Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 23:35
Static task
static1
Behavioral task
behavioral1
Sample
772e91d4a704de7c31c65849f74f76bc_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
772e91d4a704de7c31c65849f74f76bc_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
772e91d4a704de7c31c65849f74f76bc_JaffaCakes118.html
-
Size
461KB
-
MD5
772e91d4a704de7c31c65849f74f76bc
-
SHA1
74adc5c925683752ad53ce42115106e5a457cf93
-
SHA256
cf5cc7b7d87b11c4198ac3192b6ede8ba3057859b1d47470c3ccf882962543d6
-
SHA512
9ca6639143b2a13a0ffaaf9db412c21b2b7f1fb00d65a9499ec80844fa3109e1193835da45c809907c0327da10084d7cac0d1a3bc03bc21be0e0a84a5b88d6a9
-
SSDEEP
6144:SRsMYod+X3oI+YtsMYod+X3oI+YCsMYod+X3oI+YLsMYod+X3oI+YQ:A5d+X3/5d+X325d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d04b1979c5afda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000e939594ecc6512e83ff52c995f4cc0187d55fcdba044f81796db1aaf28739e8a000000000e800000000200002000000039efc0ac82146bd2ab549715f6fc46eaeb01133f6ac05c551d67679ff3894fe49000000088e0d5dee2a4c88c8d898dca7b20ee0d0c099def65e870895f08a870a89458ce8a044f22fe2290d5807f5a6ab843b1495ed68d376fe691a1c5204c0ef329aab10f0787c9e1617dc55e40c6acab2a23914a78ff1b0fa3634867a448feddbcb0057009acea965d73419024bc0538ba979183d375790e6a58bef1fd8db60142bd9233b375d73a3ecf40838219d96df0f539400000005eba032caf330934a4a62d6b8fda0e5aafacb932d687e88714f9bb23649c5f4dee8735162628160d6746ba4840d4654196d3664d305ae88e990a893b1c1622fa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A092D321-1BB8-11EF-9DB4-7A4B76010719} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000906f9d6f48c924d96e3ff4a5fa3bd1f56df30e59de534d9996fe9358198f295d000000000e8000000002000020000000403db2ded2a99959feed56b7cbbe5a2280d3119d1814a0d775c20a20f543361320000000454d9ca244905ed599416035c9777d89809a557d379e89f4b0884c7ef4ff8e38400000007c8b29120a951271d08973a77e0844c2ddc061e1944afd4aa14be4576c9ef50619d3a7ff943d16813e2c1bccbdb9d531723cff56cfe6e85c6fe6a5b658943abe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422928392" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1684 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1684 iexplore.exe 1684 iexplore.exe 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2920 1684 iexplore.exe 28 PID 1684 wrote to memory of 2920 1684 iexplore.exe 28 PID 1684 wrote to memory of 2920 1684 iexplore.exe 28 PID 1684 wrote to memory of 2920 1684 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\772e91d4a704de7c31c65849f74f76bc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a27462a57c57e3a165045a4a764b92ba
SHA12d4dfe018d23cb5dd51e126bf064eec0a31bc525
SHA2564b4f172803d2cef4768a3ad7532366bdd4075b80487a43c22d6431f45b152df4
SHA512e9abff030d13e1d372619a9f718b40f2731643b0c3a9dfb7d518c5f4652b7e91773e24747356ae984b1fab87aadc06a0968ac3c79ee3be453359c3ba845b306f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a75bb3189bf4f9d854e07a287e5e6af
SHA12a4dc2d16808d94fb119f460b6b57717ea5c8913
