Analysis
-
max time kernel
133s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:20
Static task
static1
Behavioral task
behavioral1
Sample
65d515142d57ccd2a0db23857d2a6baf_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
65d515142d57ccd2a0db23857d2a6baf_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65d515142d57ccd2a0db23857d2a6baf_JaffaCakes118.html
-
Size
32KB
-
MD5
65d515142d57ccd2a0db23857d2a6baf
-
SHA1
b182b146fade556c7c9fa9b34067f61f7f422bde
-
SHA256
621265bd24bd1a461afb6bc7a4e957644ae2be353b036ac1bcce6ad5086982da
-
SHA512
31615e056b80c9ba66c814edec792f324834508e80bd5518a9b30086924f1842075d97f72c0208f46e9412b14eb0ccfcbbba3a76e3b3895916ac0731f4372e5d
-
SSDEEP
192:VWCk3GDG7GSFGNGeWqGUpGtqhyzjb5naVk6nQjxn5Q/YnQieLNnTnQOkEntEWnQP:ACk3GDG7GaGNG9qG8GtPQ/XWSOEQ/jt
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f58f11f7abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d7341fd703ad8aa9c3566c8fdc500dfa2919f1feb0d4452b73346114a48f7647000000000e8000000002000020000000dd5cbde82886187990dcb1908818ea99d1d60a31590cc3bb62d0e52c8f14f456200000008f2d5d492568049a9051662646da38f430df20637e989ef307a42bb5f7b496d340000000e829bacd7777247e79fac43482939af20944ea6b17bc94488d0544a95675f0b4f4d657a3bb275d8a3f38c31742c1bebdba6e84b4e7d88a01ce4e50e0a8860dcf iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CE41F41-17EA-11EF-99F9-4E559C6B32B6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422509895" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000eb2ba09b5957781884f9b2ff4917b49ac320c37ddacb719c18f407a8b1077687000000000e8000000002000020000000d3eb3a57aabca04079d5da1427d6cbc13191e5e08fc88fb7549a4d229744fa4a9000000052425700fd9a15469b8f783f97bbfb477b3cbf1aff276c6ca8f5ff6b2a1f59d1934d4cad351d6a1295be4204c60baa16650899ddb5c30047416f5b8ea60626aba9fcbdcf3d845a7fba1d95e5a0d7a04a69250c52da012c551f85ed2abd3475de440f326459f9b68fa82a03c7680b78920c125aad373623890a3ca12c4ed0c88b368e79b659dce2bc3a5b825bb1b15d8140000000f2f27effef5702fb7f76d72550509b87fd5b1f3960ebc82462be7463f92b84d1e84f2fd6a98d18a47caf95a3513fcc93c5d6fd090232456d75cc53ef8d6c8a0c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2424 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2424 iexplore.exe 2424 iexplore.exe 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2424 wrote to memory of 3004 2424 iexplore.exe IEXPLORE.EXE PID 2424 wrote to memory of 3004 2424 iexplore.exe IEXPLORE.EXE PID 2424 wrote to memory of 3004 2424 iexplore.exe IEXPLORE.EXE PID 2424 wrote to memory of 3004 2424 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65d515142d57ccd2a0db23857d2a6baf_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bff093a37f16037445501036caff61ca
SHA1bac57db36f3f7abaaded3db119e833b8c3ad5cf8
SHA25607e169e08bf2c62ed68c1a4113efa603fd5f8a68d5a9260d75f9e1bf00c95070
SHA512c8524c4518e7c334ee22d2cd904c2ffa6427994fc3a3fe01c7bfa42792270e20cf758e402edc225ed07df214295884a6e5e8f150edd2b77a9bd5d2f89f38aca7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543b4d2e3fdce12dcc5d361ed4a84fabf
SHA14841d95fd98783cb3014fe8e150a516b2086c498
SHA2563edbe894d3eb306d1912fbc11f3c44d8b0497e4e20ff7b3dbb28975b0161299d
SHA512a7ba5488106c4fe905a42b25611fb495b8acdfe241952bad4322855ba9719c0612705e85f2003aa07bd536688e21b916d0e9a01585e6153b100509863c6db6bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa05bcaaf1571051a547bebe76a3d18e
SHA1eb3cd53086e80258712a65c0be50fbbfecf2a5db
SHA256d2aa86ae3cbbf7615286542460f87cca482379603605379cbbbb7cc1dc699bbe
SHA512ba82f08db7fad5c7063b0182991dbda1e5cf2764bbea2e40fe832e8c6168296b6ff003572546c2f2242027d0a398a578c743c10888fcf095afc2efaab63d607c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5b290492f23d72b609069c7a34169ae
SHA172a4ff1ec746ca63d29076d16a886a22d8edbb47
SHA256bbede48ec2bf991380fe7400454e5e7a0a3a41f89d066dda01025362d060db4b
SHA512286d205fc646b429ede543fc1a044f0bd4d60290d783d3fbd89b81baa5acd66019d2721ca0a98570bdf6fce4cd045fb84b5cbb08efb208265ac4e611e78cdedf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dd19f766242407fcb7c435688e64ef9
SHA1af18278baa85f7b8f5ef43dac02e0716a3e84cff
SHA2569240833d1c8c2e42e4a7070f24aa78e799ebdb8ee24c0b91f7ac429cd82242fc
