Analysis
-
max time kernel
136s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 16:46
Static task
static1
Behavioral task
behavioral1
Sample
40719e4212b326e5c4904e27165ffa91_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
40719e4212b326e5c4904e27165ffa91_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
40719e4212b326e5c4904e27165ffa91_JaffaCakes118.html
-
Size
14KB
-
MD5
40719e4212b326e5c4904e27165ffa91
-
SHA1
2005227281bf1f9aba5897fe3e304e6c64851531
-
SHA256
f8dae3e068ce91526236b4acffcbf66d7152ea5f3a8a216aab67aa134884423c
-
SHA512
b2e6e03ad982ecb6769e0a19a72f18a809972b7618508a24adb5fea67a82a9c21c0c5e7a1aea57ca6a6bcd4fd05e764cb80f78725c43b994c18218efe01c9665
-
SSDEEP
384:ns9a0qYM0WFi3dfpgUcMosomXSPMjomXX9Nn0eru5/w:4COWcUSCP8Hv5r4/w
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5599FF81-1148-11EF-A18A-FED6C5E8D4AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421780651" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30ea226955a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000012227b8de6b290210f992ec603bb2f8c5dc2005ee374baa63423066f935ecb82000000000e80000000020000200000005ded21ffb0bd3aebceda82f18b581d7f1d5dc43c5e7a18700d7cddbce324885b200000008550a926e1bb7b357cb8b6b7cf50bbd60a47ce77e05dedc4e4f393721f87edbc40000000ad5fb1a126c09186107e09bbcbc42255071000ed246691f0e97639a2b99febf01c9971669ab1ccf41ecf5c677f3f2a9e1cd2937664a10a1d74fedb71ab4a8f95 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000073dc8390820fa74f08f8840ab7628f1a58af40faef73748e2ee235ab04b12fac000000000e80000000020000200000004e359044135e85bc325af52ce05cd93b8a7dcbedeaa76fb15a53f639c5590d789000000046fe5fc07b2cf20b5217563aec4421d2cf8c08fc844809f00fcb9a5102bf2925eb2f8cc1181feba773d4a2c8d0dfd351cdf191ef51b4cac8b660899b5b46c8a1a663b39450b01276e79bee6d1b53954c3b9aca0fad9d5c066eef30adaed965b77e2ed098d6ed26c4204d172d92a3f80eec7e5f6c4ba1c5e9722cc70ede26a84782d7b705798f8f5aad2c786a6d16e17540000000a3ce4487e832b61a60c20a678387be4ee142749980d884acb66855c6f3a70793b859f9dae7e28285b9703b60fa80ed147ecae8f76b4716e8dd8b9665e0cb664e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2804 2116 iexplore.exe 28 PID 2116 wrote to memory of 2804 2116 iexplore.exe 28 PID 2116 wrote to memory of 2804 2116 iexplore.exe 28 PID 2116 wrote to memory of 2804 2116 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40719e4212b326e5c4904e27165ffa91_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ac132d218fbcca37c6530beedc438cb
SHA1df0b9278aa3619a5152393cd06a6b1c402c3660c
SHA25684975f753851ef5360199ebaff520f17a87086d458c318b7a673df3aea8acda3
SHA512533e1aed8ca556562ae8a79538cc6b3a345b9c450be02529dfb88a608e88b436e9bb528677efaac78ff9cbeb69e8cc5cd678ff5632c9290059878eaed78c425b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ed8635f2b87e94d8cfcc2ade1047ab0
SHA1a5804a120c81284e5f187e7426a8012e4faf58f3
SHA256210660e765507478dfd9423104f594645ed11c3aadfa6c83d29a286d68770bd9