SHA256ca6d645121a793bdcd8d3407fd4bc4edda6e7cc59120576924e2857467965809
SHA512c8692eb52841196a16cd7c5d4d621768ccf96723cd2c47320ee0f477880e9521bb702ee75ce86cf3e5fafa13e169eca8de64fbf4a7e69638f3ffa53374a6cc38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51da595a35c51397bc8504c60a793df54
SHA1e16c3ecd2fedb9ed2c91d3b197f8f3c8c69d0ab5
SHA2561dd2cb4244346a2657407d12a8bce278fbce756ffed7c717524491655818f21c
SHA512ea24c7a8d048e139396f8bdef051571da20452413dd2f04450eb5994edc2193a273113e6b518ce3dc7c6ef876976494d6679c0be3fefa59c8adf91aed8f7388e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5daca661e61c317cfa9f12543a92d2204
SHA190df5459236d8b75e42cda340bffff5032202a63
SHA256c07b53fc723aed71b62166b044e625b12dd4be5515380f904bdf5d37edc7c86b
SHA5129269a0bc2e3a72efa54ee9748c81de5989557475b67ef9c9d4e6a834b8d247e1d653fd2c021744dae2ab97c22b73861ab449796c2a4149b2f1550315fdc6e1d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e2e7b70e1659491af646ae2b50690e0
SHA1fe72710e193eafbb6a91ed1f337c33cac3433909
SHA25682adf59f3c1aa0598777503be151a676347297e9fa501394701963fb067c44b0
SHA5126cb93cb9fef730b1875b7df615f009e4291e095fe4aee8da5ebe4cb60ec526221a90f37527042933613a7724e6badafcc47bad3eacf8e38b3aeacf1b9397394e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df79a205cffe736b353a6e65faf0b1b8
SHA1972d4dafb2cb0ff4723e3ab71b6731921e826948
SHA2561e2ddac331a0b89cacba834477e352d681fefef130fb0894b318fec6420dc967
SHA512b5a215c22c56ceb4ade3ee58544d0324c6d7a93768dbd1c29aeedd843deed0feed91430cef5ac88223ce1414e106c94ed63ee5fa6d3b0fb535f5cd4a5871a755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5671c4ebce33f07ad996a9f84e135628c
SHA15ca46825ec7a4bab02c0a024a9ccc7408bfa1342
SHA2560d22496aa5cf56a32a6f1cef2467f86c7be5e9ff5a3d868a421e3718d16f6ed3
SHA51205b696597bac37de580299262d3ed6ce74af4ac91b661fff808b4288f618a6532319f26cc5393a4f4194d853a6a712740a4325994539c692fca2eae97462692e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8b4200fc753cfcf01dd57798504edca
SHA104a30c598e9fde1a658117f7a4fb323888410dbe
SHA2566065292db0a79223cdf2d3155f9fb892ba4d62d291c35614df1924db496cd9bf
SHA512262d1cba6e7d7f98ea9c0a6768fea5d9b47f108dadd49758a7bddc85db04efe407bd08f2d951c3418ef05c14ddaba4edbb56f9b7b232ca43fc291fb1d7bd8db2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5962c050bc4b8cd0d8e2a529e2a0bc348
SHA166927f421705b7871a73ef26774ac4623bd3c12c
SHA2567d562a458ea3cc850c07ef23c1f56f32b34937787c81101898d67353f5463100
SHA5121223808204cc2964fe15c6e2c05bf9cd1904432122089773b882e9288f39f316109bfc0cc3f5ddf5c9eb298edd7f39d16be3db2d76514e1a07f1da5f07ff396c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53353a6eaf36f6dcecb308e17ff8ec0df
SHA11233d17dee756499e2540718fe285790399c3670
SHA25617bc948f506f4b52fef8ecafb35259c3e80be18b14f0ffe045c7e5a907238b44
SHA512228e1310a76406c8cafbff1e37861bf48d65a2768bfa827fcfb431196575d42c48ce5b34cfeb6b1d9697882a1a1c2263d2429af6b37844308fca3e973cbfc34b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4b03533cdb733cfd6bec6109ee1fb88
