Analysis
-
max time kernel
136s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 14:08
Static task
static1
Behavioral task
behavioral1
Sample
3fd8ebecd09fe4e454207241e9c0e9d6_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3fd8ebecd09fe4e454207241e9c0e9d6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3fd8ebecd09fe4e454207241e9c0e9d6_JaffaCakes118.html
-
Size
72KB
-
MD5
3fd8ebecd09fe4e454207241e9c0e9d6
-
SHA1
0b0aeeab58ddcfc0aa0876534c5cdf59b1c185af
-
SHA256
8d48b8d5d1db4750dd339aac001fed627998695b6c18ca7fbb574caf1b7787da
-
SHA512
f479b1b22e083d3cae3d70dae4f002a090fb69b7c927f5c95086829035d2d1b17577266cdf449ea2e47105f3ead1d54efc40fa2289c7efec9e294b7e7da9d89d
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6sKY6eyL//XlloTyS1wCZkoTyMdtbBnfBgN8/lboi2hcc:J32UOiTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f076ab1d3fa5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000090cdfc8ff1c1253b955ca10b935f9d315c07ab5f8d07002dd90fbadca376a332000000000e8000000002000020000000125fefe7fcbfd4fa8cf7d66d5a9e94b16b1a66496a615e1cdfab5afada57b1f220000000d29b86863327caae0cecbe9bc1458a17de2745847fab2500605697a7a0a11e784000000033850f46d7ee684b2fd9d787bf8120540cf852a3550858fd5d81af87f81ab3d9186b92daa1eb67d49a2c6068995422b2d741870f8c58590c904454710eacecd0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421771181" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49062841-1132-11EF-88D8-5E50367223A7} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000fb579f5368916857f204d0fe28c3584ee7f231cf60adbf7a417db9e5a3db80ba000000000e80000000020000200000000658d27a6ebe44385a696736733a0770eaf8ab0ebec6a26f44c53d7eb02153549000000057d15dfd9e0bd0a6adac8b908a14716325ec684209b5001f89067b13dcf71a06fe7c606e1ce527109ceaaf8323f7068827506d912c0a987bc99540223d032d427c2d36ad0f0f519f234b53dd17cc615c934a761a2d0c96ee0548ed1ddc7909204d47c01a0fefac9ce04043ddb2c0cd37f4b66289973ab7cbb80b2a44041d14d8b453e2e95212d9c472ff12d4b4723893400000007a6bf477205d0b6cc49b31af5b3207a55036c32daae7df59657c58d23bad21695f988c057fc7e120d654c2bb90c6cf479219966c57b6dcd44eafbab01f435602 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2396 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2396 iexplore.exe 2396 iexplore.exe 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2320 2396 iexplore.exe 28 PID 2396 wrote to memory of 2320 2396 iexplore.exe 28 PID 2396 wrote to memory of 2320 2396 iexplore.exe 28 PID 2396 wrote to memory of 2320 2396 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3fd8ebecd09fe4e454207241e9c0e9d6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d619a24aab1a596cdfbb8fa38362714
SHA1a036e5de5396836242b1f1e5056f78af82d8f058
SHA2566915bbde2b6e3808b2585d18eac9eca77a725e57a5e3d1630f17c3131af37bd9
SHA512765665cccfbc471a997344b7db7bb04efb2d249fbe8c45cf1edf0a3207eead82dd698ab2d7571384bfb08a2da49c4fa6edad9ead0e1b7075805070037f80bd83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d24d99326ac5754153104831f4b09675
SHA1139dd4e4acd4ec174f11dc689d5fa5c841ff9a6e
