Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 08:40
Static task
static1
Behavioral task
behavioral1
Sample
4a3ffcecb7318fcf205015c0d9eabe54_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4a3ffcecb7318fcf205015c0d9eabe54_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4a3ffcecb7318fcf205015c0d9eabe54_JaffaCakes118.html
-
Size
29KB
-
MD5
4a3ffcecb7318fcf205015c0d9eabe54
-
SHA1
897192dbe2031cbb9bb96543f1b250e22072a9c1
-
SHA256
169557cb3bbccd76428133bd79c44c95655c78cfbf598777dcbc4e69d6155b03
-
SHA512
0e428c72b1a3d4b4506212aeef61fa0411a597e9ae3d2ae2f1deaddb1ebbb0581aa4204707ada405f32893f012939efa925a8c88ca44f6feb6c3310e7c554a93
-
SSDEEP
192:STgE2XbpU3kFmtgbo9iWQVexJxqwCi4SixX046eWkQmfciJQNQQQBDjg5eykwkgB:STghbptbqQVwCiH4NYQQQRjQnkVDi
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422010673" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40cffbc26ca7da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000007dac49915f3a1930a8023bb2cf915383b295dc7228d7da08ca442bb4f9834935000000000e8000000002000020000000bfbea808014191ad3a6e3c25430936d48e9757a6d4fe0aaf4f4fda3a5165601c900000009a2517f031c93fe9333c8a845958cad3f667465fd05a2b958dd0def6aecf060aa988051e1cb4dba41fb3edee63265635244be24aa59c22110f266bf2daf4735ce549f51ef69fd5907c0b1bb24f3af0c3389ee885adcc826716a7d445dd980f601c1df81bb8a09752906bf09cf0aeb421f2437c60fd18eb74556a67cd04340ba1b61a36f3bdf73f2cd7a59b3d53f3d117400000007b8dff7c67eb37576acda5c5eeb18a9ea64046b2a0d187cfd87a9707e10710bdd9d89e5e16b2d2fd9db7070ae18597bc86fe077cbc945395eabd27878a4fe242 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4D68E71-135F-11EF-A38F-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000000e7a3070d20eb6e61fcb8119582938f53b257b78a57f0b65e5666304226a72c8000000000e8000000002000020000000947577a065ffda2d2e2512653808875f15e1f18ff678147a757239a76b1efcb5200000007954eccf6bdbef6778564a5793a21f8e363b3445a7e918f35326096374ff9a0340000000d0dfc8408eb6c94dec64906e2f30bb4c031e0541668b6e27438fc79b4d3481ed5fdcd932eaa4c24d0b4fa2e5fb0179307735be64d91041306581ff71eb38985f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1176 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1176 iexplore.exe 1176 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1176 wrote to memory of 2216 1176 iexplore.exe 28 PID 1176 wrote to memory of 2216 1176 iexplore.exe 28 PID 1176 wrote to memory of 2216 1176 iexplore.exe 28 PID 1176 wrote to memory of 2216 1176 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a3ffcecb7318fcf205015c0d9eabe54_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc6da0a621374a0cef516c8d4210af2e
SHA187322f672e45834409fe0fa89e6637cf4fe4cd4e
SHA2563263dee6f3e541762c9294b314b05d943e3f2980e8e3c53a9aef4f915a605afc
SHA512d2f2f44e44772bf19f23e499ff88f879730cc7a148a14f2f52aa8ede052aca37d92e0ce12e80eccab90d1cd2d562d70ee8abd23acc38cea1e94eacea533c17ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e22ca65327fb7a7d4936a23335b571f7
