Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 21:45
Static task
static1
Behavioral task
behavioral1
Sample
76e141ebc6d6d0af9d30092e2f6100c1_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
76e141ebc6d6d0af9d30092e2f6100c1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
76e141ebc6d6d0af9d30092e2f6100c1_JaffaCakes118.html
-
Size
460KB
-
MD5
76e141ebc6d6d0af9d30092e2f6100c1
-
SHA1
3346e658397b4c0dfa33b03c68544275a001d4c6
-
SHA256
4dd07ca6c05ce3a57cdce9b8292896ea024fd36d6de27e75703aff1d2557f696
-
SHA512
c61c9646ff809ef0503a7e5bf6fb0787913ef19e34fedd9ea7a559b465539bd956c3f3a2698831c5598ca01a81f3deda6b715f07e082f6138ef1301e4d70356d
-
SSDEEP
6144:SbsMYod+X3oI+YCsMYod+X3oI+Y1fsMYod+X3oI+YLsMYod+X3oI+YQ:i5d+X3m5d+X3H5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000ade7ee58c6f3a7a2d056c9c848de0c395c5e16c7de123713f0bc15d1d4928081000000000e80000000020000200000002fd0c3c505849ec02073c8f7198c66a4bf88048108d6a986a13a971195db2f35200000007c8dffa6d528256a709c757f383f8d0c5dd8a0a3a0275cbd6936b579f99d495b400000002c02af2ee8f69b823498cfa038e5b1f42ab6103e5bac964c8746c90563e6caae9ce7df22f2454b96669bdbf656754e0344ab855aa01ab6fa73ae1995db9c0cc6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FB2EB81-1BA9-11EF-B8F6-D6B84878A518} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0664318b6afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422921787" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000001950f526fd3a7865ba57ce0910bedda7beb977e773839331caa242adce140993000000000e8000000002000020000000ae7efb536aeda8b8e09408259b03eaace40e6834ec310ef11e68361de8797917900000005744850fe4a832644f9d4d15579b736dbd2b32457b179fdfabbe60cc22a525334696746be3d4e6120c98ca7893871f2989f70b0f234894cedb5cdebd1eb14e11554d5216bbccfc72d2144fb4ff6b6c0b28322bddae85e94b196951bab7c4cbc35018d9e1ad30608e2f0e9171a2358670fb3ec15dee656b21fd446d4235f74d47f9f532a90d656da8fa161e820c68318940000000cb89759114336e4887fc80c9c1610a5444aa7d1044886afcffa88636411e93936cada8002fc57a03e18f6c005d52743eb1360b78357b8f0a1398c2a091c26a31 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2984 iexplore.exe 2984 iexplore.exe 2932 IEXPLORE.EXE 2932 IEXPLORE.EXE 2932 IEXPLORE.EXE 2932 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2932 2984 iexplore.exe 28 PID 2984 wrote to memory of 2932 2984 iexplore.exe 28 PID 2984 wrote to memory of 2932 2984 iexplore.exe 28 PID 2984 wrote to memory of 2932 2984 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76e141ebc6d6d0af9d30092e2f6100c1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557d8dd1f34b505c8b8ff9f6be1c57d39
SHA12eeeba0e9c6637ea048d2bab41f2e4028dbe9915
SHA2564ed6b2beb31c67ee572ca349cddbc0e68f40b299c86d741f115be70d226748e7
SHA512715b10d42f4229b5397c3646ed9eaa416675d48033007ab7ee4ceb271428f8baa6f25f813baf5a53bd3c645a932528d0c16be52792b60dc77466b3139e457286
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bb8ca15be24d866c5696c29091653c4
SHA1312277ac030eb50e687ff23868e48395521c3773
