Analysis
-
max time kernel
119s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 15:22
Static task
static1
Behavioral task
behavioral1
Sample
0c23f0cf9b56dbbd5f75f9871d8426db_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0c23f0cf9b56dbbd5f75f9871d8426db_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0c23f0cf9b56dbbd5f75f9871d8426db_JaffaCakes118.html
-
Size
460KB
-
MD5
0c23f0cf9b56dbbd5f75f9871d8426db
-
SHA1
203d1887d068828805a81e739377cbe6cc3b09b1
-
SHA256
9128a6cbd3e0fc88a6516c220e0448efb8996c6afdaaac97b051e4090c31a75a
-
SHA512
a1aea4e2586452288a6b84e71a594c24d9e69964823fd8a3bc7d37a64c1900bf63a61aad3aa78f243dfa47d66283388b0d14e130d3000d59819dbfa044efabf3
-
SSDEEP
6144:SjsMYod+X3oI+YSCQvQMsMYod+X3oI+YesMYod+X3oI+YLsMYod+X3oI+YQ:I5d+X3a5d+X3e5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000003d2f15bf34dd175571d41d9d28af0cc3ea82e395aec4351baeff46ee50dad9a9000000000e8000000002000020000000ef21eff93ff0ec6cfab4af74d4244421dd906a30f6e66fc11af243bbfd7c47a2200000003799f965d3c21f7df6499afc620ab3420286805a5b32ffb4eb6cf39bf5f4b82b400000003c75b199c275547531418093ed14d25e0b9a060e33fdbc6d6bc017f383563f8e436e59f58b1eef7fd76be8d928b317a9b47d67f92365a6d32781c14d7c640ff6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004d4bb47f19159109b981e9470c6a4602d528b474d9a8b90b113ca75385cf5e65000000000e80000000020000200000003a460b44ced1b5800e3b8e60fcc404b75a238bdcefe02d9933f2ec0619c6407890000000330c58c5c2d3a0cc22f2e71876e4786ee638a0cc441d69537535c11d45d9756f0e221ac48e4a8446e25414f8e81c7cd38fda7d9ba6b1444d9e37e621ea7b2b212f20e3377598c2e44807608d96312ac9facb2ad966ead464ada83818bcf0de9785e7e005f1867e2b214cc5e0d24421986d9429f5e1404d150a58677226cb5edbf2abf689ae7c439751c3cbd83ab73c4b40000000e60ec5d31cce88c96a1c38fef36b85e85b0717508aa382c2cf1d0499e4a95760feda202380ea9bf85a12492ba397ff570f445669febcd1080af3e97fbc92df48 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420738830" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7535B11-07CE-11EF-A0CE-F6A29408B575} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a061df7fdb9bda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1320 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1320 iexplore.exe 1320 iexplore.exe 2824 IEXPLORE.EXE 2824 IEXPLORE.EXE 2824 IEXPLORE.EXE 2824 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1320 wrote to memory of 2824 1320 iexplore.exe 28 PID 1320 wrote to memory of 2824 1320 iexplore.exe 28 PID 1320 wrote to memory of 2824 1320 iexplore.exe 28 PID 1320 wrote to memory of 2824 1320 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c23f0cf9b56dbbd5f75f9871d8426db_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1320 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ef956e203491a78ee247aa0936c0107
SHA17d03dbc55902a052d7f49bf8474c7b23533aaeed
SHA2560dd17acbf3c9f07f7541d9acf7cc344013b0507607f9860621e6806aeb59facb
SHA512290a7ce3607617daca045ec02b5fa610bd126da987babd22cf98aa12661ef0a596b454565765b76f81ac8221c9dab95eb50549cdf18d1e23361a3f0b3a1ecb44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5990c3a7a6cc078568d409268b1268545
