Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 09:39
Static task
static1
Behavioral task
behavioral1
Sample
66d23e5d306000847fee4a3a52913647_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
66d23e5d306000847fee4a3a52913647_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
66d23e5d306000847fee4a3a52913647_JaffaCakes118.html
-
Size
69KB
-
MD5
66d23e5d306000847fee4a3a52913647
-
SHA1
dc97c5594b1f7600247f55fef2363e45a7320316
-
SHA256
536e7757cf7f4c505ddee2046d855363058a5a4ca0c66a6a06f258f3e4ca9f06
-
SHA512
d73f3ba43df290a01a80781f2a0b8f004af739325aba74588fb00a8f8fcb1f2e69615c5e3e95e7d52cf00a4e26395d24d13ed7cae8d6e2545798969197aae90c
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6s/6w673K7wioTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpq:J3O7672TzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D468FB1-181F-11EF-9591-6A83D32C515E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea526b08da5c984d8ae2ae1d465819820000000002000000000010660000000100002000000005e688f26dc9d26b4de9327fe613ef1ee72e80847e1c964b0e08b214b6502663000000000e800000000200002000000017675f12a0aa742ebf51d0595b0ed1515084dab9a809faee1df57f8822e2a05190000000ef9a2537d290aac77aadbdc5748532d5dc3d8a3695f7f9a06fe0c06afa60e1ffdcc10a5d64adb0c6335fd9006e66f6b7d0a8327221eb4d471e1ea49b7b396d61990afb54c3db4d0e0b7df58741b4f7725f385cd80985f281a73324e561d5dc8630830967c1b19dbe397fd1e7030425e07735edc064e309301c708a638914575ac33d645792da20ec3bdf7a812fbc584d4000000093de9b4705f58ca44ed86b02599caa0a66353030b49d0990817436a49d9255912123a784a8895397ca39041a43c075bec048370d3c866c27d5ebb5dca461c131 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40aba2122cacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea526b08da5c984d8ae2ae1d465819820000000002000000000010660000000100002000000007f578fb7613a13b30c026890f16023793a76829c1c6a24a926b2d299dbae436000000000e8000000002000020000000dd9371adb7737ff828f24ce313b360d02a0a4294bfb5d0ac732408bdb8424cf320000000bf75cef6e31085433c141a1b218ef2dd65e1ecdeb9fd3b13b9e5ea4ba77380a74000000049ff9a34222cfb33be4fca702eda1f93ed58254317e25b6afd1554107c80f31cdc09a57c7b610e219812192482ed1516d78e65e16e3e31a2a99a7cfc6c8f4430 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422532660" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2084 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2084 iexplore.exe 2084 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2084 wrote to memory of 2564 2084 iexplore.exe IEXPLORE.EXE PID 2084 wrote to memory of 2564 2084 iexplore.exe IEXPLORE.EXE PID 2084 wrote to memory of 2564 2084 iexplore.exe IEXPLORE.EXE PID 2084 wrote to memory of 2564 2084 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66d23e5d306000847fee4a3a52913647_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3155a4652c6909d9dfa3c407a899d7b
SHA19a91b7900ac813e2a3af204f7d78b8c00f088f99
SHA2562f6d480c7b17938b7c1ecf42c76a64f86b35e816045973eb689716fe5bae8e4a
SHA5126163d52b1033ae2b5aee74ae6b5b2f012db2c3424bcb3db65b12bdb320902fba76d405deab4753f0327f12205d4614844d91612f543f7d33998a33ec51fcb532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9832b2f058a2e8a49be297fad03763e
SHA11093573a1a8d87d2d402754c9f9b53acc8d6390c
SHA256c6e63c880b04f02cd3a9dc3aa72871156a5b7e4ed4a84aa18575ffdfcd6fb0ca
SHA5120def6775efedf132c1fa0e4a7c5825ef249c0ebad4f8211d61bbd936f67c846065644aceaf133af9abd82fad9a83bfab4c869a43aae2b0d5ed181cef9fe128f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5492bd6e41a275ef054a338e7e3fca7fc
SHA190a3d57d0fe187fd14a4df34939fb2a733d1a52f
SHA256f416d06cdf791ced63b9c53363a2714df859fc828eebf49543331ee4baa6eca6
SHA512fda468e316b3fa59a5e84e0010827cb72c144177298b70a9a8bbc7fddb6b1efb52b7d52cc33d73a4b4dcd82f221ee1504a0ff34ef7ae91cfe7d35575a585e8dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5caf311d2000a0975acc169d9f3dad32e
SHA1d85dd70951b6bcfa19cc3b9b59b8de48ce5a7314
SHA2565b4adb1e735db2719ef09b738f06cc02f3d788e7eb6e1274855e085fe391695f
SHA51222eb30565a1c1fb47b770b3fc45c70c9968c3493ad303111d51d6827fc6c9563f3a1c8f577d4d2a068d97f1648b8cab849785738437b37c0377c0026451fb881
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c5763d228ffcf73104bcc2a1a21a85c
SHA1f8ec634f97664dbf495021d545080030aefda651
SHA2564198b389eda3e6559b42c084492415513e1d802fa0b452e8c68c5fedcfe9edbc
SHA512b64d21ac3aba12e27486423530bbfc3f0a0b4a0032f95b34464a1baec8496242fc45dd178b079e91f9195a9a588d2972dfdf63abc38788d51254e929fb84ba54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55abad40d608db0d17bdbf79de8eb7d2b