SHA512d96ab7b7c1e4594a427ffb02da958186653473e6b42cb5b6b9842a5fe687edec3e77a0baf812f3992540c59e0aa5db4417db1063976e8b0a2e4c6cbdd1a6e323
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c5dbf99d2f585c54248ec505729d34d
SHA18405c2bd1d3050eefaec30cd6f7804e2417a1ced
SHA2569a01fea0809216884b7e5f541345e0ed74324fc738196634a72d5f262e1aa226
SHA512da742165575202385464e8c1ef65e98d6fc172037c90e8fcd72e9edc169bbe0babbe355a4317d46f2531d05eca278ba2f437e1d36a7e5e30cd833d7d7a557e32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7d85eff6a29bbfa62d1d0228999862d
SHA1dd88282c56f6fb5a8d7698ff5d7276928d6c3599
SHA25655b787ad7cb8a63295f62338755715be93c90ddea80009611b44def175ce407a
SHA512de7dee480c3a47eddc45c45bc18a950948b7bfa45dc54e15c17ab9c571c62156064afc722d475796b6153c273a9c0e46e30a1a8030f53898bf449c28ed39f140
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ed21378cfe8cf681d3d28f92e74fb91
SHA1701a8a84e4c419fde46860357649a898e7053db9
SHA256b221ea526968b6ae2e97dadfe961ffa06bffebde2940cc81f81704accd4fbc2b
SHA5122ecc23e2455769f3c9ba562d6d3bcf0d8fca86aa66b990f9b9cd8a1b2326ba54b76124df3079291218be6f777119478278b77d6afe3d17b23d1762e99c966535
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55927e78d488f7d70098a9f81bbc2ab41
SHA14644e86296873fa6fdc5019b618672781ed494cd
SHA2561eb26d4d8e78a1346e12b86d446ca3223bea874b724cefff50c40cedc9df13bb
SHA5129b595840971fae18921becf8dce58cdba3795fe15e54f9c9f0a8b6625acfd8f421a1065103982d46b35307ac2de65dabadc6bfbb3a39f2810e6f82340f3dc886
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a166a031a4acb0edef712735bcc5d27
SHA12f58f045b1fc659bed2d090f3d6a8124d82179e7
SHA25697b3e40405e1c5d6c569565c7b3120039d08a64dbfb3ca67c478e0bb54e55a7c
SHA5127b3cdaed693667696a9715557164707ef988b8faf104f3ea70e15c037d468591ebc5c212db3425356e4dc5a90faab7d145146380d030139335c6b391894c1418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53713c9ad6205dde8d68b7fdb88c7ca82
SHA1ecea589975d5a5c95fe307dbaa4fef1d77f6a42c
SHA2564b86bd8966d31469f567fe99dda501d640ecd30c32af8d53138d073a4ecf5ea5
SHA51242f5e9805c0883a3ba8e107db64a0cdceed97af81ad309c796a63c64b3ade2f8ba53104a9cd1a63bee0a8518fa916ca898ccfd5ed9e2836a09788956c49d7d59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54483c23990eca3d67a87fcf7eefba1bc
SHA1c24e4933fd7e941b2fc00143118ab5a594618ae7
SHA25606ce5d283d19b7a78fdcfeb63fb4450945318e7999380cd7c7302219ae6532d6
SHA512db05b74f6547dcc5cddaa4121403b6761ad5c2a24a0213bdd5c6bb07b3f85731b761af60c22e4593c915ee6ec88043edf2f160a32b3eab6b667b170d81f3b330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c439b82765a6628655d3912cacf42bdf
SHA1f08bee920befcf8c0db564d36a2d1a74702a6d99
SHA25691ef28f4d64cb2632a37d861349b44a9a12afacc18a8f6a46910bccc3c9effe2
SHA5122cc4349492d90573a7dd8dda2cb8b4737faf3cf59766b69524124ed1425dd13da3d430205273e510171b0bb103d246e149c22d6da5d09fb8e965d4181a3a3138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a7132d1f4c3fec8716201f9c206846f
SHA1458e09ce5ce675280cf17319f397a05739b6fd64
SHA2563080c6699715d7e63330ca6e9f2b0384118922b512bf3c9ce18215155037c42f
SHA512736fb7710edc05dc99f757dd8ce28719001b32e4ed8ee56741b04ba92108b61d5a4327d2eed85d2a1cf7a5fb659edddc8ed0640e6ee1b9f92c656a2859e3fd06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560f507f6497b727b3c5a1a0e42dbe374
SHA1bb99f7ade3bd37fb1cd2f75025153a450790c918
SHA256fbbc8e2f8dd8450363494ba76060448e68d3419c976725515cb81584bca493ef
SHA5124297230eb6c5511fda0f9206014aa84209e9b0e9a71fc6e041002842cfb627c61e2c999dc4cbdb045879809ed046ae75ed073e1e84acad4ec79b442bf64542aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a2d56ed30c77d8f31226caf6db56225
SHA13f9e73e45dec4b5a2943ca4d5dad2c90f98ab478
SHA256792c148869322499744eeca7c342c27b0e0d3914f576561b4d806ba60b483a71
SHA512ff1575a001a4e20b9e8139aea14ac21c0b5d3fb5aec4350475c69ff808c1d1d0619f0354871dc64914edf3399145e347acf3c84f35b9b57310ddac7b8999dd53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8d727d183b5488e748f2c9f8f31d882
SHA1eec4cc1521eacec9d52992dff959ba53bc3d91af
SHA256a001b10937b6dae42f62da933f0195f441d912de83ce770a62a53aec1058d16a
SHA5124ead91c278454cdcb00049aff1eb29267b94b82dcedcfebd1caa36b6d2aec8c80f307e800614171b6a468d2cb2d40c223e1f7eea054a85a0beeac32806cea139
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a