SHA1c2d8f4cdc196cc35449b914dc6470748b84ddaed
SHA25658fd23b6fd917a5c9e775b34a6e90220f6601ae7bc471bc7c83c1e786af6352e
SHA5125aa619a43d58cfc3b2cceed95b0e667c7de92b40adde7ba0794c10f1e504c2eab983fb3207557691158dd456bd3ded3ab9c15f749f8da4022f407347f1d9598a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6afb17891faacf988898bc8e28ebb0e
SHA1cd75d6a7bd565b4644799e6ae6779d542239bab8
SHA25650e03c24fa7de86d96abf2c7045b9a692fd50ea8d5e3052c8f2e4722d8dbc412
SHA5127d626e3ec8385883449d62532a328591a112cac5e1593f40935ebaa06a8542fb94972f512c22c466d0256c9e49142dbc15676f7f484c0a52fcdf0eb5b7bae01e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f0b2519bb4a1a7aa0129ca163e70dc0
SHA112c59eb22dc28a3218180f137da41198793e6ce9
SHA256d6817f3ef46a0b3ab9fc4d3cefe459157f34a8697fbe09a796a3118ae774b1c5
SHA5123601f6bc147ad6c6447439d288e87bc4214c14a7dde461a225aeee5af57160ec90e07f0cb51184880403a7861a1c50da0c75b0488f6c6fdeebeb07f06f286771
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51981e93aae83ec9680bfdaaf8b372cdb
SHA1ff5918899618dc6305b60b6198c696658e56f0bf
SHA256697c74a2cfc4833c56512b9c2624509bf8ab806055388a58c65fc66a71f2f164
SHA512ab2ef84b2e6cf00ed426cca25d289eebf642b2d4d8f68a1664b1976e2ea0852f3361f0e29f9d8d8a933d4b0adf5a1531d1516beb19322ca55e50dcc579dc316b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5880ea9b2805228cbac9ec722767c3f7e
SHA1ed2ed6f6c9cfb43d2fbef24815b7aa1422616963
SHA2569b886b3766e2e014047d56e712d155ed82ab00462231a35e11f396a28fe55a56
SHA5126db8917dea8259532a32aef6193a6f64b4c4c45c0ad987d6845af04d8785aa0a9180274852278c3e6e8fcf370ec717ef5acc5bd8291e65b109b46d46c0740719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff9ed262206e44516c45521e0bb535c8
SHA1c3fa776eaf37ba5f26392e893626ebecbabf090c
SHA25623e709d0c6f6d0e3a152380ebb7de948e2f13b8fbcc6bde894a3f3a8cd8c3d01
SHA512001a8dd56c7c25540e57a27cffb9e29478baf96f2a19d0d9afec954fc7fea0f7445077599bd5a2470cad00ad8c41772e869d4d12df716b0d69654acabaf6bd4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9d0a41c4a1dc004685e91907ede39aa
SHA1d3069af9fd9798f06dc0ab88afb5e6c7583c8c11
SHA2561d7f37cc7d2c02982325c74e85a7ea9cf3a6dcd4ddf772aa7e788a643807abec
SHA5123f85cf3fe8a824b571074b2df81a1f6fa1d19cada988ee98ca97e8d6813da51d51083005ce9243b28c2d949c80c625f31b83fb9e7408dbd30582517ee40c745a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56314292a605afa5fe4593618c0d36183
SHA16bb66f27665d77651b7ae77c68938c928f524db0
SHA2561208370fa28a4845c982b550d32bc0ea60d434e76e34572162c87150d3b43ae8
SHA512229a5f4885b56af35f1660ceafa3d115600b37fd2a15541ae8ce071405bed67f74a8fc517a71fa8f317281c1bc6c23abb7fdefe2f58a065d22129c607b73b3e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ac7f2c587ebfec70a090124927a1d6d
SHA146450404b3ba144177492b913579885b4077dc93
SHA256a05a82195ff2ddfc75092295dc108a02491dabafe4d53f41ff34f815fc95bb2a
SHA512bbb1b745231178e426cfaa7de69f409287e83c280de1f55a35f68c30ea67e74adf997707f62c0265f9ec8471d0a7bfe3aa3fba2db1b3585453031b86fc768598
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d671ea67e66526459637c8bd6149256
