Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 11:08
Static task
static1
Behavioral task
behavioral1
Sample
4145a07b10da8b418b183b4e5affd801_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4145a07b10da8b418b183b4e5affd801_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4145a07b10da8b418b183b4e5affd801_JaffaCakes118.html
-
Size
6KB
-
MD5
4145a07b10da8b418b183b4e5affd801
-
SHA1
af912f09817342c35b18214e02f3c5b70e8ca359
-
SHA256
4524c9d757b658830a4d553cca6bf66633b40ac04e3310af5366f8dea639d004
-
SHA512
a92c7797aef8c8657f2f0e34178c82564658806ea016dd71f536c3af272b223a49d354e2ebec34ebf844a2eac0f8eeb9cf36569a331465e8f6130f28744e8ef6
-
SSDEEP
192:quj17Z04FRw5OgmYEZtdX4CW5N9bG7MYVgjVQlnQa6aCEc6/V/s:7Z04FRwIgtEZtdXfWflG7MYVq6XtCEcL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421846766" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45359011-11E2-11EF-9BF8-4A0EF18FE26D} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ab4c1aefa5da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000ab0d5d699a991ec01ed29c5c58e780615dd8c5d10f826afec13b783cf1cfa05a000000000e80000000020000200000006dddda6a954c614cd26217abdc2330907cc0b4eb0e9ebe2e7ba964a41f0721a890000000c1a6a0acebefbd8dca189c24d1d09903327a9feae43ca871626da1e4dd2007d5b081aa7668ed21f3c8efe803efdc138206bf502ece4c29272f103af5aa1e1316301d9764dedaf56e8168a502a32e4b2316492c99d6a26e5b6b0349da121f88d4c25a4ec24960f5ad54edd06a5b2a849a44dbcb4ae2f06c9bbf9050d3a81cf438d7cbecdf4e7688a8e007ed4c2f0c67284000000004a9bb1df68d189ac5523c04b8438660e1ab936f86f8efb975cedd83bdf47fd7a43e26801c8abdb5595401746704104de1eb5c4621a1cb95a53d5adaa2abf51b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000a27f765f7e4d05d7275fbd7c52764b36f23fb5574924c0388d16b22dc73e6622000000000e8000000002000020000000344e300928e1c03461e24ddabecab25defa1d7a1ffbfe99f988368d94ddeebd320000000fa911644839890eb70d8d0ac8103baedb005c94430e5de8c0fa5247c9867a9a44000000007113efcaa80026cc66a92c59b13f9062ca8e13b0315b4115e48760bfa187b5f2f75485e15ba176cb549ce63adf4f0dbc0a23b477798759067349a90b6021d23 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 1948 IEXPLORE.EXE 1948 IEXPLORE.EXE 1948 IEXPLORE.EXE 1948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 1948 2292 iexplore.exe 28 PID 2292 wrote to memory of 1948 2292 iexplore.exe 28 PID 2292 wrote to memory of 1948 2292 iexplore.exe 28 PID 2292 wrote to memory of 1948 2292 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4145a07b10da8b418b183b4e5affd801_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5beba4c356d58c9bc7c83872328ab6a2f
SHA11c6029975268b2f20acbc524169a86a0261c29ab
SHA25643238fb2cb4555dc1be12b785229a3d181b2df366ec5a856bccebf67e3005c62
SHA51241a6be73f26d1f79b77336206edee74c602e1a87b9474278962518cf9268412ba7b2b4febe1d8e88723087149f84e42701686d3273ac7679ede92481ddda0164
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577457e963f6ebe7fd1c9a8bb200f1494
SHA1fa2ce32379f719a952d15f6a924a3f2a31a40f3f
SHA2569571b9dce669b306914ed4a37541de4f249c0386ddcc6d552128e5cbf9ea810d
SHA512f751a6784452d287ddb900f48f865c726f0ff2ffc5c36bf8f0891412ace35a94810b9b82a79e346b3543a680782f9870ad4a4e18ebbe582b4f9bd502704d5b8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5300501b8fb9c6bcb4d4340d30580fff7
SHA1805df419562ea7cfa68c1f58664174e64f271b7d
SHA2565a750a10a8599313f195f6d3806445266463717c010f08f540be3b8241497575
SHA5129f44654fd6b3c9f0f47cf2ad46a82beaae1b9886213bf87ee7af2b1dc04d3ad7569b038d78d18608d42a699903e41f3eed29260940667b657d0a5f3064bd93e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507e50e47128e3efa3d359438bf5f27cd
SHA199762dc9819bcf81e153ae14de41d12b35ca0a5c
SHA256164f3dd83091797e5b010698a08d96e826043d33423a1a6fa7bee8438ab7a07d
SHA51205a1ec971473e37dc3c70783100378bd4871d1b9a5669076ef189ed29908faabae8903b97c37137792253d12e3a88589b13a61d506afd925b6d66b0515fb3ae3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3733582482fac622d9e51a7562ec3ad
SHA12df0c39606354416ffb719df847353a0f33954bf
SHA25678c44fcda9e9655eb635a21709f91de61db846693289d189e85da297893df0d8
SHA512caf1d65e818a3dcff1810b5e4ec09b7d96bb4499db4b75b36128929c99d157390218f032ced4748358a93a6aceaf7e72f88bfddaceaac05f427159ef1a575666
