Analysis
-
max time kernel
139s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 18:15
Static task
static1
Behavioral task
behavioral1
Sample
415817e3c97521ede050f337a9161479_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
415817e3c97521ede050f337a9161479_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
415817e3c97521ede050f337a9161479_JaffaCakes118.html
-
Size
138KB
-
MD5
415817e3c97521ede050f337a9161479
-
SHA1
c655e9027dcf86ce1128adab0fdb4a4d65c5d1b6
-
SHA256
092737529f4708109dba868d7b231253a685a34209e8dca3744f360156adfc8d
-
SHA512
0b09f94a2c08b7e8f5f05af86011170f5888e7a9717aa9b7ab7e98889698dc120a1da1782b569e173c45d0164e216ea2b89d12ac481fb56b58385b44e9961429
-
SSDEEP
1536:SQ90bvlbEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SQryfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c606329c1ddb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f9b63a3e9d2bbe489a6c3bb8aa8b3a8d0000000002000000000010660000000100002000000067a1c2be4811fb8d49ab302dd95d22fdf1f8e9160e13159111dfd271d7b23a3a000000000e8000000002000020000000f4b4a13959b9b172d173c17574eee244271afa764ebebe1e514998393d7a883b20000000d6c4730750aca395494f0d0de3647c1c2da6c4714d01f07eee8a3898fe20a1ab40000000c1af7190be551b7d63db193aa52f70294eb1b988367fdd730d7e8f5614bd2b6fef7feccdca55edab06baae815dc3e1384bcaee7c9aa26c526f19aadd22fc7744 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435005197" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f9b63a3e9d2bbe489a6c3bb8aa8b3a8d000000000200000000001066000000010000200000006fe1c12b1571f979fef5d047f99d4e36e885a3b37aaae7bcef95dc0ec2ea119a000000000e80000000020000200000006e13c720316deff8679bc2eac9562287101435aac90b744958b815d8847f57c590000000932231cacbda48c1568d0de830d60e1832d87f10369afd16eeb2d12e19436b578f9fcd5501d913ccaeb7d23d6d51cfa31a8afdc043518d8dd021a798dbca2b984f42fa7d17a15c1ffb9c88743ab85726370697937175616fd73c8c3b216c284b23d9f540400bd684f1aa4165b822de55c88599a4aa107836bc9b38c61cb94750ce5a8e75b22e2682dd2c943d0898184b40000000619f9dceac8b0f2705b5b0d6df7d23ec1dfdfbb4b0c9524850355d72923fce638054e99086eb17b6f6a75be69727a7c659c9ba5e55fa8f93b4595ca1967c396d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C7FC171-898F-11EF-B33F-CE9644F3BBBD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1292 iexplore.exe 1292 iexplore.exe 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2472 1292 iexplore.exe 31 PID 1292 wrote to memory of 2472 1292 iexplore.exe 31 PID 1292 wrote to memory of 2472 1292 iexplore.exe 31 PID 1292 wrote to memory of 2472 1292 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\415817e3c97521ede050f337a9161479_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5151bf1ada045494407aff18451c9711c
SHA1754e486abfad776c12023ce7839bcba88dc20d3e
SHA2569d8ad84375eac894ef7c3005cb6d6b9b65b7e694a044b76c8fd11be196a2f300
SHA512fbd823c7c60c06dba0f9f9e059cd75b0f51a7643b1ecee6b70cf1c6cdefccf67c7478b710fae6460f1df168208d00493466b4cef8b3abfd210eb8b3b7cc74d1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5add936e7af073e53affa043d11bb5706
SHA1d9511d4dc5d2524af03f1273a4bcf6cfffd6dcc0
SHA25682a30f70a4ecb9906046986c92a45d06d7e1d77be28fd17c1a90278acf62ee48
SHA5122d1ff61a570e74dbc88addaacd74db12171a1de688b52bd103142f0a90e47f47e3745f1d0cb5f6472f5b0d57a6f63d3278bff620569d2025a5c045249f9a65b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5828d16beaf3ffcd2519b707addf94c79
SHA19c3ef4e67d8c9ef8c6e5caa0f697bf997d5d351b
SHA256bdbd6d169310f4f58da4b61fa5d31fa604064d0f3878df858d8acb147536b891
SHA512e4c3a0d0176da1762002b6c6d0904aad2788e6f1d113b09a9d145e45324283148f669930c9a02c71a13387dba322c11f8db88872cdcce50dc3b233e62f7b53a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59532ed1f02ad23a12cddfb1064013b6a
SHA1cec5017d7ffca72158e96d613f841452d8ce9ba3
SHA2565db9ab541752f0a76e445352039e5d243cd155901f1a69cd85e82c1b3434ef5a
SHA51275d8e6f96fc931774ea3cfde3a2efad84f07b9d5b08b67636e752aedc5e6283a626989cab42c3e3d24f95475f5d3798e0bd63049485f1603771be79531585d32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b42173533376a2cd24e7a388435075d
SHA12a2fb8e4626222739cc3034e8841174a64ce42fc
SHA256a9ec12eaab80a2b658b36542ee3d3d386a2ae23c5e4350b1d737b574705fa6fa
