Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 13:07
Static task
static1
Behavioral task
behavioral1
Sample
6e9cdc0bc11872c662485dbb61473883_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6e9cdc0bc11872c662485dbb61473883_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6e9cdc0bc11872c662485dbb61473883_JaffaCakes118.html
-
Size
42KB
-
MD5
6e9cdc0bc11872c662485dbb61473883
-
SHA1
491ddd16b4f0d6bce7916d1613d49e56772eacdd
-
SHA256
8d20293290672ab103113eb1a590ca1351a5ba73b53304dd7d16638668065196
-
SHA512
82b7f3ef9d532dfc597cbfceb33c15f31ac0a3bb12c543a338ac328a4055e3ffb13e80ae1b1dc11f455223d24ed80b2cf6a17db6e4f3b2e5f7d0071d0b9f66cf
-
SSDEEP
384:IZCx32Kv8dSDu/G1THSG7dfiLcujY0+FUUU6r7S+W3l4VRp5GqMHoLlTgCxu2G:8KkdSVTHziQuAr7Swd5GqMHYlTgCXG
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422717945" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008cc3c282b18dfcd28631bbff49743c5bbb772a0fce2773211a79ab11052b3a45000000000e80000000020000200000003709b531d9bcb42b5caeb2345af9f1347d447068bc5eaa5b4dfc606f522d4637200000005a648047a2e479d41274ccf88bd99d180e3838af7df9b9be9276afa9393478e940000000a8157d1adbe034fec38a215771c24dd73e730140bbc098d9f116ca776d8f166cd61a4f4cbc5aaacc062f97b4db29f1da9eca75670f128b802035c6520d1f3fcb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A456DC41-19CE-11EF-8D12-66A5A0AB388F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30aaec78dbadda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009e21827f811347e57b6ef8fed353c757bd915f3df7930f89bfd4b3e6dafd67e7000000000e8000000002000020000000ebf1182d3c4c48f7a828c64d67081f27503c58692f9f7cdc320503f2ab879c9a90000000096f80881309c1e947cf047afa2098c0619d1e8d714a925ab2e989e103e2bb4dcdfe2eedc50be5e89c9602a1d5b118ed367403440b9973774627d855e9737285005935476a3ced07e823572856ba0a0dfa58d5aa1050fd4f479720e7776a72317b97b2e6a22d099cf7fdf0d566bb5f5bf8dade791cb0a81e47c91e674ca5e1bf9eba4274ff321bf8121c8b076f2c6b6940000000fa7f4008d27c7f15f82cd822cf017cd61d91f0ca2c360386ccdb624b1594c11cdc1afaa012fc0186e6c69072c31b492844dba453d17cb379ffaab04b1651bac6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 836 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 836 iexplore.exe 836 iexplore.exe 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 836 wrote to memory of 2112 836 iexplore.exe 28 PID 836 wrote to memory of 2112 836 iexplore.exe 28 PID 836 wrote to memory of 2112 836 iexplore.exe 28 PID 836 wrote to memory of 2112 836 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6e9cdc0bc11872c662485dbb61473883_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5807b538e91e087bbfac1da448ebf8fc6
SHA1c94f246253bfd9dc72e98eda613c6eda2151ed32
SHA2562f2ff52470af1a0359ea7d843ac214eb5c25151a569bd1dcfee78525f0ecbd98
SHA512ff397c0f00a80c0b9b57f4b358b491d528d9d441369966eb9251aaa09bed50d74ccc03636a589c7a52be55c634d13cab0f5d54678e6a261be6ef1b9beab484ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5264ae881d28944e7e3c5aa438385a130
SHA1c6ed836be372cf8cec2867d283003ea10e074e6a