SHA1b0696b24e6fe38cc0f7958286424fada4bfb6f3c
SHA2562364437dd0a339cb3680f226898a59897f672b7a38ce1ba2c209f0742a3bbb1c
SHA512781794af3ce4445998af4d8f103214ddbf9347011d0c51a27a8396e28b601ac7798aebbcce9578642fd3afade5ea243b18f301bc76872847a84b4b63421f7ec6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fdd4c66fa096f966bd04e5b1f316139
SHA1f78abf9eb5a0a7d654b69cb2306b1c3607c2782b
SHA256b7f6f83a945c44992e07cbf5ebf66c797346b90ec6007723ce6be987be693cc0
SHA512d833bdfe7ebe8e0aa0599b242f670fa179457cd037893139e6896334d533a709a51678ee7a18af447af0b4cfe75599a639f783a7b65eb84e170fdc1b3d6de4a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f4d06e9a95a44a2f70ec3c7e5077abf
SHA18055ba9ad23a14f6e9b240f0c170a95cc6fe69cb
SHA256bb7b3386d9a4ed3101933e12d6b6611a3bbefaff7ad16168ed9dd3ec85de626d
SHA512e3cf02be39429b264f1eec1588054a02d5bdfd8841150d837fe511d90d125e94beabb9f9e1b732a55ebc2f8e73a5208772903df53096e871fff67a8d3453800b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc4f66ecfd9f1e3da46a28aaeffb9b84
SHA1b70fdab50c0633542734bd53a9c29667656d2bad
SHA256979a1e6e7412b03fb49ba9774c7244cdf3e3fb1b55ee301269121e440e139c21
SHA51223cd61ff50c0008f7fdad5dc213f72a599d99068a51de52d3d97abdd686a42409f51fceeca266f76d770518a57188b743772d53e339f8d2fdcaf394fba23c4d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518c784632c2d36fe2a25e9003c8d1cb4
SHA117d150c3fc0df435cffb430d09a45cc141124981
SHA256060572e745ed1e162f0adfd79a375c5f425576f69544b97a8cfceaf882444fa7
SHA5120f0c7946d7ee675e32ed47c57a3cbe2ae9b31be77de87ce5940a3c6799487957e0ce4d41eb0edf9a9c7fd6d3189478699ebf4237ffcce04978df97d72178504f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5621638ea8d7375c7e7fdd9151e16d16b
SHA179d3c8c6fc665880e0b76dc21f9b4b0d3daebe49
SHA2565023a1c8c3cb76ce56d1fc2b1caac4f5882d273b71a5e884e3ffef6aeec0e79a
SHA512d36f4cd4c5f30466f13919b918a92a93916c4678d7ae5a73c59046e3eb78c076a5b73f4243a08848628117de9637b397e66f4a679c6737710a1b4753df398e91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534c6dd0ae87e49ed8e3d9b4ccab5ae57
SHA18ce08969196e8919e4e38ebb46af5815d8b20156
SHA2567b4da4e44f50c29f89f3dedabde9af5357607995498e1c600473fa871576a994
SHA5127eb8830ffe4abae924d981e35c8f8a8bdae0b03e500de4d3df35b0c6d897db5732fcf1fbf13b8457ca332b2ac5e488be0ec0bc6bb0e2b9eb25abe84910f7c16f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd8c395b9390bcc6331394357ca203d1
SHA1664596e25c40427f4a7465fe16f99dd1344399f3
SHA25654954b7c86b8b0e7658e4687a202a1b9f28b570e6d67b1a59f4badc2cf33b396
SHA512bd4692d645eb7526396c48f3e62c19f53763ab3253484ad61eea81f9b2793564673cd215e6c2061e22df4e02794b8fadc66b9ff3062c71ed4263376748edcb7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d3e956f1f7b16a6febc04b71f48b501
SHA14ea0df6edf9aa9a93c2f179b6318a31c1135cf1e
SHA2567752f510aa09b9fa346ce2583a8d32552e417a18803df6343b9497f53a11b044
