Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 15:43
Static task
static1
Behavioral task
behavioral1
Sample
a132b4bb2774ca50f9b3092c8708d9d4_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a132b4bb2774ca50f9b3092c8708d9d4_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a132b4bb2774ca50f9b3092c8708d9d4_JaffaCakes118.html
-
Size
33KB
-
MD5
a132b4bb2774ca50f9b3092c8708d9d4
-
SHA1
3ff69491a2c391a1f06f3d9583e3aa61e70cd8a1
-
SHA256
0b68cf82d7657a1c7ebe028e0ad3979c2931e5934e9346f5d3f400b51f970a30
-
SHA512
dc4a0f8494feef2277a33f67b3e4533f8d18f977f466a20e3c83aad603c3ef5f63ecbe8f9b11e7166092665b59b25f17d7a82eb5fb3d5d6796fe0e83f3029eab
-
SSDEEP
384:jfwJEh7SdHEGRtzPaB4BwPtqkRPaZ0PdxfJ0PkoVMG:jfwJJPRtPLkCeRnCR
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000002a1217df7a7c625a0c146f357150e59526d795f3e03a8d1bd6bc292d2fccb617000000000e80000000020000200000004514bee3fac413c0bd4910451c6d1b62b80278b96c9dd752371fdd4feb29852b2000000055f1356d334a6e9852d78eac6e2869bc3577b63b6a771af98de904e8cda527b240000000095cdb583abac46adbee38af79238de472a4e2ebc4a7af442f188c8e497c201f02daaf69f77b15fae95a3db2f402db6fb889ec489f9ca22afc395a342bae1335 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8514E121-28D2-11EF-BEBB-767D26DA5D32} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000aa0a17b996aa72ecefd8866208c83647b502ed1dd252701164fcb66e808c55a8000000000e8000000002000020000000869aaa049207935d908bb4c713355964ac326e14541491e1fc621106fa253dd99000000098fcc5f10d5b019a78901ae7c6e8d4734fd536921115c2dbef89dc9f246b1730e398b05127de2252b5dbea904f64b13832a59bd93f4f4d4dad8d609bc1488f655590b489db2a74529edf4badecec9f97d94c536605d302ff71a85277d0100533ac2a271ccc27cee6dc9e9f8717a0f7f289acf3a93f2757788042ecc98bcd60da10a446a701888fc27c72c76457a8f75b400000004ae6218a84a9c52af2f0871b0685ceecbb1ba0440915d44c661285c0b525abbef8854f377aff6fee4f4bdb6794acdc57e0d96d2ed080c10c3e8ceb551c17d443 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424368878" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60efab59dfbcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3040 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3040 iexplore.exe 3040 iexplore.exe 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2760 3040 iexplore.exe 28 PID 3040 wrote to memory of 2760 3040 iexplore.exe 28 PID 3040 wrote to memory of 2760 3040 iexplore.exe 28 PID 3040 wrote to memory of 2760 3040 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a132b4bb2774ca50f9b3092c8708d9d4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5288fcbcb3e4566ba734768c54896b798
SHA136755dfecb4a469759c68ac5c930504d7c7b5f4a
SHA256dc5b571c43d1458a5370443a0b950b90a4bb46f083ca876215c943543c691a9f
SHA512a5d8573d412d316d3a583554e82388dde56b253fdc22c4b18ca8fe522f1b87e0aed61907a58e8c51ae4c8f9489e3ea5900ae1eb3b4b53f0d111331eccdae2a65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a96693bd0f5ec8eb77364b197e81b7f
SHA1367d875a031999835d790f55665586580987d346
