Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 01:00
Static task
static1
Behavioral task
behavioral1
Sample
ac543c4fdeb100c604aaa110640c3cb1_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ac543c4fdeb100c604aaa110640c3cb1_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
ac543c4fdeb100c604aaa110640c3cb1_JaffaCakes118.html
-
Size
69KB
-
MD5
ac543c4fdeb100c604aaa110640c3cb1
-
SHA1
03aece33c0d0c0c109d9de3e3fa974cb8966ca5f
-
SHA256
2829ec95155ab35bd44a6038dec164d10a04dbd97b48dd8749d5e6c3457b2e9a
-
SHA512
7eefc3d553eb52e15cd541a1e317a09a12cf01ef4b55618f4309bc5830f460baff0c1dba6c102ff3de7a1c859410e764edec76c81d41dd808d193237d4e19734
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6sH6CPURoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:J3NTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000009e0d871fc1a3465f11ea90daa207ded4ae35adcd03d2348055959c916fbcf1b6000000000e80000000020000200000004d2ce3693878628dfa347bc9c298029228fad2ad03aec9890206cd4fd77308d3200000004d6e54253eb5e70966a6eb4d2189c52484564908a6bc9c62efd12f14b697d570400000001f774ef64ea2f64aab0c410939308840f650637f080bb02d269357cef55b5d6a718e30258bc6f0ca8fec1cdd4c0965d27b82b02125d9128d621d6d44cdc5b2d8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A34D7B21-2AB2-11EF-A01D-D62A3499FE36} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500d0778bfbeda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424575088" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000328d4e77fe2b8caa9292772f1286b9be905e53da9c9e8ed3548fe3f5178b9efe000000000e8000000002000020000000163117e34f94e4afaf536b4d49894c1bb875201058d9c2e54af163758b2e67a990000000f582aae35a462128fee41cc32f62ab1635049b53d4d2163d24f688df54d1da531a87dbbcb4e22c8d0ef6c5cd7dc59d3d650facf8cdeff4de923413cd273bf56fce05c30515485106ef0d668f8a2a2a01dd5178a98aef4d51260dbe4f6e02f2e4963fe01ac84cc6901593ddd065054c3ed83fff61d77392cc16765e52e398685c94e726a485a82df9be64f30a458c5dcc40000000de6437c132c088667e4731237540babf01125ab41f6b016ea7636e18c1f3981c78c77b35b95b94f84e0e2f09f0df3d9685f1ea0eff179b7c1e0238de37fb14ac iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2440 iexplore.exe 2440 iexplore.exe 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2632 2440 iexplore.exe 28 PID 2440 wrote to memory of 2632 2440 iexplore.exe 28 PID 2440 wrote to memory of 2632 2440 iexplore.exe 28 PID 2440 wrote to memory of 2632 2440 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac543c4fdeb100c604aaa110640c3cb1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bbfa873d708c9d76b22e15cd87c7122
SHA18cc4ed88aa1910a1ea22cb8e57d751744faa8ae7
SHA256a9c516771ca65dbcb00a3551077b1bd91e0e479aea4598314b7038223d59cd39
SHA5122c2fb6ce50a0b9e48bc4b004ec8f2e48714b0edf52ee11cacc56ad1dfe05a3e18ff1cc671f4c6599bcd55b5ba8287cce2272a432d0de1c567d55d02e17aaf972
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4fe205e4feb63056f41f721f72ed791
SHA120238d774ef18c3f3eeda2ea6c026fc9c3300796