SHA51217cc05462a3f91e5cdddc1635f8e166a39187c43de7f92e3535bfaf4352d66aba451cf4cf5a6b0a18d0bcfc6deec33322d6c8e55432880b502dbcb1bea2da54e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571ff462218b83201d539064395d75b88
SHA1b38e35b07100d3fcee387beb83d993996bd28123
SHA2568a406d9a3a9560579d4504e574250a61fe52c205d04b7ca6c73cf3c5d90bc000
SHA512e33b914247a02b89e2c546830942d13270b11dfa5b5793ef529099a09f2e7dc901682d3c21ed240b0d37a00015c704ae257d4753b7ca0a286f680f55b4dc6607
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5caef7ee3a78ad8c66b80339e98c8ca3a
SHA192cde8641108e921afe5e1d1f4976d0048f9a22f
SHA25645aa7418dc6bd44208d8f9947865e06d5ecef21b44ae2fda1dcbe016ee3257a1
SHA51286d92f64d352713a24b838175d46d43b9eadf5ca34f028ddb298271b4fcc5e56665e9146fde5178b7dfe4856835f74ce4255765c707093dbe273a26c48f23b2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5317a45ada58d32ed860629526bb9d8
SHA123eeb902e2317b5992df333606298c7f85c83f77
SHA256fa2b739669a39c53a7498b22d0070dfb73c5f88d413d9eeb52327b1c7d900a64
SHA512293d7053e40662c54d3788c56ede8af5a743d1bcaff14bd9593900479eeb5d8bd13e1e3e88327aebf1aec092ad1aea7e7d12ab14f03805c78935c9f279d90bd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc263a3608f497b8c58a2e3759d64893
SHA19692867c4f7a1730eb8de03e5d25cc2aaeb5ee54
SHA256a9be94620730ee2b1e4c63bded72883c447c6cf6b58e64c046ee74810b1a1f59
SHA512981c218c545cde19f22349cb3d50363ebdf53e0d10641242730d2cd6d903968da3f8d59f6958547e30977a1cfda67393fef4f21a96d0682adb2201eed9fd5fd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c1c9ed073fa427714168a04f6d031c0
SHA1595bfc452abeff5e9daca9fac722e8ac139172d7
SHA256924148736cf9abc83ad69a3288ee38fd92f5de594da4655bacfadca0f64ef269
SHA512847d13ba99741201f2aa1d5d09907cfc4d39c1dcad636f119ed0aedcbc4c7207b14c6c586b618d80ead435de0118d911d71f7dec440b973963bf480a543f6230
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ea9be441a01c92e4211787831d6fe22
SHA1fdb427eaf8c655ce49513e292f2aa39411c50576
SHA256c595ef40998981719f8fa5e0d3714eec6f54ff3f2c72eb932e9cef43bea2886e
SHA512924a27d58b904e6fc2a74ed2b5e99331f8f28f518d59ff46b90cdf21781389d8ae936f5e7bf59c9481f418c4d6129dd6c5d03d8442f10759c8786b596c2bf58b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d716d9d471164e04ce10dddd4fc2333
SHA1bd7112ec78c38cf2afe24a523eb5e79c413c30a3
SHA2561410ef333f6bfe29b5f40c18ed8943b7332713b7d8b7f19f9b76650a9bfe2ddc
SHA51218877b740cec237a9cfb789f63b393a96f3720e34190d7581cf1d5af33b396c006996b63ab297db09e37a01b420c47390928e7758e220ce93ae924a71a82639b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4b741faf3e62cb8372440847f632896
SHA1ce9790d93bf71a9c215167f00ee0bda4ed93f062
SHA256867f9cd7d3a89700a39d6660008173614dc2d20f9661398b40a7050213ccfdd0
SHA5123fdfa5aea2e61cbe6af429995794d3b753389e933d902d199468909462afbbfb008616213d0e40a880716de8e9caf944dabf8664414a4a87bc7fb6eb97f605e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513ff18d051af38304b4970bfe1569a53
SHA14e3772ad0cf2d0b6b8de9a0375a6a5bcda81a14f
SHA2568f05425adfe8ff93961dba53791f9e386cdc2a5b356315e0479ea4a4c760007d
SHA512b14a49498c9d3b40c821c79c2c22a997c306696e4754d990f68d5e5a04bf0bf8c05f19192feffde2d0b4bc0df8b0cd76a54dc96dd5127bbeadac63a0b5a457a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f6953650828da6ade40a4aa23320ed2
SHA17737a33cc2b06790e9731b5ec7e04a933f26410b
SHA25638e4645bb27214f81eb896daf86bf6f0ee8c4ba6d6303c8727759d2e62c142b8
SHA512f4ff156fa0babb496c229446d723179b98394766d89bb89ab06f4bedd98777926f3f7e08a10e012d44915d3d1983223f17cddbdd5cf77162b587de04b42cd565
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513fb0ea57bbeb1d1b22f8dd3f286b4a7
SHA1d92971edcb725635a451d591dbdf0e8242f7b7fd
SHA256fc9a843aa38e9869de10354be2036f47300cb7d8893edc47e07c5f2944f62700
SHA512b413e9528548b0534437bc99f909dd9b4bd94cedbf2347b4925dd7d25a12962fc85d46b55feeb5b2e0e802af7544b4d11024a5e5f3484c3c9347f2b1b0e5dad9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\jquery.min[1].htm
Filesize310B
MD53356a78afcd54c88b86609dcc4620d09
SHA1e530dbdb21dea4dd7843ade091b602017f8778a7
SHA25606eee7f2a49e909fa44b7cfd02d8b51e5b95b527ec6910a773bc5eca4919db51
SHA5122b1eff431474cd70f2a4006565885b4c65f16b6f54d2bd62cd01055b1a7fc0a7dd2ab040f5c9cf6880705d409b2266a1066f16fbc646ec7037cd4a30f4537e1f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b