Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
45c12c963dc2dac942ad2d9ec52760fb_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
45c12c963dc2dac942ad2d9ec52760fb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
45c12c963dc2dac942ad2d9ec52760fb_JaffaCakes118.html
-
Size
3KB
-
MD5
45c12c963dc2dac942ad2d9ec52760fb
-
SHA1
26f5331f95c61ab9a4b5ef42dc66a43021b42511
-
SHA256
dc3c35ad752787f4e585ced2413811e0df331e3c77c3837fc5cc235c71a4e396
-
SHA512
442554239905aba3e17cf035830796ea7bf4a171fa6cc414bf3d16b0a1191f90dfe9377c3a7aadb12d12ed4ca2d6a3590ac5760b2df8a2755bc64faad1516b9b
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000265c9720e9e4d2e58e5f047ea3d063a92793c6680c64d4a4360f777cc4bb5161000000000e8000000002000020000000ca8bcd5997ad3086c4f9085bd3b06a9bc7ec9c2cdd8cb91c1c60c513d04c19cf20000000a9b489d9f79a39eeef07a9dd146eb6a71e8a5902aaebb7d447899ae84a7fe1eb4000000073d4aaf01d9a314ad67951a0d8b2ce15215fb69c35f20c6a61fa4a0abb9ba8ebd45da18ba1f6379451c7916bdd82680c2193bc709e1292e138d14ea80e6a0d91 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000002821242a409dca5efd02694b7feeff93a72c67c624520c8aae6f918f58e0b48f000000000e80000000020000200000008455dadf9d516827f416a0ebc8b381f9e63b6d535d8380ec0159cac750ea429690000000bf77a49219e68106ae4214a437c7c7d2a04458c530bbeef57a9fdb92d23457b93d4caa781e66b0589b66baa8065bec15d3e110a0a09f4c538546122756af0737f3cf9c73a93f8fbcb93b8865f4e1d88a90ba36abe3a941c3cf1b313e664ac14e33b23c0e058cf44d21a76079ce940cdd314031a3d69e94f727debc61fdd949dc73b7a08aa2c4b70223a146bf799ca29a40000000ef635410dd7ef6adf5f039f60bcd7880d26478344ea93894bbdecca6c697a1706c8717bfd518ddb30000a9538a93cbee9554a3b824469f14cc31ecd3e0ce7d5d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C3A9161-12A6-11EF-BE4D-CE57F181EBEB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102de830b3a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421930986" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2788 2036 iexplore.exe 28 PID 2036 wrote to memory of 2788 2036 iexplore.exe 28 PID 2036 wrote to memory of 2788 2036 iexplore.exe 28 PID 2036 wrote to memory of 2788 2036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45c12c963dc2dac942ad2d9ec52760fb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529e7b76f493e9785391ba3cc19908427
SHA165fe8ca47e2dc4808d4d026629f920b9348276ee
SHA2565e176c84fb77b1cd020b47d3f123368ae0c82621a197fc3a741b98c1234170b9
SHA51214d7f2e0bab5de22f4ef4c1428903b3062bcf00cde0b37d160db23b3475db95ea5c2ea084211f9ff5b95c172c1191e93cc9b35872bcd5f68b5164f886d3a9ce8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e0c66b426a6ceb74b8c45cae056779b
SHA185d8f85591c8c35f4ae4570566ed6ad90dd18f09
SHA25660704a3be5b3bc009d84032fa26f9e5b7f0a55e7221b5d891510a33ea3158ee4
SHA512e68d5842bcc047c620eda8c727480416ab5e7bb47a42ad4bcd1dda67fe7f520ebaa376fe484cc853654fb9717a6243fe8a0c31934cc880f444662fe5ba7b72c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7ed135fd34fd61875a07dd842104e70
