Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
30e3eaa95de94100f1fbe0e027670fc8_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
30e3eaa95de94100f1fbe0e027670fc8_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
30e3eaa95de94100f1fbe0e027670fc8_JaffaCakes118.html
-
Size
461KB
-
MD5
30e3eaa95de94100f1fbe0e027670fc8
-
SHA1
b903c1d4e2bb09444b691a86bdd83f81707620c3
-
SHA256
6d61170ebca6f58685db29fbd2b6c5aba0ee7029d764a15fbc3c9be7d0daf7c6
-
SHA512
f799d63193502bce8c65d6ed46717cc03fffac5b000cd91e87965588f69e88ef57cac03db1995112d63569b5a1e1d525e85151df584dc2f218c0fe4ce3bd58f8
-
SSDEEP
6144:SbsMYod+X3oI+YtsMYod+X3oI+YSsMYod+X3oI+YLsMYod+X3oI+YQ:i5d+X3H5d+X3K5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c644a4c43a410b4a21723cef7d93588139ec47dd3c420c260a4cd9b87a595de4000000000e8000000002000020000000b2cd931be8d09f97236f82775ac3591ffab3193f62f097a453ed457565fecf91900000001a1bc76a964e4e4da79ab9160fc07096830accff20d5fea6e629c4306ea82489fd70358e5d0784827227e30e3c49f8d225cc1f91c2894eddbe9857a019493993c0e52a1ba4e250a2a7e87e6e88b212bc72292c779d9cd244c06e9b15a82f3223970751c12270978c43fffe0c7507ddc6b8ab99827b0ffd9efee82434dac42ed7783ee3c7fcf4a10ee125e993fda328e840000000492cb4b335adc9d15d4d7b52931cfdbe3d1edcfed938edc246e3d0eea5153ca98a9bccc4cd34c6480ce3266ccbfcd14c1dccf311e785728b58fca1ae28899fb8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C4960B1-0F0B-11EF-965F-FA9381F5F0AB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2078da0418a3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000002ba7201442765ef530fac98424c7967666b0d414b1c179acfe9b09a83661c2e6000000000e8000000002000020000000d9f09764e702ab53582cfd4e543bef6a2682874ca5c2c20b18c6a009dc90edd520000000d5e80498d56ccfe52e00c7d05664096052fd049097bde7523c66a6ead45f595d400000003004be357a7ca6a51ddadf619b702daa37536ed14f419363ac86bf35848b67021d87ae39d46ae63851d04ad147205c645aba20223a549a5671518faabfe332fa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421534480" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1736 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1736 iexplore.exe 1736 iexplore.exe 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2112 1736 iexplore.exe 28 PID 1736 wrote to memory of 2112 1736 iexplore.exe 28 PID 1736 wrote to memory of 2112 1736 iexplore.exe 28 PID 1736 wrote to memory of 2112 1736 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30e3eaa95de94100f1fbe0e027670fc8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb494f4a5c8ce305d88ee98541fdd0a4
SHA11e97eeafc5527ef08f105d2f8e1ab19e37cf8a35
SHA256b7d90700766c308d31b59a89944fe8e900356128d1c59e94d5cc1c67270eff4a
SHA5124e52481ea96e2baea601477d9da6927727a66f8c82fdab7fb553095d6afb580dd25d606de452a81d0a3eba86e95f88b533abec277c0a6995fd00f9bea5ba3d52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5feed632d2dca2a4940026cf3198d6b06
SHA1d53f5b2e2fdd1d46779b1d1b9158b536db907b97
SHA256929570036316596edd72cb792724d2ce72c7fa3032ca3d5d6a1cdfa5be45a4f5