SHA1a324f3b9582a4c8fbf5ef8e83b3b35adc4dbe8f0
SHA2566053e3bdb006fedbb9cc7adcf9bfd6e3b9190bd6bda09f03475c3576d070faad
SHA51239397ce75f1412218e7a5d5d7ffa99646b096ead187f65972c964e7e9041fe47bac3df94942ddc6ba8a5140a789dd7091e19ebae195cb2b3dccb39ae43e88979
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515abd8cb75707117e1bbb9cdcd44c206
SHA1513e80aeed9e262d4ca945acfc95f5fe2981c3a0
SHA25624f51a8e1b4cbf72da50c02bc01c66b8cf228ee90fade9b0b3f25baa28282090
SHA512e46b3ca1f8fb5a34de8a193aee2563d5f429706705eb8841a85dd1674d8afa887f29639eab6f96d9028de631f7b41a07d5cdab4fd62435f7fd9e1f62415f95d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576a545f0fae78613932b13d3dda82631
SHA1b424cce544d6dab786c2afb6f63462b7261a17da
SHA2563a9a7b2941188aeaf36710d1b0edf3a12099d2587d96de31155f1289ba7f66d9
SHA512c09982c31dfdf452ac0f528464c6c58520b901978424a866f21f6d534f9a709f14dd841e226c4a7eae295133f6796675c00696410726ad4a9bd0b4f4d4bc4e36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd7af11afcf3fc76a606cb8b1c715545
SHA16a827f3287cfa0e92e21d8399c509f8511b0ecbf
SHA256193a1a37a1c716767ace6625b5995b7f4648f9f0fe1348c76d91737e8d0a75be
SHA5129fe0bc3e64f303fdf2abf655226f5271fa72e4a2dc6e4b82aea390942656256d1f0db2268d5611fec5dcd6ab3498f2b15e6c9e532814b468a78de3fee67f61d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50572b62edaf5627c3c24a39d62ceabe6
SHA15fc7f7d600bf2b217146f258c54c8f8af95221be
SHA256ad740231eee67b83999fde6921b6f1a423065e07288a62ea10ba3057664f27c5
SHA512cdeed84283eab68888a30e8b7bc4a5b2fb5300f30be2221f8f051caf356d1bbb8c21f4ee4f6b6e56cf8ff3521ffff1ae7e4bc9f11a8e86c98c6adfcac3f1bf89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59360e5204ac12cd28cb1a3847750f039
SHA1d894212a0292916961dd1cff194661509006fd2e
SHA25659813141b341c4af31693a49d4d3a1a1883a38ad34a626c6439652c650676bb5
SHA51222375f4a86fbc98f77c1bd7a487b35d1156424f4f5af7ee7d8b5824a0b2adbe5bad5be4af5b895a7803847bad46915acaaa35b28fb7606ea373ad1b50c63973c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531ec7994b2d3e0cc940be57f84216d34
SHA1d7f6bd0b611907aa80eede3211445e9c46aacbec
SHA256758af1b1a8f8fce5be4ef4cd7fa2926c144e1960b3e73c4050630c15b1d5deaa
SHA512043fe379d02b7925baebf4d4097839f7d1ff2928dc53469112364791fe7debe9c5971f7b7b5eeb281d9685eaa01bf989a9b7f9a0a42002f149dc959e2929ceb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5368034a58e9762738b6577a158cfa121
SHA1f89e98e18756c2445eae32cd285d1a4775dde5fb
SHA2567b742f322133d795ab121bbbf2177e4e889016ca197b05cf65f7d41491bb63c8
SHA5127fb8832b11de943444e210382231d3e17d7f6037d381b9e03c26ba72995cb4b6a208ebb91a237c8120330de37d976b4edb24ccf0b258758d6e8f9370a57d0000
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a68c210089a29b7fec363f7a035790b3
SHA13b37669a9b3e3688cd631db62ccf8feb0d788c2c
SHA256ea86442099658485f6da168b65a5df890d3c30b06b4b8bf9b444a260af264e38
SHA5122ac1ea1f4d66e1656bffa886cabcfa4ce4e0a8371d0af3a184360ca4861648095422cf4d8fe7180b2449a968647175b1634ecbba71a267c99b2f1546ba6b7068
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a