SHA256d8e56542cbeb259d5dea45139c8012839941b32ce4399b470d4b65cc2f477256
SHA5128247f550a76c98838e367be9d057fd3a58e29fbf9bc115eaf7c34d48f6f8573398c52d90e7b99888bc3ebda5725772a442eb4b935702113c343e6428eec3270a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8372b90988705a2899359feb45a4971
SHA185ab7984de9898a255a301496b12927457b1cc81
SHA2562cc5a37e305f1ae784ab623f0fdf509797500475bcc349936552f0564e8ba6b1
SHA5124fb38130fe9d0bf336c117e7baf8666b3fc64baf2b273b5aac53f5b93ebb82b7e36185adfff9dd80ddc5fb48023a4071f8651a9c89806d56aaa57a6403ad41e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6413949db9a2738b638222ea53c2632
SHA1913ff77de3de6f28dacb0ef35d8c3e8877f0628c
SHA256fa6f956cf27f0d0558458d330efa00fc900a9e633768de65b3e70b3e266319a4
SHA5125421b0b2d107ff2f9c240e23705a7649da40d3cb112ebde4bd8841a73aad8c06d33c0682130e3164f4bb3d1faf3e4f47f515fac52f80e0e3607ac885453de343
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a77ea62877c26cff3ba0528a8b7fb5a
SHA14278d3a95dcd9fdc9e33808fdf687693a0fa294d
SHA256b9ade8183ab2144dd597e115d29a51d233774c4bf5dec830cdeb2ea010b46f3d
SHA51296cad4da3a1610665188c23b94ef2f545a0fbbf1c4671fb4e7f016e2e136f565057626050cd4cb7cb2006120dfedb57c6a6679ef5bd58648be4ea638e02b97ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ab1cefda67b9ae265a9ec8f9b07ef8f
SHA14408777ea173838ae0b02afd133ac6fac6ef9bc3
SHA256a5b1c0e9522c5819a94cbad3eec30cee6b1e9a3f5e13fbeef1cb92a16a4d6d02
SHA512b7e2f89e0cdbeb4d6f45300e5ccf3a9950d6ba5ffb9e2768feb96c8358c71ce0d14956dd9b1ec0b9bddc5c04169d4d8acf759f5eb9d6526263f49cb6c3a55d12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50aa1c2aadfd9790fe4efcd26f7070e8e
SHA11ca8c7d18e1b7b2468bb05d96085aa2e82c9da92
SHA256449fe9559d7f72a4d2adae1ed947069843699720ba761e553dd350db52fabb0a
SHA512261befabd2104b621314d81bc28baa03c80cbea2cb78f8ddccd54c9868957cd29c0b0b6a8f4fa90b81ef31a25d940302d1b8b4977d63102df29467469c5ca66f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5473a6480fa5430baf456fddd92718403
SHA140a78157b04a0cdbb65b1d7a523873b30e2f2230
SHA2567b5e154e0d85dad30bbbff695a13bdf21ce1aa25d510fb95f1ec45af4c8d3d9c
SHA51276f9a191d355cb7dd705866bff95f6e3a1ecb6108f039cf46d4012e77aadb109a4e254462cd5522f3df4a6456d93878f87e49f517c33bb6e655be98179a79df2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d51cc7b1a6a5b85a987aa4a0d802368
SHA1831fda6fed7c2b5dbd41b3a77390b8621f7bee62
SHA256f55c9119862a8f603c43f795cd4b2b9f31f0426191802f51955ce3e09ff83921
SHA512319067a0ca20e357357c24e1b4fb7aa134a785f597f269de1aca8bf84e20b37635600b52f9add6762c483fb2ea32e63c2cd2c09ca9c7a681cdf41262f65979d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d349093864ac9bf3be6dc2b16f69899
SHA1500f9000aa933e41dbb4d51a7cd83b82ae546f4c
SHA2564d6bfa061cfad5098fef7379e08e2eb7cb0fc8c1f6ae59db6c2ed94f555be85c
SHA5128bb46569bb3954bcbad7313f409e181156276ee2ae637ab30043505d86867dab8a874e4ba68b834959248238429a777300c0714878f0d4ac5d39e86700d3eb6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5354b89ab319a0820f69c4f17b9992cb0
SHA1f2bb1c966b598309301f9f9f0959219c7abad537
