Analysis
-
max time kernel
118s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 20:25
Static task
static1
Behavioral task
behavioral1
Sample
7e493c4f48cb5c05a776a3f8cd8d4813_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7e493c4f48cb5c05a776a3f8cd8d4813_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7e493c4f48cb5c05a776a3f8cd8d4813_JaffaCakes118.html
-
Size
17KB
-
MD5
7e493c4f48cb5c05a776a3f8cd8d4813
-
SHA1
3ef5885737176f519a62c19fba142d49366fd980
-
SHA256
72c75f40ec80606fa8495049a74f87b69f1c26eb2cd8fb9972b9d93e1a7ca6bf
-
SHA512
c2c14ecc623bcb0727d378feaa9169484f24f295f3c3357e6f5e6a8c096171316c5a5500a843f0604ffcfb6fef5080c699ad0f13ea10a0eaf5d25075fae4e63b
-
SSDEEP
384:ucMu1qPBMKBM3BM0BMXBMGcBMTFHl8/yOJOThxpJOWn3tOytOwk6q:uC0PCKC3C0CXCzCFz7nE6q
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005677e090ba821993123cecbc9bf3b6d445d2588fd04afcdfe729ddb5141a5b35000000000e80000000020000200000009a08a7a437ac39e563660f545b4f38e03dcc592b7b5825c67812772cb256f2b6900000007203800b53e3f6b46efcc769a6f9013312b45a83898ed8f58e9242fc0def3525fd8bb7dd6e5135402a8b45fb89edcfec999b964f419f02dff0662d2aff987f5c167ffa272cbd5e61eac88f025bd106d4ee2621c5f5582043b55ae1caf503306f9de8ee282c211937e4bc096d844221b23eba23bd2500a12fbd464f1cbfd17c55ddf11f888a7f8d05934becfcd010ac9a400000000d0b1d60ce2bd13cf4ee6ded15366f549f34e252f3a44192908c9b1a676992d7d052feda133a1c75556ef0cbe324644475ac1a1e4b348b73f2ffa39174320015 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423089814" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77958CA1-1D30-11EF-88AC-F2AB90EC9A26} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000042fdcb30d4b0a1936633b467bbd342a37ac7573ad5f60654c348ff661145c7cb000000000e8000000002000020000000c0d0ebe2c620dfc2ce835773588afcdaefa214ee3d9f8a403d64a1fc6e8e360f20000000c6cbfbde5cb88880f18f8458efef39511205135256be7309bd8e8ed83eba75d2400000009c10cb2db92462a9f41dfff8ea2e5ab28f9e1fa303cd27eb07950a22d75249eade30278730d285b8b3752ea371773c93c5da4aa38ccc0fcc810a6435ce07ac80 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07d614c3db1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1824 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1824 iexplore.exe 1824 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1824 wrote to memory of 3048 1824 iexplore.exe 28 PID 1824 wrote to memory of 3048 1824 iexplore.exe 28 PID 1824 wrote to memory of 3048 1824 iexplore.exe 28 PID 1824 wrote to memory of 3048 1824 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e493c4f48cb5c05a776a3f8cd8d4813_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1824 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5968945146ad731db48c913a4cb301da6
SHA1aad28ca3ae1d2da68dcba2fdd75a4b120ba3be48
SHA256dbb7420fd8807d4987bd3ecfff725e7a2a1b96ee935265e3aa8d47ffc84c4f30
SHA5121e544015ae47b1adbde704068ac986b5c9a4d993b5a3b290eb2f4c2e5eca038ef70d384b3ff6d172da844f84e7c50220d9d0b49f5fa183ae06536adb002fb1e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e523ba78adfc9efdfe573665ca0012c6