SHA2567447586fda47e2582489842154945e6da06f12abec2e976b9f98fa193db48c9a
SHA512dc9811602f83f54c20e09b9f0c6efbbb9dcd7146bb757839def8acafbaf3568837c948bb1779802b94236441f88cbb1f989ba3108084f46599636318ec3ae0b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4680cc96914bc18b6b60c9476753321
SHA1b3fe3acb1692dc1b8cc93757e193c49197ad7643
SHA2566d7f75e8e11a3f618a721ebac3087246caf741963ea5ec072905f6af010a0328
SHA512b8aac04583e326374830a5056ab61170043cf64d1e53f3c3d45a1f8c021ea96a7e4f11c9f4f3d49aa0d19c02af83927f21bd849c11280feef7fffda0faf0993c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a872c569a79cb06d6e52b7a926f311e
SHA1af26449ee6dbff4a2b992fb46c55cfcb152a42c1
SHA2569f3fc704556fa74b32ae962d0362f43a5996b5f08f80b39732113398072f3f2a
SHA51268566aad48feff67c68854352407df3c55426276c4b81dbba3b8d8260c70e2a93e03f893efff22330ac2d343c0b9a16606da30f6381cb3c90883eb8707d6f858
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595afef8b6809a8a2655b0a2da35f4c23
SHA10bffd8aad93126c9a702a92a5503ad966451014a
SHA2569f6ee34e5f8a9e76a7f470c8dd4544bb43f2ef08b97dd1d461834ac8b49bfd60
SHA512ca1c1cc764bee5b8ce44820ce6479dbd4b6b3e6849458e9d7b73b5796017ef3447c5cfd5f495b7b6fe64da4defaf529ba5ca1ec06db2b89f219bb19f8f313d57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5962102066e5a380311470be38a0649d3
SHA1149b425e955ce74bc3256c5fd2df82398722926b
SHA25690abf2b8c12153f797ab606d516445d03d517a9af186bcf781fc37d07f9eaf08
SHA512c58a4e173b71a591d74ab0ab50f7b8119a99aa833698b228c0d3dc18c920c55b1af91477f13e23ef01986655deae54204b83b182624d45f35bf779a67f063b2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b2e3737e14b7e0bfceabd2c3081f24f
SHA1db391ff906e5b02991f39c0745d53f98c43282e4
SHA2565312ff1c74feaf702b279e049ce301f1f8009b4ee6771cdfe2e8a1e99462f195
SHA5121c6fc63ca8602f7072e85d8272580de12cd74d5fcfdb8ac06181320eb91765f0ac0bee4878da75e73be1a51f7205bd122a50b4585384f174be7643c5196aa683
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518f873fb8a558e51358de37e247d0018
SHA1a5a3d1a8227a56b2bef78dc171f408e580456fd6
SHA2566704c9afefecc2024f5cb641d7ab8612d4292572fc1640377480cae8b5be3656
SHA5127322c8b9bcf6010aab2b800276c84bc4dc14256d92b63b9c0eb981b13b78c35270d23da4d5763617cf733f66f7ddc89bb886adcfd3050d3e8b6685f976505f5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e6c210dc9dd4680b8121bf5465f1ff4
SHA17ecd691a5b75ee339a6cd64848b1be7001cef4b8
SHA256c6d9df385357f700dcdc841ed86a8f32e1f530bb83e3f9667dbef2c4f08df0ee
SHA51257e36f262426991ffd4c07eea70fafcf725799dedef65daab5b8edce847f26638e506eb230279dc97c06b2cac4824f8e126271ab67401b93c2878ec344be1235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e065611c427454e83531d74be7ea3bef
SHA1223d996f589da95c613baf3a2cc12e244e3c6f8a
SHA2562c0a5701132f112f24bea70db50f1647b805f186abca0018fa8e07378f86efe5
SHA5125093296c86e3df13f3a95e61396f10d50f9c8c3a54b9d00d20b2499096638e7f02fb8986b387159e69926f87d2b614aa03cc96e8ba40c21daccca8ab43720a5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb74658c3ef3045de8a5a4638a591589
SHA190a2a56ce2dd51bb677565b9ae605728dac0b0a5