SHA512fe90f04d1d3c0d39dedb4bc9099cf0b78a824a403618b20d8743aa919f52748ecfe9d0678ec7f67571a07412d924c2cb0cc5f9d6c7c2b8c206a480743edb1bc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6087a0526021f729d8a5f3eecd73a1e
SHA1981a2d4f9969554d81728e269941aeef4ae7211d
SHA256e6c72108f4eae6a6cec542f6a157ad0cb61d6d71fc02e4fe3d0621083e5980c3
SHA512fd2bc00c6e37a932f6a1030c3faa6c072089ce202949ef66f3b3df628819806e8be6e09a15e8b5d7cf77e5d6b3bada5adec72402a8a5aab81ee0a950609de44c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fc87709a77e569197b32f0a9443d21e
SHA145dd38db7cb26373b0f077c5eaf09035d4b4a689
SHA256986df221a13d484a896d8a061f862f4b043da72c5c1d9e239c746d1c67b6cc87
SHA5127c6be34458b2befbfc5ca90ce7bfe1a93b7bb0d6f91c5d1acb2ccb0f62c254f66d1a79545c8ec537c26b3ef96884eb043628d11e5fd03e7c6845b5055c29d161
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0dfda620fd8f13f2cbbefc3985a1a63
SHA1d080e64575ae3b2495326a2c81da4ab373917efe
SHA2561c685a4eceb4b88168cf966923a632a3a2a1e24865ec63351db92adad29805d9
SHA5126e8cc9290058c87f2604811af2ed25f45560bfabf49a609df77997164cd3294e2e56c2b2ee8f463d4c8c5239867cc475bf20a9cc9753487c1872da5e33ba4fa8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddc1b4d9e2d84f8f2e46cd1d94815705
SHA1feb771e9c588b869588c591329956c1144888b65
SHA256acd8485cae78cf9404cb267180e5791cc92d0bea32eb28ea8cb606ad4b722e8d
SHA512d09fc21bb06e446166577936605ee97e8af9b27f3a14ea30866d0bc9d4ddfbfe4d0f0db1bf6bdb536ddfbaf0b2329d50550b848ec935bb452c898be67877a2d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e90adc85ffeb33ce464f3b5113b7a25
SHA1b1a881764ed94b2512be80179b92c81463046ba7
SHA2569885c1e8bbfef11716ef229388cd8615e4a2230a2c80e117993ed14c049e08fb
SHA5121d70f47ca16ac2dc8ce6ee0200a6bd19b484c6cf581b445c31808aedf2633a84955a6131cb26ddf697aa68674cc0e729af78d14265a9ce2baea1ce882947dfee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2db16dfeb682a71c0e0acef73cf7ca9
SHA171ee2a3b315552e43cbdace8ef5365ee18af2d2c
SHA2566df109ec3e30fa72c6786f81c90143aa754d9a6bb90f5978ba1db9bba7e7c6a2
SHA5123dca32d89122928a2edd179ae83c9c3dec33d82786f593bb6e15dd421e9594df583e1dfb78b8e23b0e68fbc91616f1dbc18eca6e2f7f667c4deae19ac9743ebe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef81c910c71b1ad8e3a1de061c5a9089
SHA15ce142c48c9eebf63389573b66a13010745746f2
SHA256bce0f2d45b3aa1a5016ed424f784eaa5acf8959e2c5216bd39b750713eee72f9
SHA512f10261601f35666ad787f1da3f0bd0b9898e5f2f057ef1014346cd0e71e2d40b53c6c7f99051b2a533993bbcf75d89eea636a43147257347e0bf88e615adda3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfcd6a07a2975cd7fdc21f4aa840efd7
SHA14663b82015602ae45604461349395dfa16a52187
SHA2561a6735e198e1f7f85ab6a651eeb71379609fc7b8c73674f3f87b39a0cd967ad8
SHA51243de601cf246bc53fdd5b9b40c4b586d516d6b55f74b071b5cf4776d2931b2e9f0e2beca24832a2f29ec4a575e275b2c933c77316e11bc1fc3c1d6b5362b1412
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5655e1d556f6694f0e8575dfcb8a56a77
SHA1f59ce7f22430e6d00bc07e0b9d9c4958083b2361