SHA1cca3c03d0043b4ed0de02721d2af59f90f824c6e
SHA256b45781a5f60c6219a624894d31017c4478c69c3b5a8f8931162c3f604f31c81b
SHA512ed166e79f14cabf2f90cc947f589595f012b176fbeede82054e3340f36ddf10993535ded3a6c33898a45cc42a9e46bffe1d51eb21acf326843b4fe97c5975032
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee877eaf7e2b729bdece16f9f8b3301e
SHA198229c8b57a19b1e621ea227b2f837e2b7ca9372
SHA25654e509a71200749635d8bb5c39111156461cfa50f1a2b20746fea0b1a9945de5
SHA5125f5f00f32e37a53033b37e6dbfe3b8d4703a1c6953f68f9e1187dfa93855391e43d0baf376d40fe1da1fb2421c8f2cb77558e4606a9c2238817bb94bc658d8ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1405e0abd2bbfecba895bd12fb6a962
SHA1fa5fac1139128277bf99e264927fc14f8f6e7302
SHA25663884ea633172bd817f40d8ab49bfd85f74847c5a57011844cdff7b474f520ed
SHA512efeb22dab3d610da3736e289c32ffa4cb3b5a8437cc01159b3fe29bff6ec769f976c7a4b6a1efb3b29a2b6b59b8bab337cacb1cc2f77d8ee38cb85adc1ae62c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c12e552cffedd667879f69e3c3787db0
SHA1ea13b8cb5fdeaa73dc5f3e0996e3182f392fee59
SHA2561ddfb5aa9742a49094f78262b5903a4db69f7517345d2c2e46654e8313ad5c6d
SHA5125ab50bf855e8bf8b783d118a62dde0ae4a63f9ddafee936f67fa6fa5221dbcc9557daa380e4d199b087a4b223afe1907a2cfbeef77909e75bf39ce44454a07fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a00eb91e0e26b51e5a1cecee958319c
SHA1129df350251906a0305925f0bc0066479ff04d81
SHA256b8695064d323be93f8f5c3647f21bfc199a63e5e6c7b102124c005834a459239
SHA51265c9e3bf77fa2059c648ed219252ecbda382f4c8f5b9586513cc68a7d8e69a08bea43260bdd5984ffb7612e837ca0843ad8730faae768fbac195b7687da31c68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53621ce8aedb07a80eec4a7fa85575b97
SHA175eae1edc652c46c151ae898cc26beab105d1466
SHA2566d89be9f425295e12ca629e58736121cbcb08cca05284edbc30495423bcfa0b3
SHA51284888bc3bcade7cddf21af2608c1a0941909d662b6cddc291aca769ab219a4a3c481eac0890896e2d253e192903323e16d3dcbbcbfa0b4ee2b87741cad02e043
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aeb863931863c8fff18db351963331da
SHA1b4b0cf4bde95627b69b6c8458a25954db4719292
SHA256a3473228f3834f853b30805d9023f2657f0c9734ed65f677313853ce70960d55
SHA512f2a3c66d08a093ce61e13e2500eaa1c7a6035781bfad4a730b6749d69d40f8d77d5507d70b4419f3a37cc5990f8648821069a00b5c3715eeb4e60d2aeff8c96f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592486737d8493ff8e253546852a28176
SHA1387b77bc679ec07535bd05d21e5c36e39fb4e87f
SHA2563101fac1d35ccea4a0493513ae8bfcee384ad774d905cc3d1bc26f7166178904
SHA51207e19417428ab2a1ac647d27cabb3daa72e54bae2a7eff3d6f8009d772c8bd14e4dc00bf575b9092f36999b75da71e141cb7c62b155b74d8bcde40328ff0d68f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585695f1c76e52f9de97513709941844c
SHA10313569f909103716de0310c11be5c6308da373a
SHA256d29d665feeae1f9bfdcd8b5fb42ec0dc4fc292f4dab2858d57602c85cf562225
SHA512b1bc9da01421fbe3d0f6e18984dc64aa9ae149865c5c725d513db6032b7f5a9081ae1f6547c26e9b2024d2c7f6e655bf8b4b47e211cefc2b472b33930c9a0eb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55925f47d70f20a3dec256fac77826dc3