SHA256c8d2fe6cd6c759c0ed39b6bbfe707038a489b0adb9456f5860c2ca479f3579a0
SHA512eb77399f6f0bd878800cb4864a925a1a56410f4e49acda69ac3a1b67d24b09fd35d2e9bff61ee97b66ffa01b9250c2467d7325119c34c2e4832e0a6c1917a4d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534fb75419b57e2ae710e9b790aaceefa
SHA1d23ca84d6dac15438d2780026f77ab6b6e9d262b
SHA256f51aca3595741f76b7e9d51dafe9ba85b784ae8517e38ff18e2076813fd9fd9f
SHA5122826c5339ff99acd4d99f11eb9c5db35b38391cba5e23828d4f3b101912a2e090079156d04f8fe9aa093c9a2357fcab6da8f1c949263727b3acf4da3b1500bfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54326e9a50dab5f3d3ef154d168749de5
SHA14c64067db9f84ee4cffceaaeae8adfb0880f07f6
SHA256771e42c23b814c92af38348e378d922ff78dab9bf74653e12b8669dd5808b129
SHA51230804bd4a7eb2799a46942c581bc02f525e6af29bb67c0333f59f922bb1b3b6ef4308bde7cf4afbc9ff5ed77a4a6b1fb37ee83083fd0e8df1f2ee048006af487
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e4bbb47689fa7e233a11af46f31279e
SHA1fbcd3f608868cb4b24b324733c88d4dcd8949834
SHA256798214cea27efcea617cbcd293cb4006dac8c75f3194bcb14dcef1039b4b9b77
SHA512f5bcc3fab91dc11c215e6b685e1ebfcbfa5b0e53885c4f5e40d865819249084e10fcd7e507ae711d52cb8353c0ffebe489f91706bbaa4409726bf1862c0798fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523d9a4046d95c7c840c2b5f85d01274d
SHA18b7c32646065c4dbd2bd085a13c8593a985e507b
SHA2561a16cdf2cceb893dc0028d1dbd3a33e1374e84cd1fbca0bc95b8480e8551aa54
SHA51234ead38537fa22a37dd78a7c343ea5811cfe518cc920f0b1a4618d0dd1d0136faf291e289c80dcdeaf13bdbd7febe455a0c92c27e5e84807677e908ed8e7a7ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578b17021b4e5dae2d078cced69aad3b5
SHA1b67fea778cdd61c26e20acdd0380178ec56f0017
SHA2562eaa310fa43dc48c84443ccc5f044a52d00042bf2b0df5cf0cd342004b3c41b6
SHA512c82e18d89c722f13d435f3d51b8c31fc63f1d2a18e5c105e40e44232c0a238d373d1852829990e1800ee6211d584c321d05fc89ae9d3b8c67b64c24577d9bdfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a9323f09a6bfeb94d1f1c6071689e1d
SHA1d0fc7409af95537066b69ec3713cb4e3e9cb0531
SHA25653fd20801f1e03bdc4287a90d652d0a2495bd79906942aacc5b75d01a102428f
SHA51215429ecd9281de05c21a8e88ccb2244c64ec6ad75ee1389e6d5292224ffad03931430fb4c4c652c8c0d2b73b0e5b0cfcfec6f2d0f30b110d851527bad4beaf11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5094c36ff02c0d79cc09a432ac3d3952a
SHA1479de9138d34b35b73a768e1956d7c81e497274e
SHA2567941bbf232bff3ad20ad9101fc4c69996a8251399f856a5543cfb2171131904d
SHA51232aeb1b4764994b0a7749f21370b53c4ef02c284f8d557e9943bee2f941b6371be185fec2f1c6e67680015055dfde7ff04a403ceba13ad9ba40a2eea356188bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dfd99d0c3b7cb5c822ab78882680afc
SHA1a826baa23f15ab20dc57cf08c0f7d6597d3c0161
SHA2567989ec32a7c086a14e208719cede9a5e01c938be4128e20b11972e1f5a917f5e
SHA512bfc38f20f9a00c22c658ed245ba3e11bc638df086a730263df03c93f9b4a28d66dd6284f971738c4f675eff124c6af68804aefbf39220997d86ae569b98e753f
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b