SHA2562f4180b8a522cada3b28e5df50c3dbe9a8d3c38286928497757b7bdfaea2681b
SHA512fb20950f76434d1165d46e37accedd28f199b0c53c5db0d4de61a16cf3faaf54584cca58bc2d7549a23247fd1c478ae21f5ec44fc0acc8ec1a23e57d976437d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50681cc286925abb88bbbb200ed0bfd85
SHA1257940f98fe696d77432998a3a5312bdbc44fe3f
SHA2568e7566f208f995084986445700cb69055c4555a9654d47aed2a7266336178c0d
SHA512cbc70cb2ba744271275d6513f6247ce7cbdfb4c0268ab9d7f918b5eb04957dd280b058faeb4ce91cdab110892a04b31837de9b23e22a3ad3bd6d9220de3c8d35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a667cde98c9cbd06a6e47b90e9ff317a
SHA1476c885805a3ceb3d95c847c8294e648e7a11e22
SHA2562c12502c7014a05048f492f9b06a7d5e9e5867900f11af02b4ea4e5fdcf1fe88
SHA51237a6a6c44bfa6a7df50125a621cc504365cb1c8c84ecf6f6c5a81ef75eb54cb99386e0e6992ecf8837885e94862abed06725a0e614c89595e5783620e3e77d6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567e672e01c5a66614fbe24ef062cb431
SHA16ba2da4ca67b4cedd6a5dd980665bb6f8af8592d
SHA256dc6e66a3dad6a34372a10778d9eb7e9e0ce04636ee2a891487c57c781b53afe8
SHA51283dcee94915fb5c56748dd14c6a536af873ca083b50ce71ab709166847ff5bd8267a16238eaf6bf2930b1848157fb29ef0308a016f01bbb1e083bc75f5ff8fdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f07d5262a401bc5378b735bf082a20f
SHA1afdebc5986e3534eb20cd4e16bd859553166f33d
SHA2567163a30b3c7253001238733fbe95fbca047c951dcfc043e77379e9c385fa16f6
SHA51277d39281b284b949e93954cbb39179503f1145e49e5712be5e1d086efcaac2e96bdd646dd5634b9ec6b246c30e9c68e71b5ae5a88893efba07ee6139fd71d98f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a3827a625adb46ed46f2867bb4071fb
SHA12adcd58e6815913e3b4f472bea19e170d6ddb34f
SHA256e38d4e0261edaeff022d6c56aab7c49b3f97d831d27bbe696e92726f620ad10b
SHA512a347615e143bade794b824dc6911be1583c9c96261c4a1cfb9b98a16e878c8e2f9bad1ea175739c90f0e9b1dd327284c36274be888382ca113d79d0190c5d6ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bf3d2e54c6bbdb93966ff7ed455ea48
SHA1370d26fbef8cfdc12b39eb1c62c189677c1a768a
SHA256dc38e56233304026f6cbed936391c3334299bfe8917ad7f731755b1a634e46b5
SHA512ac72207173c425a46ed0d64762317c3055c018b24f60d4ef2a107cb0dcf8df9892c722de4a3e67501b5e3f118166d5dc6c359be31f2464c23ae5de512d2f743e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c9a5e9a95bda0cd48fa41e28e2d9bfe
SHA18842f0f0b4bfc2602da82e32206272c5c755ddb2
SHA2567e0686457075138400e42556d23da9e9dc7c04c35fd340d99df9b64e3ab9c2af
SHA512f159bee75cc2488b3adcd0c2efde7d1c647a1b24dc434ef413197732731fa6db2e997ed0239813db6c9fb382994e38c7a8a7ef0fc1d45d52c1583af5c9dc93b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecff7be5b6f873a002d7071946454d29
SHA1e870e9af7b4808f196def54aafc70fce7dc8e38f
SHA256c37fa6d858dc177573f844ff48b5387e7727cf80dd39cc641b9a6e27e2002ed0
SHA51217dd4d525ee3a3d5a3780aed8472d06573f46c81cd7a981dce71cb8c84776ef787d5d5589679a2643c99c3915920c5e5f8fa28b3e863e61739bef000098e7896
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a