SHA1d5cd58eb87b8178ca80f2131fcacd82ebfa14925
SHA256d9b37ea8295047366d59fd181af8db6280e40c2b111f7bb046163332a52bc96e
SHA512180a05ce6e9e00971f73e241c878cf4c8d96c40ebb55fcbc8f5f86fdead203ecd0f2c0266baf1b12fc5c9c79697f4100913b0b0cb46ba53ddc051221e5bba948
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d755af166179a759ca4c52264eac7b2
SHA1f22be00b64841ae4ac7276c3ef5cce36611d31f9
SHA2563afeffc31ef9ec7b9cbc40930772944daeb66dcf15d199b550864a64394557b6
SHA51298330a80d5b8283e6c2e9ddb0d520cec92c8563a4eff6f01207d54f1b19e82bc4791459da79a6a640376a8c6cd990859f5a6ac6d33b5b5ef7df3ced0e1794a4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a1afaa0c517ff5c2fbc12e1bef6921c
SHA1da5ecaf3170d4aa8d34ed9fb3c330e6c170a671d
SHA256207d07c7e0be7e22489bb05bdf187c3ca1b9dc92005c7ee81ef5528f575f1a17
SHA512c63ca71b66ce6ff30385e90e2c7523595eccd5b805ad6bef003c773829281eba3de2385cb0517499f53b5371ae324e969379a2cb55ad74e8624b046990aabe2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c55d225953b09ab4e4167f4d5645126
SHA11dda1dbf4b5be296d3d50be84b6f9b0958563f15
SHA256a7efc62e1f866d40a0df43b12c8a7e90dc33ed1ab526e7201a7bf934e2533381
SHA5126ef4ca0f878ebbec0add0a5e8ad9c4c9c8da600db2eb0df3bac141dcf5571c263d0c616e61a0a358664036e8ab6be70bf98734ab093fee47992e17e5726bd27b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56157ad08d05e6558e9e7f68d90ba45c9
SHA129be253675bdd9594024c2ef8fd81e397d2444e5
SHA256286a18c3ecf18b33cc6725996c3ded0133d7565f46acd80fcfb87ed24b06f837
SHA51227341028c9d00b01265f2f75d91ec10560cf91059594c444919e0e5677a1c63935458489a9de8f6e7bd282bf3726f1ce5a7efee44aca0dc1130a13e76778e0e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ee947f06cc20e451938517aa7e22ffc
SHA19793485d9cc923550cea77f9cc5f9f62af054ff5
SHA256cc133adaa1b0565015dc4b39155745757ba22c3dd775b243897cd4105e3f9dbc
SHA512f9598cd6ad3554301ac4b57bdfdc5c60e667efbcf1f3ba3f34b9e603fc5c5af73ec5f2ba327410f2982d201f6a6ec4a8680e27c18244372415c7e2f55e37f320
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fe7df704766cffdd813ffd53d04c218
SHA1766b718608605b9e325fc7efa03e30ade610be14
SHA256e49d832b615e926090a3dede2795614fa762821f74f67821b1e52d0c296cd23a
SHA5123e6c639e6e898d0586aac2957593c9b4527126cf6cdb7827362944245ad3fb268f5c9365cbb5d5079a6a0a1ba1c0c348df4e38babf6162b6442c197630c39466
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5263b0aa90f01f713b64c2b3524e4ab7f
SHA1d83c5cfc0420213605640a7e544efd8f20e73014
SHA2563b38dc43ecfe0c430be314fa5e1a7ae9392dc781cc51579eadb827e94518b8ab
SHA51217b5c9402db77f8170a14949011c483813605111dfea2937ec35d3e7a3016492d1d5c51df90d2a8c8e81582a6507e83f1438c9d8462bfb7edc2198d6d47da740
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a98a422657aee7d6472eaed820958205
SHA1173ddf1a91f93a30039706c52379d9ecc83356ca
SHA256904c98d60b8ce9ae4973a5f4d546c3b644bc2992852263c834a925d2e4b916cc
