Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 01:35
Static task
static1
Behavioral task
behavioral1
Sample
ac6cac3f5c79c7ad443d282847f0a628_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ac6cac3f5c79c7ad443d282847f0a628_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ac6cac3f5c79c7ad443d282847f0a628_JaffaCakes118.html
-
Size
462KB
-
MD5
ac6cac3f5c79c7ad443d282847f0a628
-
SHA1
a78c9868e4f0219efba49f2e02f64c5f23a37986
-
SHA256
664ad486c00d98470373e7ca020a9260ae7d8a31eb2157bc67db6cd7a2450556
-
SHA512
17a1beee915bf7f4bed07288382b1deaeffeb9fda4ce7f061d7a5453d9cac75a04b16bb987faf70332391302e7166ae72848b40271f1249d5c932bf19a29f0a2
-
SSDEEP
6144:SgsMYod+X3oI+YzLdsMYod+X3oI+YxsMYod+X3oI+YLsMYod+X3oI+YQ:95d+X3BLp5d+X3T5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000dbc9822b41da1240ce8192ff06c5337d4fac8a4d34f59d63cbe733d786a60343000000000e80000000020000200000006fbb3431936240526764f0df39039ceb0c23f9ee902a0374d44a9996807d38c720000000fd614b42f0eb356877af457a3f1672977591c81804edf50078967a61c2c90615400000000b0f0df4d073230f5dd4057544d1eb7218b4d12d0bee5b2d7830dc7693267134efb0e006a3b4579bafdaee610105932ae41bbdbdf72fe20fceeb933f11132dc7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000aa4775ca4b30afa3e47819ab9a9bd4dd39f507f37cd69931b96ae5b52e642431000000000e8000000002000020000000503e38917c9f8e48c698dfc53c87190303f120d09a7e2dd05a1625493ae5832590000000db9ac9e933f7216eeaf5501b1aa45452ba47abc200be8e4fa4bd3e8fa8b102f7a2c40abf616326fa0be25685f63686d45e93dac429a1791ed0f2ea14743b63230055425f56af900bd3440d7d6f0319900b1f7bb87f66fc5fb156f0967ed286504bfaed4e6ce433c5226d4222f55b51fbc86a509864b2bf04bb85a7b47c173abdadbed450594487ba4cb6602d2cf3074a40000000bbbf5098e01a5bfb2e18a5c472db60f441ac0645b642ecf40c426fcf307c00cd08e40b3e700949f30d64bb716cabc54409c326e6d0b11b96ba022600e84678a0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7019a06cc4beda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{941664A1-2AB7-11EF-90EB-D671A15513D2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424577210" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2344 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2344 iexplore.exe 2344 iexplore.exe 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2272 2344 iexplore.exe 28 PID 2344 wrote to memory of 2272 2344 iexplore.exe 28 PID 2344 wrote to memory of 2272 2344 iexplore.exe 28 PID 2344 wrote to memory of 2272 2344 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac6cac3f5c79c7ad443d282847f0a628_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de464f09681fe9463974e5643e533be8
SHA17ec3d387750df1ef32c51689ebf6dc374dc88490
SHA256309862619221b5296a4845d873f223b940d6e527cd0d2d522b1ef462d20a47bd
SHA512148f5c4eef15866b55b0f10dc2fb1a1331d07c4a82e9049baf923975e7987283ecb7bf5eb10cfda23be98d19c2899c05227a1ec9a95d172829416a6d6659d8e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c3d6070be7679e5948500d88d6cc720
SHA1664ad0a05eb218ef332bddba4e48d8934e344949