SHA25632cc4d22b5a7fc9d80a4d7b2d715650e3f0554462d6e294d21b855c0d064d3d2
SHA512fc43e007cb96ce234fe59cdbf81ce883760cb3ae692fac30cd2f643e7a1f4c0265b44f8b2413b5918db61e49c64e0a52237cb90cc6caa7e0e4df8a5e9b554613
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ddb7d6a9886c1ca7021027d0fd9cf53
SHA126f9b287e8e7b917aee50082e1421a7d340c9652
SHA256f37520bacfabc6b6e49c7a94a4baf3b5b34a9a00e47b08175d6b98127837441d
SHA51225d1bb2f80dc3afca1528b9dc4fb5e10e42d36333d6c1dada929fc43963690f726fd1b8537b76a83e5d31cfdfbfe97b1c50b7d9a7e5e7888d1b0304d697a4e1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb07c3e1d30cc69f3473a6c9e9b7082e
SHA1ff138131334e5d45fc80676640be8da14c46dd3b
SHA256b8bdac024bfb9d93f7eea9de04befacdc3d181f780694d1360da6f0063db9be8
SHA512854e397890fc0aa90f2cb93bb0298f16fda976bbd2d0a9f766bd2e2137ce16960a1267ba59063f58a542ba53cf6555fbf6d6b73f5de385b7575aff1938f66dc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c208cc601b65e7de5371a900e372f6f3
SHA147ff0e260a83bff1f58712cffc80db51c1517fb3
SHA25615888e634538637ace40ebbbfdbb8c1e94f331123d7ac6eda3b5a414448782a2
SHA512a3ca66e1a784bd84b84649d474f0bedbbacab2b34d27594055b064c2692adf17150442440b8a553ea799f90b46d33a942b733133c8f271bae904cfc325530c0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1f73de57ddd9b9910d66345f4549790
SHA10972870fb4fc11d164ab7db8ee64a814d2e46db0
SHA2569555b665e94cbf1d712f28608cfb6bdef5c8f8f6ae6753cadea70b46ebdafb9d
SHA512e520762241aca7274c916eae0b8c074680cb1c64ca2d32e245c9c054ac2600da10e0e62ebf7f080896c9b934bfdb859e828386320fa46bbca2180cee602016c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5167dd8a2c15ae70db7b4320d23b3fa30
SHA1fe5011ce2d652ec9c0110df84853fe273ca5b0ff
SHA25691da4f2ca3c5004f13457dcaaad237951695bd96c795fd85e2466d5e7483077d
SHA51248bfe28a286511c9498696c96b18fa7c0e3c3d98a205b83f9fe56f637170ad9de50ddef26362cd17428a343f018aaec394252068d3b69fbe5c59a3d98eb3120e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f92d930ba64036def124b1826e41369
SHA19707c3d578e664fd7a4fc38b6f973f1fa0a7bca5
SHA25657cb4357e083a3dcaed47ff44155f32001c6d8821c604505f2968858b986a090
SHA51261188fcfa65e2574c58984dbdf07bd1532f905566c4ff0d9bfa7488db9cc926fb5e4482a6fc933b1e4f0272353a32093ceb07188405921ae9699fed2a55f1ed2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5176731220b8dcef04bbb3713adcccd
SHA1626ccb5c7110f39fab8ad83c8d5bdd6bdccc90b6
SHA256a565fc0393f1e3034ce5d9dca6e56914084193c6db13869deb20b9df41ad8fdc
SHA51240a39b93031d8d5e80098cf5ec412c3d20b61c3c8f5d6446c1673bf5adc7ad28545cfd9f6b2dcbf4f26a17f9ce1e2760c942144691f136071ca260bbc803a802
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0ad9a3c022cac117d46ae9048006b7e
SHA164ff8ed17aeba20318cdf67c9ccd9d7894064c01
SHA256f0553a99f8b691bc4e86a40bf20c53b8d7df88f4624b1202438d35002e8adc9f
SHA512db2415525f3456575bf0f32a1de3ec47f1309966a01b836448ca3d58318a1b6178bb8416751b14bcdb3841882dffd747ad601de1aafcc3f83944ef103ab81729
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd58101063899e3da526d9d80b965486