SHA512e1071de26e55e891e0f2c266222e43534ec8b67d3abb1f50ecfef9f777f9f63850680b0f10d21ef67a356d6c8b6746308cca2fda096b013339320ebb1600b857
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57449568466e89da9f8a975ef81fc7d1e
SHA1c9b5f334e1234dffcb7b1aafca003c748e603d8c
SHA256f188ed7e9fe7e4e972aba0880bd5b1968e2406e97166a77e47650f997cb9c219
SHA512df856458e7ed07c3e9e090b8135b3cffb32e55cd016b6c723bc952e400bfdc59bebde41d2e24f247f7d36a14068fb0fec2d9d0c48475de63d9cfbd0249bbc65f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55de6cb59b6cb9bb7d8ba43efb47fc2ee
SHA19ef5b74044c5a9e8574d53c8b8b6249c822f7822
SHA25686ef02c4f5f6e2bf455f75f334f824323a8d19d68e11d36be0140aa65d15df0c
SHA512c195b68d2cf16a53b9ea797723ebf4b68a216533dabe8ea28d46d456c385052079aef951d2c2162388378ecb2fac07fbcc1967e579e5169a5e69abd168e09708
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb6b2e42b6e604224be3377a35523f65
SHA100d728c8fbae1b4b9583d8fff6c2953612a16305
SHA2569d6ab0222d11a4210bd21a8f6d8e69b7923ca6b9711d40ba2cab3c01addbd435
SHA512d23397d2e2c11e286a36d6374fd36c871b8e4100c5df56771bc8feb8668a23d85079fcbc40f91785db2fd0a17757cd22edb868b9c1eb747b2dd82f800b859950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c94a26de69591dc9f4e75c4f5f5d66ec
SHA1bdd493c8f0cf2e2523ddd478dba4e3c64d07958a
SHA256b1894aa498871717538da0f2233a473e88d3446192584c6738e5a6cf9c303120
SHA5127b1859884c3d7e8cb5d585fac0f37af09b87758c52d1cf67657f76bb8fa1d0d684878a2dacb78bc5def4b5083fb235862aa1baa3c5cb6346f365b99bea74247d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5a4b138ee1cb92c673322e5aa34000d
SHA1adb6f1bd300292b42612f32c1c3750432565f17e
SHA25689fa639c4ac90b833253c49104a0835af46f01d2602bf4006e95576c6004a878
SHA512c20af17c2004b551a255e8924540368fd95b0a0d6153927a4db87ad531abb83ab08362a072d0d837f1d2eb1cbdb553460cbcc88886983963c1fedf6532c0cd99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515e8d543b7b9deb872c9d296d91689ab
SHA1a36664bd971b300dfc39d159f4fe1ad4ccd70434
SHA256fdf3c80443669967bf87e6180a26fb7deeb6fba7e0e462b69e3b10915446ada0
SHA512281a18897125b0e6de38b4f33b22332befd0409cbcd3114fbd4808cff572d57b02ae7f0b0e167ea4fa74825718a5bc71198377149124ca4ae81c29a8ef7d4773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5978eca9adb64cc380bcbc9dac2924f77
SHA17238f1e2574542dcef267a5363d19d840143153e
SHA25665166725e1c8ea5c0cee3e55cf16bd123e7b10959fb7e18270f93350fc5f51c2
SHA512368fcc7aaa4fc42f7b85dc4cf42499d718db0e562b09d991bb754f7cc969b2b82b14d2275d07392b59162d5dc2c32bc0d4b61dc969a841a26491502bbffe1e97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e4644504a1d0d57b5bdbabbaf4b6791
SHA1e66640e7168335b5a91b8c8071e76a7fefa4febd
SHA256e540d69fbe22697eda1baa97b90a3d08d9afa5436fd050b7102c8914138b3924
SHA512135ebfe86a79738bcd0bcb99c3d3f017aae2e5d32fbf307e365d3849c88196ea905867cfbb11a89c0e46c17da9adf72d20680634e87f8ce6c3b7c6263e2c42a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5341f23750321cc79e3ee531de1d8a395
SHA14d9ea212c4d91d998f6a9d0b6be2f4a712cf88a5