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b297180fbffb6583be833576f79c2847
SHA1e4d39d206f1c8a30407aa7699c69cb9b309ca003
SHA25636e763062d1013099a037d71065f84400878086abc4e9247106b28b437317aab
SHA512d9c3a027917a35120ddad66139911c18e196d7615ab90cd74321150e1d6489b4e82cd3a66509db5ba90e7a1fa2d55889f03f86c602a5aec2bfd06a83b49f0cb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a27e99fedd4ba18198b6df7dc5eb751b
SHA1c7a251c45950de29ed997e1aef69c4816c72f725
SHA256491356860812335f3d4494c7db35f3dcac0158ec19a161bba85fb25cf2ae3148
SHA512bcbeb47ce04d53eb5ead834be7c232ebdf5449f36abd3bab83b567924ed2c5ab3a5b75f0ec6e1a64264d6ecd7749343660ddc7b459cda6ba52dc3f9e0cfd6b23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5402c993fd94ca936dcb4847b4c896e6a
SHA1f97e1929752f669dbffb7ba6cb27f1e51129df76
SHA256a68096aa59a1789aba759376de41f9d23ca0bae99b6b08bac4bc9c68275a8347
SHA51242b64a8d5ea0d7088feb4c39320c8ca054c1f9d82c2d7c3f2a07a0cc9b4d9e319e4c4923815410f95ba6cf889350056acfaaeeb7cf8af86c6812f45c61df77eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596e6fdc1bb1459fd6db691fda3571f37
SHA140351e10b779de59037f5cac23889a9d348509e9
SHA2561c37cd2016e2e5f15ee4e6abc1185c0287696e29f6b72c91b756ab9b3277c780
SHA512479165f7bc06ffbbcfd3ae6bea40445073b72a99ace0b752f4a70283eb2eb71b4613ec40fb027f6ec0754b01fefe86aa0011eb070440670271c38f7a8325f156
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5532a703a2f730c5877126c540e5a2736
SHA154a997cb2969660e8e9679331b1d9a9ac854a749
SHA25618fcb16d37a6c9a9c035bd40417f46e0546adc1f754ff1c3f2904ec6751a0182
SHA512b1d910bc143ccfc4eca4df4b585d638e93953bb770257eb9b4513e90b53d6582367dd6272c2d09cada9fff1e39cd9c97352b3622cb727767390646f5584cca6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f6dc4d25bec64d8467925198f1f460a
SHA1c1efde1ee5840c391b45003b4e207a242ffd5713
SHA256cca20b67e2085843837dbf587552d6324d068c4a1b7ab61eb7ca6ae8f3bb2820
SHA512f3ecce9b100412bf80facf7205b615eb776945489e815c1e7716eaeb67cd46f32bc8e1feac3920ae93a199aa11dcac83b60adc9a78b51b8c0eb41b1b24713b42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5182d29ca5328a686d31423faf9cdb07f
SHA12d82b1295ed83f5be97b19ae29e7ab35136367c8
SHA256909f97063b0f489a44c62ce41110b46e5a2ddc681585b41ba350b469c83a22c4
SHA5122bbe28e22f5085806465ac798586f6219a272ebb025f56e8aaece87e2384e1145aee3a2a1ffdb4a5046680d13858759593ec15d5fbdb52cfed764eb746083d95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa6f2ee3b10e0375fbe744f8d91342b3
SHA1d7ba6d65304b0c6b094d1de4267a84f2f9f59a32
SHA2568eb814807e749f84f1b6639afc24e502e55628f2fd8cd67d9bf68ef227d544bf
SHA512f84d1c993d71659c7a741d63498f263d6718745a02d60929758e7455256e55aa7114f00d5f5fcfc84739ee7ac00516a1343f7fc747a79e745fc094bf43f1321e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58517e48601f458d4212db69abf2a1325
SHA157a7bb3f0ce2028ab3f6a33f43a348d5217271b8
SHA25627efec61cbaca99fcc1a7d7f45a7c200502a93327b38b6f0ee0f1b89eec12736
SHA512d04d9316d5ba2c2b3b775bbf3c01f62f135fac80030e3b2af0bacb3b198498d6e82d7968c6883bca1bc1467625b3eef3886b3de0fb0969792f3d16169e147ddb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af2ea1e43c66bd3bacdd745f458ebe1f
SHA1a116f5c0b4768e8343d966c11a20ce8e1b2b16f1
SHA2565db7295d014b3e8478f83ce00df69a376110ce362ff7d3d6b627141b5df8bfb5
SHA512fc1967860fb82d9b7b849e65294c590a7b37dbe559be7245024b00aacae084db533807fef60a9bf19c406c061e3ecde0e3856d0e4b278c998a4581029e1c6c95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514290303df1fad6a385a2156fe4ee87e
SHA16da3731f0d5a8892e80602869e6d3878dacaecb3
SHA2564edbded02bf5d4c4fda10283d56f6107cce88fe4289711870006123baf2a5f46
SHA51268859c1eee17ce082622a0dc086a9fcf99959c887e75802648a8d98736502156c4553baad68e7054bec6640665f48c18251142632f09904747e66faba9f4e54c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e74aad7ee995a735f34f4ef9c16cc52f
SHA1cc298d352ee505cacbc67fb4871f42752353470f
SHA256befa06b48953de926219603029ae4ee7908dca9819a29f836825659e71005dfd
SHA5126a53b1a8d980f35f61c84757884a3b11241192007c45c3e5ea94e854969b200d48f86c2358874594bea27c0b5dde3a699a984f434123e23c4bc04fda90e0dca2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a