Analysis
-
max time kernel
139s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
a2b004d0965afa4abfd61b6770842476_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a2b004d0965afa4abfd61b6770842476_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a2b004d0965afa4abfd61b6770842476_JaffaCakes118.html
-
Size
7KB
-
MD5
a2b004d0965afa4abfd61b6770842476
-
SHA1
330389e36e8e65570c8e49cf342e999920e4509d
-
SHA256
e1b90140e4d9d59029dfdc01d0c982377b6b1e8d0a4d854b8351df3579bbbaad
-
SHA512
cf1168c27007024047989b434ce0782c5501e659d27390b184db94251d6d04f1d2fbd031d6f4f4e9ddcc29eee58275ce185fdea9a8c26ed6395bfadcacf1c30e
-
SSDEEP
192:kdVM0/eq09LjJeewJUHwKLmEwamNPhmw3:kdy0/ez9Lj4ewOHwKLmEwap+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424393002" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000f429a34bff4957be8a4e875434fa700637436b96a23fb0e1eeeeb6ecbd7eeaf1000000000e8000000002000020000000b5c2a41a29c7f040383fc5065a6f3d158a2de12bd39e2fc6364ac41b38406b692000000065c432a15078f73457d926c0892b88c810438f76b7c561dacc12fd4b9b41d38140000000acc0aafd1b89d8f300fe1244d5cae442408b7d9f5cf1ad2284486a6e1c636140725a66f1131b3ed9688832926103b2f73dad0a5ed75fa814ec71fe58c6b86659 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000043664b5c17981cedfe9c0c9ab4a7906ba653abf0aaf0edd82341ce8c05e6ef20000000000e800000000200002000000081ce6430c2afc43e24b557e0860a65a4d6c2e6a80b657dc43a0f2f44fe9a235290000000ea9641523daa96cf4a733cb8720cb2ee738ddea463c7066435867aa36cdfd4c7f39698e0b8f32a9576e207c39120d17045543e91abd1ba0596b8fdff15fac54b8aa890e0777134bfec3929a0ab09f04a7df3995e8a74566024c2f76f10175774c3783742862406aec8ed8e7b57f540ff28054e4bb0f9fef9a6de1baf2dc230436d48de70dcbaccaccbc9c16ac5860b4240000000b255979d49e84ba877f1b65564775dc3428f3a5dc7973158792353c49ea56c9feae8385c2f345d8015a0d93d31ab9f91d73dbf90746ae01a3ce07e9ed1e8e191 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40bf02c517bdda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF90F051-290A-11EF-BBA4-D2DB9F9EC2A6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2872 iexplore.exe 2872 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2928 2872 iexplore.exe 28 PID 2872 wrote to memory of 2928 2872 iexplore.exe 28 PID 2872 wrote to memory of 2928 2872 iexplore.exe 28 PID 2872 wrote to memory of 2928 2872 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2b004d0965afa4abfd61b6770842476_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545c83df8a93ff8532ff77abbd2c7dcdd
SHA1efc33fb3779dc0450fabbfdeb6441f9c3406efae
SHA256d8fb77790e7b8b6b8934d406b163742d73dc64d6de806179277f551476d7c795
SHA5129d840e9ddb9a9e7661589afe3bd90ff439b957b075e2b057e3e3dfea10848d3efd0d08dd04bc76c8b6039f294f23f4bc2357c56b19b71c992fbf699bf15dc547
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f8700c75d25bbf33eb716d35f85cddc
SHA1f9342846fa9c5ac7830941631eb9de0336513f15
SHA256a310c93dc0a2d74ffeef598a8ce791ffbefa56c8e1739245384ecc5991165e84