SHA25619aa78a2d148824fb91d11e23bd3cb92f8bc998043941afddea913b220df6f8e
SHA512d3261e3251b09584d0cfb3e3ef7f7e800d33fe1370e8a58f7af09e075a7e5592e32dc058c272b5b7eefdcff93f6dc2c970968101ef421d2840a0a9153475d722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5521f42c88f3f865869bd7cfe82773d7b
SHA1f0b3c1b19125d0eb28e806e84e7ed93121591cb9
SHA2562ef61c0350eb86ed2f85e1452ffdde6109a93e3a5c4c9c50c4f1b2dc89e7d04c
SHA512531d6d775a4f78e793470e337530aa1c9ba62525ada2c2a08500b881e96339985e6f427656cbf09807b575202abe1235aa5d74845a5958f03a0db75b636ededb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a10100d9feb76bb835ad53e6b50faa6
SHA104c1347d1b29c13ae2f6db451db8ad7049e7384c
SHA25626a1943aa64258045b8ff34d9d844e61be4854f14cb2bd47ef17fcd5cd64852a
SHA512c0c814cb9a60bcbd6976d2862792e138aa4c9d78ec2c1b103ed70152e670957a6cb127ea4045c5ec45b55f70aed952bf54625c86e7e79c615da6af99b03f16a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea55571d3f423c8b0a0f5d9a24be688b
SHA1e379f5d1d4c957cb97c984d3ba1405350c8be628
SHA25629fd1df04b9181ea5e660fe7140230e607e6c11c842180db573cf8ac4c45e225
SHA512b81a739d2cb96294eeaf582cc44079dcb616b3021cfc8e96a831530ff9de2ae68f6bb81ba75c7a67ea59fcc4934c19aee3ad7aa37479f22b636c0456c65a86f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519b7dc289ffe518bd0b06adafdd673b2
SHA1962003f8e0c1d88c1cbe325e8a6558dee348fd22
SHA256f1efc29917515bbc197bc9d2822fbc9d6688294099da3b82f91bf494b557a297
SHA512d99b9f8c92239c53dd6b5ac70ad4204c341661d29633ded3f4337023df4562a4a61d771a6a7c5fe62e12f9d698a08a2622f93e59205ebf2fa51ce4dc108f6f80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5163bc9c19fb239d36e8fc017786ae797
SHA101ddf488f3b8d7a89ae338bb9b859a693da798b1
SHA25642cfd4e76b0b7a1d177935ee6420b24498d50bf4012a67cb64efd35ad971e8d0
SHA512e1f31e2eca6ca97927f1045e7ec18b28984cd3e5e94bf074f62b3cd782617321ed6a2c7ea9bf4111776e6c78b7e533c48c2b7e654e8ffcd4516f7ca1476beb57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd4d1400214d491c0f2349b4904c79f4
SHA13e9f947965774d2b59b2a4083a1506c980669b7b
SHA256fda8ca0a7fa24c3f53466eb1f18176f4cd96697f25030a42d9b056953d39118e
SHA51296e1d3145dc8be25c8762fa0c0165417a40770658b0fb8d421fac38290709db9b18603eeac09295989e882067561f746e38e30a76a9aef8f05a803b5a44c1072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58aa2b533e4ca4f963a0b708498e67ef1
SHA1b3e958464fe555eaac3e6a83df224e0a2f41b449
SHA25667bdebd4b03347002fd53071ad341b350e87931d3f6af4a13cc63784972e8df6
SHA512d1635d7db0ca6383274b358e89abdf78fe10e0359acecdc95216751a4f6b0b26133ef0c4f2ae4bd3af1cbc74ac42289db062b1b68a6f9ede77ec4f75f04113d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505386c0b01cfa1b4ea3263c2eac0b4e7
SHA1f0d0d739101bf25e720ced2aebae2cd725fdab4d
SHA256cce087abf6666524a20755e53d943bbef1a883e4e33332867f37db5e389b1138
SHA5129ed95eb41ad30e48e9dc400e6448584d8b2e989cf017ed395d154b766a70e976ee00903fe6cf58a900bf625ad3f7b12f69c9cdc3f16ded8312bafe0c76f53be4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a16199a9fbba980581fb4ef30d05ee65