SHA256348c1d9cd114fd8a92687c37664949fd6f7b3e430e1559d69ca9a94cd409f4e4
SHA512d49fae4c79df843a8a51ded0a925eb7d6746066fc19d923bfbc6377b79b3b5025cf4a9aa1441459d591e47e54332dfa24bedcd0ef972bf4e99a2537175a69e94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556eae0300cfaa92b55401b6a88d74ada
SHA1da5de5645c4fdd76b0c26a5d06dcda86a0c5919f
SHA25611ce008d80981f60c85eb55a66a64938b40c70af15b0d307e82e9e8892cde806
SHA512568bfc7bafa40f5c58816be4bf76247386ecf8490770b47aa61cdebdb253989a4f44e4b5e8bcc77ecb78fd35f708e4e81cf505664afbe6e972a972988edce332
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d286e04d6e4adfb2556bac8f4cf0434
SHA11248a321be3b87d751ce5fd1a6332dd1d5a53050
SHA256a28f2ebf0bea619bcf76278722b8ffb5993779df44c42f92555a90d9e827ee78
SHA51226e8e0728ee6b137942975da35573bc2b78b7b815e3ffb90ac54b54e41e705b4b3f2ef72779bb5c7c794b0760516d3361c8fda53725ff5b2b36496c553256e7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50466a8434b581fee9952b704613c1dad
SHA158753173339f12ade2fd77067e823320e02731f7
SHA25672a93ac61f63847832c094ef9bbcbc6dc0c6b94b558273b17e42b506e81a58fa
SHA5123792ea5c91189e8f83b6fe1a05bbd53e59387e04f21d923adc1dbd177a48ff3cdbb68d240edbf6e8954d7ba5d823530ed50568b9d4c66dc062fa7b1c2941f5b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de4ad058ce3736ad6b6a54503e57103a
SHA1c68ec2a2f5159e02bf68004f21a85b35674c574f
SHA25648d0c632548c6768de1cb606309ccb883414d1b62eb609e68c197dfbd76dc809
SHA512cdee6a5b723eea197c70b353e3c9a3cda8e0b77d313c22b4a0d75646341ebca75cdc3a43a8e8dfadcd991b64a2c0078f09ce40a5310b1e157738bb6f49d067a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c937fb6dcb73012dad8d8431f0621284
SHA181535c69f040315531e3a341e2df674c817c80a0
SHA256cdcddfe9ff7f201a8be3c9800c100f46c569a05781d5bdcc5c73d7c992902705
SHA512df30d44cd949ac6801e6f6461f190014b2a1c509859b5aa5ad1d0ef2e764c591fcabc79c38b1ce707f6e09ea31e028f0b9a77b69e307ed68a059162b398aa143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f27e62db1180ccf9652631d8df0304d
SHA14838b19eacf1fc510ad7e940fa6f8d0a4768f17b
SHA2565dcb212ef191cc4bc64349f7786394ad7a94adf55e36fe6fbfb6c0f05b85bf63
SHA512618304d62bdb4def41c593775b308c191a64ce526d8a901ed5fe71ae68fbedf056ee7bc757ff29ef3fd0c1154dbbc92c3505a2f503e9de75a501db1b2ddb7544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5355399011defc41987d5f4f42bc18468
SHA15d013941181f0ab7ffb2ee3f3ba85ef4f571221a
SHA256854a35ad89a247e567464c7d6b8d1e1c42a5b96df89597189327c2889debb5a0
SHA5127ec4ccf6a4f3aabd6e39c79865c7de1b0fea1521b3ba9c3d34530330a4c8425e4578c37686e25ea811ac345e789a7ff503ec57f7730bfee3464544b52c74673b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbef66bbb0cd0b0181e293b3716412b4
SHA1fcb4c5363d49af15bcf9b7456d8385e2d4375522
SHA2560f35aa8732c0d0c85968383d9eeca93720d9aaef2914634e45f2c3115aabf8a2
SHA51230f747e9b99c1faecfd4a8244bae1bb35fa38857ad6bebddb7856874fa3d26aa81d156e2de3bafa6c20a6167e4246aa28ccdd1461f6e9f9553c1a91834cd3339
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c2e436ddf5382bf10ae2c252d417a34
