485a6a600a767548c702
SHA1c7cfa58b3a5ba67b07f019b91f1f1c2fa25ccd40
SHA256a3d230993def8545a17cfc504d5b0dce9fb0022b92183718effeaff91a8ac1e0
SHA512d4c0b142c7a781e56ffd297e61e80490c737d80a863c1211151006c8669b28ff5b9ffea1ce7ef1d0bff0b9037ed8fb07914901c1d126b8d385d4a126ca1508a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef7cca3fe6c9a7080186f984eb333078
SHA1ff745d388d7282176d7784a300f7d3adb7bf75e4
SHA2560ba812367cfd6338f480b4de54bec530a1e33169395f329d0abdd24766cbc94b
SHA512e0cec2dc3f80b633b1280ad0a607b84d96d790d1e6084662f7ddd2622ace76f7246ecbfb41f468c003310de26f639bd9a43405d6f63e4c271ace7adb575f0893
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b