Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
a77be928cc88ec190e25afb2f6fd8a22_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a77be928cc88ec190e25afb2f6fd8a22_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a77be928cc88ec190e25afb2f6fd8a22_JaffaCakes118.html
-
Size
461KB
-
MD5
a77be928cc88ec190e25afb2f6fd8a22
-
SHA1
05026a24b6fed680241d927e5be5343c3e45cdce
-
SHA256
a125c3ad540daa0794c13138ffff7236668dac0d67d4643e9d88cb18cfa3d33c
-
SHA512
2d221dc9c9e5515512c9561d254a45b6b505bbd80adb94efccadb4c4b62ac2ac82a12555fc47a2af917f8cbe46f895563a748d45fc187648a84618cc1aade863
-
SSDEEP
6144:SYsMYod+X3oI+YRsMYod+X3oI+Y6sMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3X5d+X3y5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71B15091-29EB-11EF-820E-FE0070C7CB2B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000f7cf6852c13e84df7dcb0e914516619d952246c7a0f7af3396743cacade248c7000000000e800000000200002000000071f426d23f15a09d9074d8ba157650aa95553839ba6eb69a812e35cd36e499ce9000000046ce662210fea8f9f7fa81d56021de4cef7a544a0352e39fa30c2b7ce080c202e4c7293a5c4331162f0b81a2f53621fc000a430a35ecf982a61a18391c467001537c16ca0cbb24a12cde8cdb5daa447f8172eea5cda7b238f8612c185fece9caf45b285041cacb1f7b676938b2f5600ea90e400f5c524cedc5332f425f4c2a763a66ef6851a479decf89071f8e45397b40000000d7395f9b96b6ad152996fd256029cb2f737dd53bef184beaea4c936933e86de5e2634f27af4279eb54601eeefc2ba6814f4f5f4ea5f0b0698cd70e5790094b61 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b83f4af8bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000009fbc8271f4c1ce2367420c83780ef85a64162c82329449b714c9c35f0687eda4000000000e80000000020000200000006e0a6dd48b99834098d3c0ae33ebc36738d998b20d2c4db1ec4901e955c30ead20000000cc5a67feae5dc3b2500a33ffc60fdad117d5ebf0f0a177dbad32abe27a0bd50140000000e8ddb6f0fb1a00df09d82d23b3240bd4468c9eef68055e16280c5e7b995d6aa50f68ca649d0da6b98354024702d2a29dc0a9189b14d577baccfb20b87eb3bec0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424489535" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1244 iexplore.exe 1244 iexplore.exe 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2896 1244 iexplore.exe 28 PID 1244 wrote to memory of 2896 1244 iexplore.exe 28 PID 1244 wrote to memory of 2896 1244 iexplore.exe 28 PID 1244 wrote to memory of 2896 1244 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a77be928cc88ec190e25afb2f6fd8a22_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4a95f3e67603511acda6ebd993a3d35
SHA1f89d40b468f954d879c2f967ba4a591e1325e09a
SHA256587a96c6bf76c6f69620b3cc8703a9f70ab934c2d593e263582596f75f2993b2
SHA51249d325da7ed5dada4db1e4f9c22f0cede4ad4a7ec90a61362a7b65f4d25799bccc53bd09e091234e6b007b4ff1f45401bad4fa0bfca99b9d8a41ea2608c1c054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526fdb46d47c2a13a9de965f5b94ba17c
SHA1287e7be60ee82694f6c0e60579961c7d6a7480c5
SHA2565e3193ed6a3d1954c3abe10afbbc77aff56fee3b5e1d0e3b63d1fadaeb18bda0