SHA10b77efeef8e42c48f898dd241513f3c0f268feff
SHA25622e4d04b0e94d9b5035fdf6837b8e5cb77216230a032745e66343bad03d29e90
SHA5123b5f8e9042fb9f4ad6ffebdbf0ae23adfa632747cc029e610ac1cbe7c8065a15f6c8891aacdeb7b81c3d5ae52ddba6a650943d3b65a2153a01c8753f182ee803
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595cfbeb3a77186b33766472dde98ab69
SHA1c8c79586dacb1ff09d0bb74a2b777ae82976a4ac
SHA2561fec4b83302f715e88cc354e96139ea7226701f9ab29649bd3029aefea0afe58
SHA5127caa928a7cb054e055137d1fd84801b5501c0330de6e59955e9aeee930dbad695818e4262fdd383f6b90fa8bea88e7583fa66c09d661d6e012a9aa00ffaad401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bffbaac158ba4fe91a08d4acb6a7e574
SHA10d3d275879370045a23ddfb05dc470cf2cadb544
SHA256385d3c234e79d61a25f1b03220ed3b97d7cb63fb42dd00b843f2d02e04984077
SHA512d951b8a9b27e66e2d801ba9334c2f12da407d6cf6d6e1808aedb1f2c0a10d2f55a20117ecbda3d8185219deea7e267a0edbd60f1923ec00359b431e7cbc7d585
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544bb63aeed324b44bd5dab31139ef7e8
SHA19309e4b3540fc7ab9614159b1c3c04c053dd20c7
SHA256040670dadebf1d7be0a5639a93b59103b82b07724f88a30dcc0dea7b628383e7
SHA5129d0400420fbf6129350d19281180676d477cc6616481c37a5122ba703dbe6d03f4e4b546c7bbdb3f1fd04b4052f0f4eaa7ea834f93959954c2291078b79e4fe9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eddd2c3dc43eedf33d5f4a8a065a84d5
SHA1a69d33f6e6e2d4b64180f9c77f3eef55ac242905
SHA256013228cf6dab62249f5d0cf3beb1dd770486505fee0542fea109c549cbbae874
SHA512a9fc527b3d03667861e022497948d377023cd0440db6aaf20cb73957e891e30388bce6abcd89f34bd5cacfa31a530c132de3e534f361fbffc2dc0489fe76f5da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b309d959c6d9a41a52796b6c02d9a33
SHA1933c49149c7106e09b889ac88bb91536bc989f69
SHA256aaa241ed93881bb09aaaf1e115aa4801b21c4c5f4c9ab24f171dc033b5b88e62
SHA512130b9a7d882c15eb79c5c263c91e91d7b231acb4261b28ae21a28f697466347b3ebfdae52f512768e4681a7df3e72d2be8b4d84909903e74fc2fb2970359ea8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548c9ebc10ac951a5aa3c1f8a88a61dac
SHA1058e29bd57da9ea785752960ac41161439ffe1a5
SHA2561a2d73a301c6bf7da49ded5ee42ff113ee5a7285c03521112b932ad35b8abedc
SHA51216eb1fdb6afee9ee992cefc70441eda8e9a6a190df099345f83467e9e87d7d013be6ffb78c3659e7c823f4122a9fae8feb755c66620f9be4c568e6f5becfd2ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519ebbd4fd637220a0cb41932e0e12c60
SHA1ac005b338489a9550695fe2db8dbef051772a8a4
SHA256d09f57f338bae965300390e889a8d782219443d4383059bf2c5151442c4fc07e
SHA512a38e250c1ddc694aca03ffa7dcf8f2a40154e475dbde11cf7a2ca0505bcd284d188ff54e61628976d1a8d5ebf1de2300eb0c0a6e7eb21a1d4892d3f8ebd2a42a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5222ae082b14a81cfa7a0beb8fa68753a
SHA17913d6f831ddbcb0b7ae9c4ac26958f8cd037ae6
SHA256c1630fc335ce2b651ce4664cf9676715601faae4e4c8586844c609466c59c8c0
SHA512da56f58325df7b5360c33be86f9b6556c7946d573c65d8bf11bd94b0141ff49173ab4637ff062d8dd030bfc5874cc6b63718714d9034612187d4c6e01fb6eb11
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a