SHA51262723d6c9835ae1452cfb140523d50ce8639e60fa8996facff2acb43a0b7b4f4ec2d78aac8554519592fe8ead989c804b2c754641bd23f9f91f1aa27b224c384
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf094da94ec806f9acade14aaee3fda7
SHA143aa2a7ec1bc0bd918d7f80e21da1bbb3787a128
SHA2569b9ba83f03fdee1c3a6864359625bbaa72159436f92e075fc2788f42073202c4
SHA512b0517a702f4d7361db3bfbb7a2f85b0c92e045b3b626fd8452411af3851355fa6a62c0fce78b739e27aabc706425cff26ecef24885bf4cb6444413ccfd474287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545fdd707d776f74e34b65f5059c31d3a
SHA1d3a5710b175ecc811d872c1e62a5f77033411ecb
SHA256a8f212ce802c325ad2038d1e6007a3c2d201d4c98f8cb2ef8dbebf27551ce529
SHA51284ed90b3d5c09ec61413765718d99a0964f18ab910cf994a107b4d55c66d22c37b6003c43095764d956bbcc44620059a6a34e054eaef47e619186ad21d643cb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c1d0403684e24e5e8b75910b26a74f0
SHA1e52bcbfa00097608c04c5ed2c425268d473dcfa3
SHA2567782e6344278a84743f1f11a0e089cbfb85e2e8e6377ccf0a293d250874ad80c
SHA5127c9f163eea167db6225e94eaa6a21fc263ae43fbff030c71a40a2d6e124ce03c37c9704b8289475eec014a4b73a212443567a9ce2de05b413a1850133904686a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba73cc9cd551c1277b3df94d294b39b9
SHA114c347a9564c3cad9ce482051341b345ffe68da9
SHA25653a43282e5dcca15121033bf8564ca7c0658e5c7ea28882c658685cef1f52d61
SHA512cb93603b864e9ab589d9f241ed7621b43b7aa3c07de3fc8aa0c3c8c82ffac717bfd3961ab55c819014283d2233255026e3ae1f7404c45bcf6b47e907ac74ec21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0ac0a5c5864fd5dc305967e764c8deb
SHA17be0131c4b0f2634df908f4da3aeb3c3bb6c2882
SHA2561fc548f8bbc92621b885febaf342c0687379123e7b4def8d7f5fc59cec78b47c
SHA5125059bf46f43b1c8c66c602d8196b827adaa8cb59d75562595c1a86b2cfab2da16ddf0426f4bc565eca011e51ad153e0b41dfff497bc4fb56b41c3d656116333d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550f957788abf30948da232ec78dc3e9f
SHA1df0f9a2013db446f07bb59f2c2dbc2875025c86e
SHA25683a3ae9523f36494c1cd84481e87ea474f19abebe98a98430bbd7c2930b7c63e
SHA512b7cbdfb4d16baed0b8a7598dcc0c31883c9fc3aa84c8991e88213f3a9bf39ab174bfda6230cc084d49e161dbf568c4a2909128b602c31de88809591d9de3f740
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5deeaa0528dd37f4d7df98dbb4404d76a
SHA1ed36f6a6c7c99e982ad68ed38a68e51cb9e35655
SHA256eb8c32aca3be2f525bd9589ee06f4c3869f54c078374ff3c544b1ea1e49f7922
SHA512bcf7e6e4a7ed6587e78b02177990c621caf7f0ef714f5ca9b2c71cd2663fa17f55615b353ea5aba4613eb99bed3bc7fd604bb18bbab6b670fc6bca9f867acbae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51711755ecb6e80a94730908a77947b65
SHA1008b311b87ff50333577cef9447e61aee831527a
SHA256fe63596579c4eb2c6aa0e52e95d3f4f7ab4d9e2da6d52bcfb7158bde39fa4dc3
SHA512c46591db865f8d51d05b0afee5733d2c97345b8f952c6eb5ee87cdcc707e3d223cb41fb51ebf10977b96be935bcada34010f94faa6b861f8ea5a1bc4a457014f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a