SHA512b6da662ae299d96a053b083e4b7d450cddc2b1af80b7ae666a6ce724cbd02b5dd3d0a570a63f0eaef884b4771804dfc496bb3b30281fbad6a81a6b5bfc40d41c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da8eae80da02b15f67847c51682c75e4
SHA18bef2c28d0121d33716a8b061c19049dfa514da4
SHA256415cbdcf2ce3aed1ae1b0f89574a7ad8624c3c4e78392a748bb3e21734352d2b
SHA51266ad2c302f62fdf19db3bf98e7be942a2afa13faf45f497c1de74b19ae45ac74005d6343f0395f1338d4dce62ac49316da8c1e1cb261b56d9a81e5c540c3e408
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1d08192821b56f0a652821a8f5e1a0d
SHA19c6363caa6c9dcfb183df26b71b370aefe7ad2cb
SHA2561764678c004601a34a9c683e5dec9dc1f2b94911e75d10ca8d34ba479c9cc9bc
SHA5126addc7f3f6ae78626a1076c10001a34f381e50766cff3b1bc6f49b60d1c39e56135abe2eea4419f2f38fb50f974fe09f1700eefae9d8c2ed3a104be6330d8792
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5328565ac317352c19eaed45b2e041f0c
SHA1eda0b23682def1b768ae67b156bee38f55a3875c
SHA2568be63fe1077a81b38ded9e5321214dd3cd923204fea91deba3697609304845c3
SHA5127fed2fc5b77350809513c8c60ad09ecb84383319bd2d81b2728ef4a069e75b59fbbf29c31cc49fb1f5896246cd86ed4a6e03af1be50e834e3f3ab0a3bd6310a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4d84597699d720cbe05da1d76f5bcad
SHA13099736ad4c49a071299883d0165797d2c2f3ecb
SHA256dc112efc6d0f8d846a8214fc5822742cee16b4029a91a626baba9c00ebfb8bfd
SHA512dfc4e05bf82669262e7252b79dae8a4443911412d68e99a02cfd3253895b5dff7e27532360986f86997110baea07a6c0719fc5c0df30589de32b76b428e8d0e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531feab4bb832ccdfbc6d93b37e043b5e
SHA13e4b00253a573df2be831f37387e89beb4d7c7e2
SHA25625cf515e65126c78ee4310c6e58bcbbb5d99b8898e85bf19263b901e607bdfa3
SHA5123a16be06c1a6e1c16c539766a7d1dba003daba1fce8de5cb84457edc800b777a8bdc6799741f1540fcd86ba2e50ec4d254a705455a0371421a1e886f7476b4f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5801d550c87b28620398c4767ed65ea0d
SHA17df29186df864f0872b20f5e0a56f5e00f5f9243
SHA256585b8510e942e2d2d858372f9f12da0fafa46c5c771cc76f82ab6983618ad85f
SHA51249fc9ecc94afd355ededbe6471d8841a07e87da6d41bc22cb03694700ef16be811d785c6fc3e3c35fa535f0a06c17fbf9274daa32f95ac4c8867fe6c62686e95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f3f1a10f61cf4f38e3309e4731be5b1
SHA138b894dc7b179bc27a2e931d4c0da5e15c50436b
SHA256ee410054b01e0b9492ec3bf3661a3bc1fa975701b6adf64a5f6e53962622698a
SHA512d34bbb78c7edc050949d882c7450380d1569d8cb986d47c8298eb6d912e4db3fcdcbcb3003783ce5243aa9e4a121ec77bed34416ea7625355d792030af5603b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583c9931dd0051bef3e68b3bbba952fd6
SHA10bd80f6e47e4cee0b84447b26a77e98b9d9ceabc
SHA2569d2dcc023d5d7df318a2f6c8cf66c356182781102564e12a6579c54d8316b4cf
SHA51228470328d55c787e210fd18ae7e570f2dccf0ec88ab8de7d4f5f2a3a70dbd12bcb0f902b23641f4c569eb3618345bf4ddec39d889236af91e1e116a5d0466357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8989acd5a10660b6c62098638f0382c
SHA19a4884741d15892c6b5e1ac2f2ecba21f5dd45fb