SHA256ca2691c9e6c25bd6857981b95b1221af556d11883c4c09a097c39061cfc4ea9b
SHA5125d7c99e7bafa4c3372706b0f00547acfc88536b7cea00f24e83175882fd9dfaaac87b2bf76939da12e15a49c0e4a2fb0f7842d2265b787e40094359af5099169
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b7d1d1c5af3db2aaf00a7de4e5eaf32
SHA1fc46fbde36a173ef1223caf21387a715e8c5de23
SHA256524cef4775fa1429a488472435eefdef8e872899d481026e45e3187f084c0295
SHA512cf5ca32f6254abb1a2efa10c74850ced584d13e3bea9c8178ba254271e9ad72651c349fa6c9570f461d910d9beaea3a71bb0a2e1d40dd052f6d641fac8700e86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2b96f52fa4fb0209b03b0ac3769897b
SHA119ed46296de9286477d7aea33487cb958e38b68d
SHA256a18edde86d54dd13a3311ac107640e9b0f9a55e6ff3e2958558b79e4e8aa14e7
SHA512fc4d85b50c834bf10e524fd5b0c868ad6e3d0acba743d541f24d1cb79c929cb96a29921f488fe48fae03b9993cd9645eb49f853836b8e7157c790e40952806be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511ba6109d65704e5010535af6e035895
SHA1748b825d748c505ef265cae5837d7a8daa9c0d6c
SHA2562f8c2fe18bf798938dc5364acd5fae5c2c6c4e546ff0055d0bfc5edd356385a0
SHA512093b75f2ea4d3a8f9be1cff85da805bc0e0fd5ba0d335f1c9bd3d9d722e4722e41c215bb0e8c54b072fd3486a5b8ace29b88e18a407b2727062399f942a941a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c91c1b03955811660bbbb555dfc3921
SHA1768f304c90b306efbb89721dc9d1176b1910bcab
SHA256ade235a12959792f6effea30531fa93f2b1a7bed82e0d0bd304defd5deebb91f
SHA5122f3c25c60deb5f2029d4897843c731ff6b97410beacd452430aa0afbb80cbb4b2a978345b8bc4af1b81755adc984ca6f997ba8a70bd0abb53751a2b0568cd8e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587e626d717982d7574363171a3c2a76a
SHA1475125d2211f7e26628eed6ec44172ea391f8f60
SHA25600e54063192632ae7d5721b4d1cfb7ada08720b02b970aa87104b9e82aa4ce3d
SHA51297fcf4c73f3e7e64101f1320351b8828c29a514f2b1c0f4d384c293e41b6cdbcc6be8ba99bcd4ba8bcb9636ece80e2595c380c07f7f6fefcaef3b82b58485536
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c8357ad6c7652acbe4e35603779e918
SHA156734070926af0a508daf0df06494784f4d80e8e
SHA256230a0f42a6fc644022019e78f9006b2878dcd2e0f9756459509f6a1c97206c79
SHA512fa9d6a63b25b86d99be356170bb1f4073f317c3417bf062bed944acf22ab27329761b019bff09f0e78b0f836061cef243db476044689ce3b47c4ab7d84cf3cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5663d9a453c1025b61b26a15bbb6a1ca3
SHA17716ec2ff758861e6dfdf327ac671e1b7a83b771
SHA25666e9a4e4248fc5c5bb975c8d92a7cf6b19eace8e80ffcfc748508aa10fa82c9d
SHA512e7cde5d08398bd6c67f70c1a818bcbce02a4af106b71e14b42118edb1c720a5d05e4ad7b4f219e8659f091394023d6521d45d100176ee3cfc89a8dbfaa19d80b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5492123e433f1633365f78d1729ce2374
SHA1e626cf7a7e9e6f87c85e0784093725e8f992dbcb
SHA2562c15f8e300f0966106d7d0c9226152d15bbc403afcb745d923938f5673a14f5a
SHA5123ff395092a3e4311eff5e3ecd3f4bf8179ed7af4cec85306d681fb6ce5be6808dbda5e6f80e4d3d33bf88a6d1100f5aa331af0f1d3d086a3ed8b4ef5c3813854
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556ebd5ba3f636819cf495de7c5ab3263