SHA256f87fd3825c16014e7c9d9a4e9dbc595793e443b4ec03bf5091c61df5bd59a22c
SHA512c4d0ab27158b5f472969389c63ae79eaaf5bc3c80a7b92fcecb8d50dadc97cd32c50f0400cf054a70d685ff4a7c57a075b2de2928a8c393d28301e5e95f4a5f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550cd4809536536a2c2e758e97f5ed7f3
SHA1d743ac1d4c6d55fb6a299d5e22cc19d56ed34278
SHA25677dc179bb95915a98e267f0e5e8c3b0351e5e5e2461ce1a44e0cc6bbbb4a4880
SHA5120adaf0e8f3e66196ce02d1514b28902a2dcfc378da632dd78d353fa1409cdce3e37deb8be02b36f7d584578e738dc8ac53e7100bbb73aba19633cba6641483b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5593e27e59a2ffaa865f8c0e6f5bc01b4
SHA1196c027bb4ad826232d87c875a31393776db5ce3
SHA256800bc3a0eb9c3bba3258e26981e704039afbf814ad97c26493f59b5c1a4b9f5a
SHA51274dd3070855717d060edab0ce1a5ec5418eee8eae13989a2657949344c2838f9dcb795f15b30c195148d8e1ce285fb1a7936669ab039c468c18325a7f06f0f16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561de4929ea96edc68c1a697ad62a2ad8
SHA1465c39a24aa4a883ff3e44cce2e100124d396143
SHA2568401bd5c8a00d7da20fcb2cc27d7b1400b604d962da7358adecccd1ddd8daf15
SHA51248c810b2acdd7178a044626d9f2ff5c1a2bca6fe558ce0c13cc7161651bc67a2c2c6885366816368bd7cf94a78022902f6534e6045a762336c74a293f1e370e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5627d626d7d693ec58aba1bd46495c3e5
SHA12a8da01fdb07d3c6052cd047eff081eb0b43108e
SHA256a991fe784fba0769e7a6520979df10226f4fac416197a6cebc52e319e759ba9d
SHA512ad5419097da145a078074fdf2d9e320378064cb54830aa80ebc51b6c904582a5d4c2f0fccc9a02e4c6719bb7e196bd5285f48b15eab60ba0edb1f00e26c7cecb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e5a7c7c854d42e2913e68c5c6de0111
SHA1509f1b31496a3942e45e8036e65e07984b3e972f
SHA2565c2dfd8fa7591bfaf67a96d028e80e78d59f0fa574463ba3d0b099fccadb2eab
SHA512f6804588fe32dd5cba76691fab9099b4cadba1cde6714a18ed1729ab75f97131ddde45696603f7fe124173595b7af6eb79c984f0e5334d0d436017a0d81ca08f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b6885be886794205dd31199b4a4d057
SHA16a9cac20210baf61356ccc4d41772ce0bbb7a27b
SHA256c06bb0159d9ac8308dfaab8b74efad4b1ba3b0f64cf42207f3be8ba820edaf3c
SHA512130ea9665340c1a7420de7ce4a0ec1687ee72d3d128f52f1fb763574f4998a6d91a8d3fb0b07231c8db24bfc1703eb77762b22fcc05686acad145d9208f6f200
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575ebe975bb85552e1e2bd30bb38d445f
SHA140db3c0a49998c7503c6d6d3f2ddfac91a0d9ef5
SHA25659c30adb4f4d052792d3d159f4b517d60aa4436c941a431054af2e05bab5de29
SHA5124c582b4123eb5908011094f68bad69833162c10839adcc09524f9b4940de1b56ef6f6c76b03f6bcf5e5a51718cc192082400bb55ce5d82872c7e5c3c8a5884f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbfff3dbbf83d35d1c77770904d83139
SHA144288e6eb1606b441808e9fecfd648a00ce3af7a
SHA2563a7553f526482e8f0eb3dfdda764874473240c7acb8de53fb5894e2359ab4558
SHA512524b2363e918e46b9ceebf98ccad7511b7f49f0de0c192d57b54b9423f7eefce6f153fbfeaa3bfb6afecc83d882bec2c11cfe44220786b9c4ce344a43428a9c5
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b