SHA5123280e11be3e5b56ae32441a2a8532d29b517831af02dbb4c4ec8359511ee55a8c8966038e67028fbe4b334d038689f39d9fdc3bdf59f3588ab4b2ece58a16fef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0f63d4780edec0406627fad52bf79ee
SHA1cc2f86ee5ca7396f3187878254b67bde7eaac7b5
SHA25668bd4e1e3d7d0bbafc57974b5529d55f7030cff17cf069498b2cad120782d544
SHA51209dfe7bd290060ee8097afc036e936f9fb36b99bdfca11386f70aecf9dfed022948315e893be480d9b373e1ae064ddcc007cae1d8a688376cc5f6dfdd97ad939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fe0a65c3cfb64eafa9dceee6b421830
SHA10149a332f1e0587a77f972f81e3dc29fca54e481
SHA25629a5389fe6f65869d6b933032538ac16e9d0c57388e260f777795ed6b1f19915
SHA512ab3b3fb88c36c1119455feda39e4cdbc898dceb96c7a414d67b167fb288c7f6742cf0d080b78228ba18d7afc4ad6973fa048dd48d19d7d0de9d9e9da9daeaed8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f97c46bbacdaccbd30cfc3da02cb463a
SHA160ffededa4caa7bf1c50534958942ce00a5b2489
SHA25639bee8584126eef8fba854d5499b89f90276f9f7b027acc10a1ef29ae910961f
SHA5128873b5d66f7b77258df43b120f1c18b7e96cf4d3a37f24cc7a6e80636304972bea1a28b91f30651346f8c678166f6c2e3e940be03afa4ae2e83e170fccf84444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0f4fb140446c9a3160e834c0d60e85c
SHA1c4162a22a13a3f52c7186f6e137c232eb53a4439
SHA2562fa843507093afa551a9088b1bc685044c842f712276a6217f115fe40b73f701
SHA5120f1df007b6e5738ce7f915e2fbe364902e5bfcf6dbeacd8edac60610ab6e5747f0c30d7e60a6caaf9e06585a1229626c2c34feb34046880a31c3fe0bac8c1365
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5439dc50f9ace71d09a330093116ac5df
SHA13e64f0f80c4c28a0ad7c286daeb66eed89648ec7
SHA2562e1e5f5a0e10dc200e26de1783c63ebcf3ff10747da040dc3e3c69ddb4fb614d
SHA51207581b25eacbb488c04267e77f09cadf129f5f34c726492355c62e6d9e366437b75203e5811f36530ee3ae8ccc90fc18709a82a0ef2d2db1872bf9b870840c8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a6f86c5af64b9097d26e6de463720a8
SHA1fcf60d4f6dc82ab4e092c9c95237a5d29cfa10e1
SHA256ee6a3b967f7a172f9a1d0aac6f0b65b24e8cf15ae749c94a081b5988ed8e7748
SHA5124dab9435014a581ac6fcdf9f5eaa08fc66fb08dfe9039d5b3493fd0f67d52fd7522a4e5540116d33b7740e39856c70cd7a3721ae29c625f8fe5c6aba73d90fec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c46cfaccbbb31a1fa9a1f6e0e3ae62c6
SHA197fa036b5b16a31b9c11e76968d702aee7d18277
SHA256399b3dca9931f4dc2bb193c1528ef33cc99595bfc449e8663a157ec2bb6b1e27
SHA51245771e035bb133f6625215026a0f603cba5d374abd669074b64a738419afd451d15ca190da354f3d6ae0e83e60cf5a87535402cc43f5886d3a48a680f570087d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5039bcab7dda6a33ca7b958cf47807d4a
SHA13445da3dbc18404653878c3fe36e24b2ececeb9e
SHA256e5aaf07168e6e2661d2f4631f2b643f6d5b5a1f84b4786460509e23f81e623a8
SHA51238b081468c92e1ce7e5aa5cdbdd3ee07698a963965d5838b9e2b606e6a6e4d35edd34dc9eba1350b94e68f19b502843adea930c34805871b39f9149954905675
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a9291faf83d97961ec84548694f7e79
SHA10ae97fe2e8e10fc7cf182a37384e4a96ae8b9f88