SHA14a7f1e8b76721dd76e98e4726e6684079f6024ef
SHA256c5caa6edf9254c52ad2d4b7278e2a854a01c67042dac369ca43423968537a6d3
SHA512afb7be48df1fa75b8e22cf7979cf978d5355c687f40f77387bb2e59f44148d3fef6e1cb270302e6f0a1c2a9e24fb278ebc0b270a0edd8ce4bd22f2c26dffa981
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545149702ff77a16bcbb4caffad8c92c2
SHA16b4b9bf1e870ba4f590c7496ef271359e586a647
SHA256ce7b1901c995d51fe1072625f6b7fd73bca75db61cdaa96147e1ea2fa119c8a9
SHA5124304b4eaf8213e7b90d8826edfd7b63ae2cb503218b969269e01414a2910bce441c84dcd1633088d73f569e0189556351a710e94106cce378f2cab2c9b5fa5f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e78994bca20df7761374a6bc517b9283
SHA17b94d9c563b0c9230cb814e7ece55fa568a9fb9b
SHA2568923123fdc3c045811e0e34e497b3b57ad563fb069e8ee0e5ab4d88714bb19dd
SHA51244f9ae2d79f2ea644c93520ac2d450d97cd68211ec60ab7f6a5995c6f0cabf793d029cb6aa9b2adfc41824f85d4c6046db9a1b1dd25090c6065ac0e851675b6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58179788a04c39d0731adff1dfbd82585
SHA1e28cf4610cc401a386de3ed92b831965e7c42cf6
SHA2566aee4c9530583c7f03ad1fd9de62a28647ef6225bc136921e71e3ce3ab6fbac1
SHA5126c280726d3dfbcf16b02f981e5c4fd328228779b7f5b7fb3179ba195d32b66566c4809d2551352e1589a264ef292b07ca87fd4932bd349103bee9fe7c681a64b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ca0de6a1bb66a90aa287b120f676859
SHA145b1dde0753fc242bd3f54b56faff81e7c4048e9
SHA256ddab0bc4d0d82d21358a1ea3230600fe1806ecc2fbda4704c78bc8b6f17fe76b
SHA5120dafda0520d416ef7d34ab7f664ca259773b7a0eeb45a3f67142d0eaca78423763c5d98857c25ab2017d3db6e47c182c470e3160e444a828b6eddac66bc56a66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524fb5e115072fa47101157ec23e9fcb3
SHA1ee75364214a6b89748a32cb0e0db4c2592c3d848
SHA25663eade8281a9fbf83c22e60ad613e33d397f2cb2f403f7d400ca5d8ea63a0406
SHA5125b764ed02b7d67b437cfc699888c8bb4ebf811c29141c462dc7df31dfd19bdf13b8b3574ec21473a3625406692bd44f6851ededddcede2248b48433d369e9d0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ad1b8d6ec65e41cb28a3683237c7425
SHA13942b203705775aaa243a64607212652d478fbc0
SHA256b63b531ef61625b1c9903e5a60a4e5d657b0a2f07d77e5018857dc9569b2fef2
SHA512ce9059654268522cf8f955398e4de9f022b1aac4a99a29e12c86b3fdb05adf020f09a91d398cf5166ab480e391dc755b1dd23d4c068951af37173443529fd38e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5123b23f526a0f472618cf67e8d91a86c
SHA19298ca0cfcfd07e06146a8a7a2979cb55573c3b0
SHA256238aba74bf73bd2f328fb1073fd4a5d4d3665719306fa3bfde314b11292908e6
SHA512fa6f4f47bc7aae6552b2ee7c4fc4a65f80207e3a69625b9020548e87678bcbe3134074dd9a0fc50d5608094bced8a297cf9364ab20026b3a617e7a627e321ec3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a155b7d664f83b572cd05f073bf95f0
SHA13dfbd0b0737d404960ed91b5ae35297bdd79785b
SHA25653c87b1c4c2f76b2001dc4eec30835c36eec81e5a2674bacdf43d5abf09beac3
SHA5126a4dcd6bc320c846bd952671d26b5546b4a77960ded0a2c97fbbf70a896ba89b40c2db78676f427303c78d437fbc36ea7e1bd41c32db47eff5c1ea0ce5c86e7e
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b