SHA10787e60e90c26ab45f22ef420f90ac42f36204ef
SHA256b29625f251708c81cd7b2cf4972182731ca03a659ee1da3e9954fe3d39f74f98
SHA5123e8e15f97bab550a334517891bbe04d33c06395e98745c44b8782e8d6ee14a2c1dd813f1ecc01ed41c49a728b8391d7658b773bc5be058585352c480f7c34f23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edf91b9f411cb038525a1af05b780cec
SHA19c460c53bb1336bdae7d2c8bd128b37fac459516
SHA256822d70f6ecb62ca568216de26a74b26813b5b12116481efb5593ade07f1cb66d
SHA512b18ca9712df18d05c482c21c1e562c496e570df072b36b2f90e3be4706aef405a03ff50168b3dcbb36590fa620d58f84d412e9dc40c5f2b0ed0437d3f1d9ebf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dd18580559ab8cfdc2d4208bdea4e00
SHA1ffaedebe43d2661ead11563389aad72135994039
SHA256644673b4fac15f569761df830f3389a3a85750467f14d661971f158d4b08b570
SHA51235917b1255a3932f79bb4420221fb817d9bb7c7442e885b2cd4677f1191e1d39f83cec1810c9c95dd463724d3be2e0a6991100ff2093a686c0a97cf70e276345
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f059ed1fbf77cfcd5c5af99203b4e68e
SHA10be945763cf19637823782fd85cf2d241526c2ba
SHA2560c864d4a2952eb915989ff100d7bc442fda5b47168c633de1b5f74a468d9564a
SHA5127d56a798f80257c204cb3f351a08bd3b5eb2cd74a5409013ab8fa8a2aa8a72eb3c34403732ad2a80bd9dd6bb5bd739592471d3a0325b395d9a45b2cfc1030d4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519057b7f149f0c6bbfe238ff57ea17d3
SHA1f6dbfe1e69902db537b8182e42379e5acc8862fc
SHA256f5e09e254ad94a1fd75779a11ad37dce5139c28c67131187c4164060a37faa2a
SHA5120fcd9df80bdbd1c23fc55a49d2c0807ee4adaea824c976c58fa6abbbe6ce2a87d820c2e3ef21c0f7dfe29eff31b6111ff4695487dca0f29f651f66ef6b3de2cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd3a1a2c02a0dc3c7d61f97b3764f774
SHA149e4835a85d9c3f5432940ec7df9a5ed9de1d695
SHA256da7ea3a6df1025b8a914dfe1dab9af0bc6326ff0adc30a9d00a73a401638880a
SHA512ac188871c72cacc098895fb82843d20551b8b4f8ea2de3696cb5f520a16bf849bc4265a47e1ca32adb68c181b846a06e868ad2542b0c7ecfcec200149b846a47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510a4ee2fb9301ce3ae007c809c19a6de
SHA12ef992105c5548223090ad4d69e10fa9fc92547b
SHA25629964ebe257e19a90e44c3c0696bf2cfa315a53b14eb010519a3a16c767c5db3
SHA51211483c09d9659d9893d430385fac333aa71877c8e9eae10fd5580fc34e84863200fe4f2bd75532b075d9132a865a29cc65c4e2be7b479209a1962f7c5708d101
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c93490fdcb655723adfd6076fc1e51b
SHA1d07068cbbe57f9cc301473748ba15831eba969dc
SHA256b5a8ab30afc33c86baaf6087240455d4207f38f854eba0850c7cb53b665ce4b9
SHA51297f921ef11f5664625dc79c708ad3f169be6cd09bb0b419c807747b65989dca31cdb9a0659bcc7e7b3e8dc1d93bf089c35fe953b4eee95e991cab51acb3af407
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51331d14343a582a1dbacfdd01559d170
SHA125ca3c50cfc90157b2ddcb219d965100cb24666f
SHA256ac940867c5f3473ec52811acadae9a46397d424bc25712a04d527c778188384f
SHA512dc546779b70fc9e893b0cbfefa2bb10685dc4194175d4a6ded9b50d341cecd682c2201e76274a76a86048e76910b6326c5b62ba8eaf4b4a0456ef49e543ec011
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b671d1fc4ad995e98b83418cca31681
SHA15ad2f43abcf50cceed61bc85063ad47c5da3b91b
SHA256c64aadd7d904726c688d49ccba102b8f1ba45513c18f7fb604b4966023593871
SHA512558dbc52ffb8dd8f9c67ae40848e2fcb3d6a9ffbdf72fe416b2ac849490269fc444863c054b978011d58b7dc825e320d1be78d2bcd7be1c9776efec0c52973ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5662ac5e7b067ea89819d78639a440707
SHA1b19b7b3df1b5ca9832c0cab8525fd28f7ad59de0
SHA256016265104ee479c5fdb260870025f9a123520e2926427d7aee3672867a904511
SHA5123a897d55d40786b4baddb42295864f6128281b166161520cca63e9da5486a33077fe0e349e74584418ba754fadf1cefe321785891829512f8756b8ab125d634f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab56a127d038a80422e089c723d9d348
SHA159c377e2841549557db1ad18c83b7c3ae3175b7a
SHA25610a697598d02a350f7186316e0c3c3e24e8833ec498088317489de70b7350b3f
SHA512a6f150bae6f1e6f36c36d629fb004164daf89bbe72c294b5d433b4fc0c3286ba3f18563364e2fd7b1fd8a1c6b5f28279a7be161787a20af364388a0044a4b23c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543478047ad73921f3631aea537b38ade
SHA1092363b48015a5cadef5020974e0c65786ea2760
SHA256cc616df4295185d4d821864a8ca53cbc245f7c0cef7e557671b921cf81959894
SHA5126e5b47fe2c0133ac369e9853f8ce3a85d042772e776d06bcbc615c10c0d1fd2ad3b46a0b1652b535697c26ee5460d83f8fb8b215cc4806ad52c69f3cd5fd0afc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a