SHA1a80c4e1820aa45a225623f30025f9dda235ad49a
SHA25602cd402cdee541b8a6ec94d2cb88ac9e7dc35aac2c701e4a58c779edc71dad83
SHA512dbf579f864412212db075ae59a7d1a1b9e77ca020f41df1f2c4f2f02cceee2ffc99a267eaa623448c36c7eba17468e7d5d28c1a7a1d2a7d20d023362cbad66f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d040613089e2fb5b6824faa8a3a5045
SHA12fbc1118eaa3730243916a251a15db92c5269ba4
SHA25646794306f065774041b00b5692d1d99bd28314b90793dcbce0232d979e07a449
SHA51266a289e858dd63896684245fe682ea66f59a642b49699f54391d038575718fb6f5f492db4d31179149b9addca63b66d6f3ce8d032a02c59fbc5d8c798b7ebf2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9677b830853cf066886a5026dfc3b48
SHA1bf3ef2bfb9fcb7fd9b39d7bfff784a89f9be9402
SHA256aff01a317d343a8e079d139ca5a6797a9d602d34b07ad8921847f35c9ae70613
SHA512d38038c0a22c218e58878bd9d4f7720525df2f7b36bda35c58f258e47f4712a27617a64c45ce82f4d23e5d1a5ac04d239a97fce4ddcc3d19943992da3f07af69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e090d74c3f2aafb9f882eb5c9501d23f
SHA1462bce5c664e460c03b1eb85c8e6c87449375ffd
SHA2562aa4db4b49552cc721a740a4d25017a0a1462b521962a124d3b3baca2725f50c
SHA5129b07ee82e26884a2f1c74055f307590bf9db1c164aa24c44e2f8911cb80147f17e20d686e1a79207d8da48062f6237a65968bb97c97c9d585ca4da19101e5f65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8e571fb8bef46d884b7211a90d1e3bc
SHA1037ce437b7bf515a6ddbaa489ee7c77ac70ed076
SHA25605be5cbe3df49e7b780802a4d7fa99304a0350aa167bdcd012b168eef4cc3d5c
SHA512a153e8962be6aa079e08e05aa2f0b36f38519ed085b1b0f5eab78ab7c2edf96105b1c5617a8d6ca755d7da868fd654961dd3a7c433e864095b3acf2c2feec17c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a10efa2114c68c9712b57f47be1f887e
SHA1c6a5280103421407c5c7368351bcf41edf8c77f7
SHA256ded1f1179ab225ff1bd8bf84f85bbeb448a9c7df0ee8734678ded8bd7866fda7
SHA512d26d75f7d0fae363a8e3f5f1afb55a16d85dd810c2874ce77ba666825f4535d9eab9a646211921a71524ab6bb3db164aa5a0cec06ba16155a92b5dfc35e7f9a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5483abcf620c49f6af363576a17c22485
SHA1248976b8f4a8b5aa9d41d7c794763361ff9fd40f
SHA25654f8d1c8a1293fa23cbadf5e3c45edf64aa0e33531b274cb06dd21f5321e6618
SHA5120118802dc42d78cbaa6f4c3d2a3b55f40c64d406ae0ccdadd5c7b4234ebff87c2887778c412c46de5c67077256f8c979ab3a880d26c0ea5f5e3e4f6aaf489f3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a96331eae7b517990ee41cbc2253c50
SHA1e232af3fb9e7272af26d5a7b681d8db6c3c158f7
SHA2560f7369456ac91bb71c5f8754ce73a9c22def21e5620d00c3ddb393ee0414d4ba
SHA5121da2d80f2096ca84064bab5cd3266699b6791ced456d6a30030ed83948756437d5bc44d61220982cee8f706d2ab8f29a73eca8dc9f23d0e16e69a7b250da98ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576b1a7beacd4c988e70d7c925462e810
SHA1e70178ddb8824c2064d2239bce37d2b25ce98429
SHA2564b4a1c2d8f2873bb1cc561d1f3e79c9a4ac0d9163f7d7e6ba588c7c1988d51d7
SHA5122322326d55c5f79e85a75eb7319e725b11f7c2414c5fa45a75f1aad48471959e0019d21478a550d7ff5179981a993a52155c1a84a3d24c41e27886e4e2fbf7dd
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a