SHA51269a069f4509f5cb5697a697140b78e5449bc174cddc408c0e9f44432056bce505246b5050e40c3873eb8524dd722093f7f4bd54df8d3f44fa3ddce7374c74353
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3e8fe01afbaf7289bda8d14f343c7ff
SHA1d1d7193cd76058fcbd4b7141a0651dcaad3a415b
SHA25602fc1043504a47200143205a42ecf5d7aba087e564adcbced8dc3ef4a63bc828
SHA512073fea1e513a217f55da0c7a133221728ab15e2dcb2e303bdf9a15b63cdb9f74978cb077e32481b4c47cd6f3c3e5190c8647619c3130978b4a6cc9ff534a064e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a43bb2e36d5ff3de8a6e9d8407f516b
SHA1a323110da9c9879899a49bb8649eb5cf4018c661
SHA256f83632088feffb77e4b7c9c48d3c6e37ec50c978edf8d8e1bc254e561d090a23
SHA5125f15eaa92f940cfdd78e6c9343a12fbdedd0a007cf3bdd0f74370d404305941ea38b80c4224a2737e043f7eb8d5570e9e8a6b8758078b7d5d04ffc7b4b11e675
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acfa109d6110b19d40521b83ac8e7ae6
SHA11e97866fe056d2ffc5faca599f99a579b47e7b04
SHA25650c625f7b05bd0811ad1d9c4b766543f8ed80175775cc534a2aae702e08dc0b0
SHA512535cdbfd0f869be237b488d0f333e6e7a8e726e6bca67950da1810d35c043dc09d2445050971e8022f267dba38070b0c4fa55c89e75c9d2c9c9b3f4ccec6effd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5077c0069b236dc73846c410622607a3b
SHA1176e8908883947bfb3cb904e1e0cfc809f085a59
SHA25693edb33ed879ac06bc9d0a44188e2e2147c42657d301c82cea7fdb0a62a1ebff
SHA512125793b3b984a7c721835c6d94feb1e1b6a8eef0d26e2a2a53b51265e6951fae3dfad0d47cb6336515c313292d5c1eeb212b72388bc7cbb8a5e2d7d0c1983abd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587f3c67ec3609dd97dcb8ee01d9db765
SHA1a30147f09b359f7d611a8a1837c2cc6b308f7ac7
SHA2561ce10b47d04252e9b1a292ba52c5227f5928510fdbb7100ec761578af35ad591
SHA51230ad9dbb19ff4caeac5ab8b0cbecdcaccfd901494da30746921e656c1fca37f9373567c98619774cd91ff4e638532f22b66e17b35bbd288c1537a87d25603d55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aad662744cdd123c7352f11e1b929b59
SHA1b2ba394322b9dcb54ead4a2e8f18ae65e52c1794
SHA25611104b4d2fa4bec1465ab631b3d2e0647b218eede95279f6496110a9224048fa
SHA512e79dd3993b81a56e037a2a8694b4a55d17d98b0e6f0804f67a755b57ebb3493a06d059ae4e2e0a5976e128f6e6d71f0906a9bf523dcdf264370e896501516f37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565200d23e44c4c26cd7617bbae155da5
SHA1dddb9a2e48df0ab6b635f5c2c751e81b6d89243f
SHA2565aac09e8c80b845325f6579056f147e82db1d837960c7af644e11d62281faeb4
SHA5123d2b249748c7be266a996165a13bc8d49dfdf3720b2f3e00684ad21ca91223a9b35a57cb36d89e6b9e5ef68bee985235c61cede7ac807f55960d59da9f500485
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b33334bdb114c08e5b3371b369d01f8
SHA126504bd55fa6e43c7f8fe5bca4dec93ce7cdb748
SHA2562250bf2848b2f3089c579cf5c2bfea1ae918e9370b2dfd787fc9ca960482a501
SHA512e66af2f2b67ff1c6f1a55ba914d146fd0cee497d063c2ac9f051ced1a5a5ff950d8bbf939e96000ffa7dcf3d36d8b251d8f5cb120b6116a2b34f3f6b2b5b0946
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a