SHA2569b7579a830121441cd7360d6a1a9fffd96bf6ac79a8d88452d825ef1f900aa3c
SHA5126866b9ce7839755bc0b3922229d715418348cfc90e78e6abb79f5da961e0bc0dc06a5fba86088377924b9c6dd8ec60fed0a7d6003cb03a6ffdf4fcf6efe9c46e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58509b838b4de565b06a0cd68c8424342
SHA1035a439ec732aa611855823ace2b98bf33a6c772
SHA256c3c708ed26f0802078bd0e59e15c401423047f1751beec2f5f6be5f16ba226c6
SHA5124842c27d7c02329434bd42085a0bca90b113120b806943a6a5bed9140fe75b297ba771355633b8ad6b8f3761285505ee1a76b83d535ded524fefd761efe49442
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6d78fb642f5015162fd424090374432
SHA10ec23118a30a65e07e2709ddad1a71845b71e8ac
SHA256d664c7b4874c308417adea19268fd4fc39b9415472a0526e49d488e2211a092e
SHA5128541f7e8c00de35b21af99edfb8d16e1c1e8f2bc8558c629937fda9d72865befc91d4e327f6a7c8d9b384835aa7173353702d95bc228bdea3e4d9956dcabfa33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5657a59b66be5d9a939574290caa4e494
SHA122702ca329f6d00bd1540359db2c4f94e19a705f
SHA25625ff971aa5b466a55998831a20521aff0c0b63c0de83d797b4b81098289bb82d
SHA512acecc54bff7af0ec8769fc1e2cfa96df8c7af53e25f4e694dcfc0354e168d5ffc296b3ce211fa3d10147f1d4b62effdb407fc481c8b6fc1c8ab87206f3f15719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579429a3325baf43591e42964a0a22ec7
SHA1db826defae1ef735633cd56fc772c573625abc06
SHA256872070b1a64dcf8366d02dc8c3dd89ccf43e576871eab32c17638bc1fcb6e74f
SHA5122aa5b0351d3d908cd45770c4c158938622e8f98291925b93509e452b77669798e796be99fabbe0dba1b5fc008677c7309a0b6b6238becd33b8c5bde4125fff57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0f259bb4c39c4890f8a704323613ad7
SHA1a01745c6148d298d151536565dd72769cd9a0496
SHA256f4da4330e09af443081ede15f7f160390dfd90ecec15b3c413ab6c925c0116a2
SHA512da6583b5564edde606870299f1272bce1ab18e729c61940dfffb25184a609b9d8d33fb81154ecab8815a8fd11e730cb92a56647b8d43b4282a9f005448166a57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c555163d75ebb7ce6363e5fbc94283e1
SHA1e2aace35d40647fb7041058bfe1a25e2583a2f08
SHA2565685852ab4e4eb74faab96bb370dc8a19fa29f6c90e890746c12cb415cde0c23
SHA512b359422dc225e879c0914ddb89b0a5521a44c7f68d2643f6c5de8d1ab5197b4809546df52e2da05570465a8691b443ea63a5b3b3fa04e8a829ff06637456cfa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc0bf745316e81fc0a2ba423ec353576
SHA1c96b8dac935020fc87bcc25ded24242d56e8c323
SHA2566239c7a945ff4901bf8331e21aaaf266c0bf880ba4a47b40b3e4257c1ecbfb65
SHA512ab9834e18790dc4c71983986aa61c016bddfdb0dd1aa36d0e98ad3a9cee8329a24b34c5c865adec7f8c110489af6995e7bf41a8211bde358891d9274bdab0773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e79671895d8daa2326577df14f81f5b
SHA1a6f4e092d2f2c1a283e9c3bd37c5116633fbd54c
SHA2560fadee08ad65bff186b25679bef1744beadc74fc71819a91d647acb020c2b1b3
SHA512151cfa866456bdb3cdcbd4b93c0d7c7e840ccc9f94de0974b7f5ae6d25b149910e656baa0e71308cc9453a54a7b47d642342f25a6e2a0452d9fb88b56fef9dc9
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a