Analysis
-
max time kernel
137s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 15:02
Static task
static1
Behavioral task
behavioral1
Sample
63b72a351489daedb45baf02f550aa22_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
63b72a351489daedb45baf02f550aa22_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
63b72a351489daedb45baf02f550aa22_JaffaCakes118.html
-
Size
213KB
-
MD5
63b72a351489daedb45baf02f550aa22
-
SHA1
c5a56d84fffdd869ffad1df4c25eab6e8649dfdd
-
SHA256
7318f6efde7de1215c71c7c232df4c57305816f11167ce2d2fdbde55997fa994
-
SHA512
6e95edf2d3b34b0ba6a8c564f7e216dc445b3f618b0805898d9607aab224578867d5f9c439a3cc1e700a83dc1826fe6e5dd042cede32d92a57913dda6491c498
-
SSDEEP
3072:Sf8B8elH5sBgMyfkMY+BES09JXAnyrZalI+YQ:SfMV/xsMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422465622" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27580811-1783-11EF-BCB4-4AADDC6219DF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1704 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1704 iexplore.exe 1704 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1704 wrote to memory of 3064 1704 iexplore.exe IEXPLORE.EXE PID 1704 wrote to memory of 3064 1704 iexplore.exe IEXPLORE.EXE PID 1704 wrote to memory of 3064 1704 iexplore.exe IEXPLORE.EXE PID 1704 wrote to memory of 3064 1704 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63b72a351489daedb45baf02f550aa22_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58b78c28c947c4c5a07ced3b7e723773c
SHA1a37a547be59293706eae409a0bb85db6ae0f497a
SHA2561492e1ce78a918f91c72c11e0f0b3bf24aca1b9027a99584cb6c25bd8956d675
SHA51287b8ef0dee1628c6f1b60154134d9082f88b16bfda7144a8d3161adcfcfa8d93721890e9493ebc72ba8e6f31fd9b96ea1feb52ad557ec5785b39c6535f74e065
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59fed5eabefe029b0189b2a7d1621133f
SHA1afc3b700e8df701102d4c1dfd7447ee9400b7d5a
SHA256c4b8a11ed293fe192a42710641a2d70a16ece3526673bfe5d86e86b898361bae
SHA512a5d03a744db1952455ac32f94e50814b9817487a09638ff006f62c340b636ddd58053085cfd2631f781f996a80530d6a8882bbdbd91700293401e38e574eb912
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5523467d066ac669b6391720cf9eee428
SHA1d7fd507af293dc4595b7014b81943064b1ddd119
SHA256597a56cfa8a28253433e9dd38655b7000ba7ebe222a8ded3cba89683ba2b818d
SHA51230c59e0e4dc80c98e56768ff49e45e10df15abfc2f7fafbc9fb4f3e9f1600a772cb63f672f45bb0532a70cd80785ebb5c0eaeb9891c402be4986f144dfb4ea7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52a091b1d54de9d5c527a3fae7d6554bd
SHA1f3d79de5cd45aacd79ed9823770d1d82ef9f9195
SHA256432f925316d14d8466e0c51149599ed78d54d1b4084f76977f57fba2275d120e
SHA51269066fc92ce095fc3bc53dd1e4f004477cc31ef6477cfde45fa865a45ccfdc73e6a1579f09c8858d129ea1696a037003d35816184d2d31014fb9474a9a256b32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD559d6239cd8dbcf1ed2aba3f2aeeafcb1
SHA1efead2ebd03f2706454f0003e1d02e5cbd510930
SHA2564f9e0b223188a63adf30290177fe94423026619422658e389f3350c2e37f84f7
SHA512de45d54a6719413da2c0e213eee18bf22cc2ceb5de5840c0d56ffcab27063a4e790bac79f5949504bc673ccc65bd08883f5dab638b7756509b648bd19a29714c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD538f93cdf8d297325303a6773bca918d5
SHA1c059eb1249a14e8d6bdd380aa088ce515b20f2cb
SHA256bb35282ca753618f41126fcaaf6aa40c2208b053ba39f780558b0e35292b1779
SHA5122c23d0b12cdff5325fd04e0595a9e2071eebd4dd4c95e803f68db48c79d8f3935f2246d548e43dae4813bb724e7e9019f8f4474b4ec89c58cc06b0e2422a9eb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD526e04386241b8d29c6e43d7ddeb67b04
SHA1ee5d06c9ebb99662179fc40952f226a3f6718036
SHA2562317088ecf69a63ca4f4742e4cf718481aac76fc3c55b5cd27a9d881986d37ac
SHA5125d4719ea2cdd70461a8b179faeefbfb147a8abc95611c5e03a55ec6f2418b323ea683d8723e8e25ef221952682fce2320d5dbd6d95812f3b199d8eecbbce7881
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fd0568e275dbcc1318c0bcdd43de8bcd
SHA142f4407d34ed0803276b87c3ec1d6a3b3b7fe57c
SHA2561a11bd105562b9511e9b161fd63ddeed2de0ea54eae1b0d3ddc1b9bb0ee20482
SHA51231080684b692ef175096c58cf14d48f248036ea88df7b53834eefed07daf70b209784800ade0b9a7c67a2f8f3f42164cd812cd1c867118476d8ea1f3322a45b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f4effb21c95884d1004eadcaba2e180f
SHA14fe7251a5d37090a7d18e971435a353af504f60a
SHA2565df3a9e0b498008780e54dd8138c767c958ce41f5b2e24602033c9e3fc614fd9