SHA256916eadac0320801d51ddc36fba405a648fa4bc8fe6dfeb992c91766a4bf68459
SHA512b829fe2d69d4e3384fee19ff51c50b11c1d387f407c985de1e582873c31a81ec3b660cb67ce83b589e32e62615d6282c0b2cded32fd26d217f3c79a5373fb21e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c194a4165e11e5d8743c50c0f9f68ff9
SHA1ba9507eed989a92a1ed525b898652af06641ec66
SHA256630d60d3ebdfa2e86c97e72720cc3560b3c0ce7630cb8e3581fe892ea12e1280
SHA512a6a34867426d4afc3585f65ec5c4d594ca87c005d6eaa6780f23eaf30f718fcca347c95d56de419064b5d1a021e50fdbdbe94c9eda5b2f2299dbe6fe376b39cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b8b14144d43620354c7e009550aa5f3
SHA188c8adeb96910e5582f422d8f8909b37d6901fb5
SHA2567052494ae13aa4fa0258a26016efbf1ded62a3d4381fd0cb871d9da6f739308a
SHA512e0050e626ec4079064c5a70ae4c2cf6bb74110b40675a57b93b3ab75317f153097a190ce693ae65fca2167b8637d8f381b8c846b83b14264611d6ee0139bab22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54eaf8052e2b8cee1e612571aa6183969
SHA152c6b0f5570b76d2bfee1f12bfe0e4a6b0ddb74b
SHA2568b3873360e688a1570f1bd2192fc1215a1a0fd8089b81c7e095948207a10b5e4
SHA5126be2bf09ed20864483bf4d95da24a4e1f4eefb8069f4d348babb400cb100a0193ba567f22eec9c66c845954af6f65a803835ebc9c2a506b5784969a00dc15c53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ae2fef95cc9a311c8cf2e5aa9205416
SHA1c5d28cf1d96f07b2ad5543e482784882e26e84c2
SHA25677d7f41d60b95441ef3f8951937bcb1c1e240bbb23dbe59fea1dcc6dd7064adb
SHA512663ce91afcd632cadd9c6a651c036d192b2cff7fedbf4fda8e7bdc87b46bad01b24e3445bcac9d5ddd5721f07f7388a498a4c451e192bb3067e7b8521065be95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c15967a42c739c0eada2978bc436bc8
SHA1e4699dfcc9186603a7bcfec5dd63bc8b27d8f863
SHA25619c1d6be5325f4f9524fcfde73154b07ade83417fc5f6889a267b406e98c0d25
SHA5123e59ba6eb493272c3fc5237007a9790ca1d33b61fb6bc79596d7e1fc388057759e1dbc4e3242a5ee55c4d1c4e764c6ad616f3b760833c0a04c5665db6e55a6fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fba4e4ccf86f7df65098c35951891bb
SHA1e26a20ca17e89c39d6aa5dcf7ceb4e78456cf82b
SHA2564afee3698c9b91ebd837ac97f4bc19364a814f73994f7cab036d77f1d885913a
SHA51247576a412c6d2d55106aaba9300b1a556d7cb2becbd5a13c57c6f5297a33f90bd711643ed6183c7ae0ee0f8a8c850cd7f0cef5078619c6075e30924d4fc4fc2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb459fb131c0ae0295aa49996f306fae
SHA11b3f5f800d9698d33100274ff57221d1422d5244
SHA25660dbb8e84b41d8bb64c4b80538690a4b0441542115f55b271e641a8d348f2e21
SHA51201362f25cbfe4a08e627338f58df357db8ce6879b3eec005fd9655bd410abe180d422c78287733fe86902a7c3da6bf16f25016aba00c9f4651e6a38fd558a1d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5719fd58528b3cc8b30653757fcb2455b
SHA198120830892478353d804c732e59e16319b13b56
SHA256b8ab2b9bf36e02a1feba5bb4233783428946a682c22fdf76df54a6af4ae6a3c6
SHA51215b02c5603430aecdc7ebb2141780297ff5e979f3b8e530e38b7ee89d52bfd2d649e0c9791c6586647fb2c11c747844d74f2fb056b82812bcc50f26d118190ed
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b