SHA1f5986c72f80269abfcd2e0267ceacbef7ccdb9dd
SHA256c79217b8a0fbd94c02f446ad022f9af79df93c8372bab293319aa9bad6d7ed0e
SHA5124c5eda3363415255723b946b103f892a44af61ff50e5eb16b6a322d60b4e6fa0d6ddd7f7af57f88d67f9579bdc3c229231387b7377637d8b053e6b2aed9feb29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a20bef2284db5175dfbabf1f58e49597
SHA1000dc48c2e525f2d6a3ac81216a1987ae8aa1d3e
SHA256468e9a5cf26c6fc7f7be03fb990955dbaf53b242f1fb2aa8d2f3219631ab0704
SHA5121f499c6e1f138667f46ae58e7bb11bb2b65030752794740b09277243cb5174e02494bda8c15ef51310043c5365fa7cff55b4e12986844f6149ddd2f387c5bf8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5877a10d081ecf22b7e767e80daffcbda
SHA1f7b7da11b95a96f07b1822f1928564e6396dbc44
SHA25678581fab7203fba33dd59c86a767f3e0a86096bae3cf7c3b2607887950c6f2e6
SHA5125a07ae154eb94387b4d59929f38f35546bc7c49bc8cba7a27f787cd0674de553b0a13e9ef7625c28183ce7e43dbc0b701b8caae57249e59f5b978bff64eec28a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b0894968e05853735d9d24e268a2879
SHA1a8e5cced3129426a4b8a2081117298c2ddec888a
SHA2568e7a6503afa25b6b5086a94204b83a3e9aaff40eb5e8291ef0b8ae3bd2e34c8a
SHA512aab3e8ed55c65af92b50f96cd1b393ce434232b8bbd674eb98ecea688f432a0040633f1558e167bc62ed345ed8cc8256c47846bfc291e7a6567dee462a0bd9d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589f1c826221c792bd798b1aa3eec2ea2
SHA14c77fd939067c74a673639269b9f4da608936092
SHA2563aff610c41be37a5316aa144aeae709b56d4c4d4ec6081a543a7117f5959dc8a
SHA5122fe936b8e1575d17e4e16a780764eabee517b642fb8b60b0560620e1bebdfc2ec7e407bb9255716373a5cd270467120bc3d1f51b1867110b5ec8d82786a53a56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561eeff15364321b0ec78587d9b238a11
SHA15fe5a2e7c1787d842956d0d127ff32b9538fcee3
SHA256c44193fb9a44344252acd008ca14752371a2f142cfcb5464dc44279155c3a049
SHA51294bf0b0c2e8bd69ec59b9f725fdfb03f829d36c64d10a364af26413a147073624c8a5f412aa2b32820681c6337590a6fc806867c638316d3db4ed49c035c5f7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e60185a8890668fa05b2fb93b561889b
SHA14851eed804cd6cac301a8cf9d6f34c3cc9fe550b
SHA256791e088ee08dca464d48325d911fd8c805e4c9dd12cf1229a7b5af12a450bb08
SHA512319cc0f71d7378644b266b099f9a131af622961c2d76d4610fa0df1e75cdd792ba3141edc6720bed44c72549cc559a1e27317dcfcb7e183c247c89c92e0d2d30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5247918f09007dbf46d436f80cef779e3
SHA1544d53ca5511321f8b9e1eee41f3f4f83fbc6705
SHA25663b32c3c3fc02ac4ed0128dd1a11a5ec98808dccba48415e1b8a321f35018cce
SHA512705ace5092e3570dc916b288f7e683aef2daf92b459b0636b2e0a3297a723bf8ee7e479325b44a957feecbfa5ec58c1a82fe7f7c18903884fb1921f0250814b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4b61e18a4df80d26bf5634d70104e9d
SHA104dbf4ed9e5216a22e64e5260a56548a0330ba5d
SHA256b85c436695742eeb3ad4123498ffd7da9a88aa46366184cfa5c06a11ea64578d
SHA5129b39fbb9802f4ce6e41cb4cf1f5bba3a12ccb46aff650f21b8cda4934db9477be2cb42f98ac6d5e19007b07dfe96b501df8476badcf939460db36c5fad0cbaad
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a