SHA512b560d351fd45a2b9f5212788f6a7f632fc146d72906a3e3fd30704244b6905c3b93cdfcbf212594e057670a314b2fdd0dc9307295028c83b2afa6480908919da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD583f506f74364560c1c876ccf8430c19f
SHA10b809f49162697ab4b73ff11c2591baf03fbaa69
SHA256932aa9320a20bb4ff47ef5b78853e913f7b3cdf148522e19bd7d19b73b29fa3f
SHA51270faa74d7d2dc755a8c85bc391bc5025ed7f110a29f279be8262a15a005dd6cf23e925805e6b7e224c7423bb0ad0e0378ddde46bbc60879fdeaaa2b04c83268a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e9174164997e17df0383495cf8c6707a
SHA1c67f6ea6c5d833542e7e79fbbdae979a5cfdc5c7
SHA256a0e2a5c636fbcf8a1475bc7b1f92dbecea01004d79b594403cf0439e80f769f4
SHA512416a73da7fdaba99d0db19266dac3d827f5a343745776a2332de3e793e48d557b4a3cf2f6cf708c43850a51f84b90454d5b45816884c441ffb096b2d5698fefb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD519c3b4c7ade327a4aefb6bf63ad08118
SHA1c3063db5fc8e5ec92e36d3a9cf722119e2c41548
SHA256e38cc9da97db9ffe92ba9461aa5f715e52da015f5bed62e52850894bbcf2442e
SHA512348d1a712086de299b986309cbf6b4edcf7745c3c9abfb37fa1716910219e6c8b83c489d080edb19f72e3d31dd709888d03d7d6c2a6d2c5286b720e2088af6bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50ac7fa9de9ef620cd7d4a1473f1aa488
SHA18c5e364d0120085113595c3e492c4e217f914b22
SHA2562d47843b69809a90913514b1f2eb9a0ddb689baff08650e7ade8574e498058d8
SHA512c61c965edc5cd38b4a03ac86150dbc8901eef78d0807d31d3ce08969d5453587de30f3f576233b986debe8096320b7204c488b530cb4c8b855d3ae98a84e5738
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55642a37acdf81d78422edca2a5e96385
SHA1d22fbbb3e0779da9a860d04f7c2754c6aef382ca
SHA2563cf414d69155781a05065c00464a67be23cf5f93a0f6071ab0309b0d543d1bd0
SHA51226a4e21619ac6ab7b89181d57fd1a6f7f2ae5327694499368b847255f9c94d3a8dc59042a18acd9b937cc386124daa4df9b80b398b5fadfa65ed35496a578682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c5d3341eab23adbb33ec41a9ec082629
SHA1c05145cbf9267fd79cecd24ba0c98e37633fe162
SHA2561c7c42513cc76079ddb26819d640b6f7d6c8e29e082d8c4eec495b1bd0121105
SHA512c4c9959be7d5cb4661b28cd3f1c578d477a2953c6e56fa4429538808586ec8aabf8e35b0208a4da0d43a85deaa0380bcd0987400a45523eb78cd225a1601233c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e2902cb31fe3745f3d9f399dd0ecc79f
SHA1534241d8b08ca864e77e50e824f529958a821c63
SHA2564fad091c3cbfd9c8088159dd70c495ccf0e6a79ca75586bf7ac2fd168f5443f6
SHA5124d415c67d3c42c56957767d054e3ec21afbc8cedf314f2141ff163a1b028ee7c1bbfe6290029d18c03240b7ad31012df0fe879607df2a1384625629b7ee8a684
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f3cc1499c862efdc4de80085f3571f10
SHA1b59537e83ec1d8206efdf5cf8142db455436676d
SHA2561e94557150724e9d930dae5fc0719841ae85c518902508c3f17aeb4148ee8cb7
SHA5126708363a9e0e8aa74b9f6b54634e1da5c4e225e4ed9ecb3a73b579d5a24991fb2f5ac995671ea658e2829b71e0af3cecf2e250824026bd773d7967b9b6a8ea61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59914280aa2f4fe5e38c5d296e2c1b188
SHA1b9e65bc8a3e74b07a7fab0d0d75fa6959421c5b5
SHA256dbf0925d82e491e902a202746a250837f5c91c1e044440fafce5ddc28579cdc0
SHA512e951bdc852ea9a940757d6ea8b610c19136a2c6015cb887c1b4279fad55d9487c3d28a1052693a0690bd95565c8efa90bc2d433c38bc5377c5c1a935fc577717
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD547c569ced7385cc786d7ead183e5dbb4
SHA14fbbaff353bcd13f642592b9cdd15a4b1d95bae8
SHA256c46bd634f5d3f41237cc0cb04955c94aceae1783658cf61ac0988486a53f24a5
SHA512aeec893221865029c9e1116bd7e8fad744a569955de802282d1f6339a5774761958d56d0f008632893dab8fc859dc3f4c77c1d401fa801c43d2782c82d185fe6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5aa22a408f435e045eda9c9123fc4aa22
SHA1a2ac9255462d93a441f78bf0a65db8f0facbd1e5
SHA256b7a36b56f955e9d3f5e7a5624abe2744854c0d0fc50e1bcedeb24dacc569077e
SHA51211e3ad61e94cd467cc85bc93e545887d852ef0f0afb2080cb423210c647511600545fbe195f89701750f672a8631679e9a13b40bf21aaad04b0b9f765db29ee4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b7e86db5fe2548b517ef2886d90f5f95
SHA1349bc70e5d927e4e8291d11afdf641584c247c12
SHA256775fa005ff58383e3a1789ebaa83b9ad6db9bfb440687dd6f6ea8c6caf531935
SHA512b2a2d5ff0e646ed20ef2feaa04add2dbfe6566b7cb3ad73ea2cc1d1bbb98816c7f43ffca39437a8722065ae825236bf9b780c9bbd8caff39019e65a5a27dfc65
-
C:\Users\Admin\AppData\Local\Temp\Cab8DE0.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar8ED1.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a