SHA25681fdc6964d9d6cedeb306a433f4b56a86bc8963e4e69b75c79b5436d19e1a34b
SHA51263827860d83822444ac334e95ce95edf93beab9d806aa27b4f0df58bc2749d04d90338738ed693d2602d4b021e8d0f96517973c2ab35db50fa1b62803e7bb138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ffe18555877322e225123ffbfd0807f
SHA1fe6a444ffa7d99b6342ce1498cf2dc1812b6b686
SHA256c5e55d333c18f969f608014c20c89de3f574764f96f3c36e3c1ee7ce97d53258
SHA512fec82f63b7878294900d6008fe7ee289a42e24f5e4b46291ce433fa81589c36dfd4bae890da7d1e038dcc6d47aa4feb31f1d66ee8111ac2caf3e19018192fa87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfbce7b08698d803098a92477fea562d
SHA1c195d3b4c827acaaf76b80b5ae3831ab7a620d03
SHA256284c8eb46bd2f405d49d76d19aabc0c9c14d15550bb5e116a30d65a88e9717d1
SHA51252dc84d9ed3783386e4e18b8739150fb68ac758b008cb1b0c26b49d7fca47a0ec282a04a13cb63bb47a67c30cdfb43e60f93ace7ed953a8d224877283d747138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562c32da9dec66f27d27b797b227651b6
SHA191c3c75d7ec6dde244ce5024b08abff4f2ee8aa9
SHA2566a1a9fdaf496248621d75bfbebc1ae5d4ccf6e4abcc4788e16f244cda329e9c0
SHA5126255bbb5607f52f9c5fbc0032f864a82ab50a302b797cff01a45b8aae68032eae526921f8797ca69d756a7ae38d5dd9ff5370252de4e26f6201b86f828aab18d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd87b2896741bdd9e45f55cedbf80bbc
SHA1c24a9359c451e0c777b223c8060ffda11fd0ce99
SHA256d8842fbc31d37a3e024807d96beb66325489a58cd73e369077038035a6155f0f
SHA512e15cfa5cb1c2553d6ff7a5693f6f8954b6f91cecf717759aeb7db8d66c2550eba5dd10081f6149556894a3d626aafe50aec41a068fdbee7f42c545db6743a883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6ab7248d3e6b49b3c1091037eb22d0e
SHA11bacfae609c22ffbdfeb60779d6353f621a73b3d
SHA256e1e54a480477397abd27df18d8f5af899ac18873c8b740c6bdbbe287bdd7d6d7
SHA512d64297ced95c20a410048b63d6bebf68808099bece4674e489230647408551b13eae3655ef826c82b982d4f392bcd0e4040c677119016f06a252c105d063fedf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567c2ee01ac970ab9981ddbbca587b79b
SHA1ec11cdd39e5d36d812aadc99ffc18f122d8e4f1f
SHA256c11b3b5e540c30090f7e233d4d936dfff5d76122d0858aa62e75619ce03e1c62
SHA51254f1f9eb18c0037793e639d8cbd01f9a3d32d277f547c3980c7b377cedfaecdbd2c725eded07c691cec9b9a60cd8f0b76235069ad2b7cbd0cfb2ef7b92df99f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5760b62e26e0f19145786cf5ad9728753
SHA187c1748b1f4a0000d93b6dc58a2e06d945e1a46a
SHA2567272e7b348fed89a9e8592509fee13f8836198488aca293a2a676d3eceb93c46
SHA512d107386bfa4227d867697226a675568ebc0152b703172bb46fdae29219b3c3a4a1afd9df3f1c70c724f7b879f3c00ce84afcb38a75404d5434a8ce7e39478fac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cd89dd31e08f48934a5305e58b94998
SHA1eeea033d4458406f4bde1eaa09a92ec1ddddca51
SHA2568a2e744ec3e567670e1b5c0b1de2fd284dc7f7ba052e1a981585ced73f230d67
SHA512c66693637e1b49c684ae3afb50a5a741cdd45436f5adf316e1a074cbf5c0e5cb1cf2a7a9e9e62d64ff3f878d382f412c96bbdb083e7c0dfe00a28d68321bbf38
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b