SHA16c23d10d9d584ce85d340ce0f9dfed77c3a16bbe
SHA256ab5b4df7d13f154de108a512eb628d36e7c1f967c137e326fd4abd4bf9657e1b
SHA5125a91e1e3e8b85056d5aa73e9cb33204b3b935c577a4a3fb0996119c8c44bd87d80c3fefb440de9c14cb9fcc60b1e832fb4db625aaddc941ddf00bf77a86dd0df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bf2ca0b196fd2243af4b1705add5430
SHA185838ad8dbb1319b11d7d0322dc8a44893ac8274
SHA2568c8e0e8bb0c3c51da16f8fd86e2c0d7a616ab5291f7a64ba9c0a5042605118ea
SHA512288fb65bc93c312bc31e499abd40d46359d67f516452a93b46c46316f80632f85ef2a586025a924328e250a1af1c29a1db836b439fc754a5bf182c604e11ae85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53572cfe2af55f79d746e47298daecc4f
SHA1c3ac184223e72aeb41176c52d537f126c5d87f64
SHA256d11f88016b582ed7cf08e8c7fa00f41d426f00738dca0b67a2150e1ad54fa686
SHA512d2dd20562a30ad56b58d1f5726cc441342e9627079ccdeacd566a20538bbf0f6b785ad7431c0814890aeed62353393ab4dab4224d92aec1094dc5c501825b711
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582ab99caff29c178327d6d1fa8294ff8
SHA1220fead8d07a1c377bd4b06e95f3b888b21a042f
SHA2565fd6921d1cfd85b5bef84687046a9e4c26587659779995fa59d476b1ea164180
SHA512c1911d663b8582b17fecf55bc343778bba4221ed52d6a5e8e9ba254548d1162f8368d93bc5ef2d0ceb7fbb878a544b5a193d8c014d739884027b688d132d0940
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5480de785702b27fcbbc00f5f4fa013dc
SHA1142a829d90be433fbd2d5144fddeb29ec9ee5035
SHA256fe4f9cf66360d6f7a3a30678f1352f7e55c1dbd94c813183a91242ad98a0928f
SHA512daea6c81ca8f244ab77c2b353df9483d2a7d3de451b8ffb3300ae9b680b29132ddc06a778d97620e9b56bd56d07af0eb99db2fa63840b203f31f94d299f02949
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5842bbb9e1109965c0aca307934b1e3e4
SHA15e8ffd3c79644cab3f38214369e7e5a75cb508fa
SHA256669626f603fb563161820cc24796edde66d5e7b78e214107fc5bf8b8bf58e38a
SHA5125c2ec86c15983f3d9fb62299b34d213bc59c14cd0b97fab325b878441bdcf671023d5087e1d7516a50516913dd5552c49be15c8783873b4512882a458efd6102
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7f679e8fc73fae9fa30e948c1db2f7c
SHA1b4bc8214abae0c82ce88303a8c2c401decace615
SHA256eca4bcde4f8e642c27d9a18b453f5d09c20743dcd9b004c878f6c4fa41a4f62f
SHA5128ae408869fdf5cdef492d9b495f13838650f68a5c432b817e4b73328d946ba821c9537692ec04c64da2b50c8266e8c973bf404204b9a695de0ef6c8dfc45bcf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e348e810a63a89b020584be27c887873
SHA196ace75ef8efd783bc0561cc0b962cf04ecc140d
SHA256d5231e8b39bba6c84ea9222fc937059c4aa7412bdb23ece9b10e9ed8383f8628
SHA51249c892c6b08db4175733a8b35ec1154b5ce2d58df474b41263afe58bee0b35b6dac4aa90d6b89ecf7505cc3d6ec9e6ba8ffaf1e62a9e0863e90a46ae79163083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc06e00bdd9d3e7d0d7c6cbba8da4066
SHA14f8e0b5321e6164ad55b73d0117a798308027d30
SHA25639f4c9e51010787fae8796b8be90410b33507744209a1a268ec0a063ce573631
SHA5129ab62658ea056c0a97999e99b221b562f64c0b5f47dbd856b9c6ef865b20b2a3aa1c9c62d3e60a924c37df7e79b1ba0341a1188c91efea3da2b6cd163591fa75
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a