SHA13c3cfdcf71c9fe7a2a2922259cf488e475c2a8a7
SHA2569b898f3b3620cccd7b29ad2ca57b986fbf6422e9a5a074b3a1429faa5762bb13
SHA5127327cdb1f7cba5dfa04a89c3ebad2cb83cf3871e4c4c270caa0ff537a59524564810a6439c065e856ef3dfd115233d17eb4cd38f6c0bfe5a408dc6ed522d39b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598488ddc5910864d2f80bda3af5cd04b
SHA1bc943b2829808565dbf11b6e84723be5e227c263
SHA256bea884ee3bedd4a3e8703e9d272fb606b59c2279141cc21c2eecaefeb126e7af
SHA5126eacfd25da7a35cd6c3a997df21b9ac6c043c7e37e5c5829598af96112400425c8c8dd0901c1433daa78a276f0da4692e4bdf7dbaf58c14ce2892fcc6296fa2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3640819b9e99f17a16166c40321aa53
SHA129016254153a8e2e9b4af4bb5ab54b75c586ac8b
SHA256b525cf7a9e651ec5424019c96699e86970276311df72a0c2315f9fec427878a0
SHA51221224c1aeb23adeb9e25dc0b4b672a6971bb2b293e6080cac63aed768b457c54184a8c7aaa10c6dbcfda568cdeff8e1e4ea8df8fa269beb412790c5de24b03c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5883a50d722dad2a197f1c736fb6c9aa1
SHA16a8c5497de73151e8e25135dbc4688adb1defe46
SHA256ce95ecd3eedb66618492055e3562d2aab5ea4def072bc0f2155fc6305b596d00
SHA512da40dc240fea506683a84ed69b6c302a0942135c45723a52c0cbd6e6ed76af892c20b94349db4f9d76101aa84b4171de332510f7b864ef5ddc77cbcc6b26336b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac10b98177888bd8af82b92bd646cf90
SHA1e1631618a9135442eeff9ea2dc6222a1edf842dc
SHA2563fa401c1cf89b007c0310dea76866616ca2b775bd73d838854dc0fd384e74e03
SHA512aa71e8a0bf805432de58d2018fe07ad7b041b092862fa3473751dc5dff05b67c863a6fad4d12bdc0744388385e98855b105dee4d802798d5880d34acf0cdee99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc2b828be80eaa497e4a40161ee3fd6c
SHA1d91e1fadcd3fe9bc2660a1965f939d6cb169d751
SHA256a2b73fef5e4e49f34471a33469127ca61994f94771b42bf421e92e1eaa7d4e29
SHA512c81f76af8b779a6d5e39fb194a69b18a805dbda1ef8a4a2e8609697c7d3069a31af14f8e573318a9a342a4d0e2a5c2bc6c5a3b09eee74fb9366bd406dace2c22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526aec9994af7cb72b5c979eddf0b4b67
SHA199141d4d2e91236fdf08a37c3e18949c85365ff8
SHA2565000506f1ab5a8ab2418be84853319b0ef5c3f2251d00f2210fecd5e8bf683f1
SHA512181cd607a1d8bcb9eebff24f5404a24a820d0053ebf06724f71e4e939034d48c9970ef7e000aca1e3e21c2bbe580418d7c58b4b81789db27c8c7aa9ba22c8da3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d18a6b6c38395f99a109c03222e2bb19
SHA10d4e92d3f7415c4ce0524d92e8681c7142c22d32
SHA25607ef888823745c9a67e464d9f696ed993aa717fd9a1abb4f92f33e80131945f4
SHA5129794e55881087d79a22bd89ea33accf5819bd2966d2fa8c8a9eedb9d865730cdbe8e25a81e9ed6002966d784c0091197c85648900ec89aef63847895b065fd2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5316c4af265b08b43390872410002bbaa
SHA139b51aae660bb716f68c55b7d61199fa092d64cd
SHA256cebe9d7817c035b4fd27930a52ed2584da28669cc1fc629bba93863087143d90
SHA512aecfd87e115ccee304c5ecef212bc87b17789e7528e3cc20b5ae4f75380e4846805e5d0d5a1ad96466268c3a823fd8b0d62d884f366a7a9ff09ea40bce75496e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a