Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
8891620069ca495e6aecc0f96a22fcb5_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8891620069ca495e6aecc0f96a22fcb5_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8891620069ca495e6aecc0f96a22fcb5_JaffaCakes118.html
-
Size
53KB
-
MD5
8891620069ca495e6aecc0f96a22fcb5
-
SHA1
1e2978809f6d125d56d7def42e55a201b640b2df
-
SHA256
adb8b631aa613a7fc20495832890d17e3ca83f0aa9105b9d34f932b0d17a883c
-
SHA512
a24d3e926d45fbdf80e32348d6490ed5d77fcc0a5b75e9a8cc498666d9e552eb2109707fdc62cace09d75a24772c4cabdbaed7761fde26b6c88d942e61eae1da
-
SSDEEP
384:Sypdg2tekQn4M/NeAHhnuTcZdTRnuTcZdZh7uTcZdkBewP4ZUZLBRA7aywA9SWJu:Syg2tekQn4M/Nx7h8eo9/gsSlz0
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5004 msedge.exe 5004 msedge.exe 1684 msedge.exe 1684 msedge.exe 2684 identity_helper.exe 2684 identity_helper.exe 1356 msedge.exe 1356 msedge.exe 1356 msedge.exe 1356 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 632 1684 msedge.exe 81 PID 1684 wrote to memory of 632 1684 msedge.exe 81 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 4728 1684 msedge.exe 82 PID 1684 wrote to memory of 5004 1684 msedge.exe 83 PID 1684 wrote to memory of 5004 1684 msedge.exe 83 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84 PID 1684 wrote to memory of 2448 1684 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8891620069ca495e6aecc0f96a22fcb5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6ed746f8,0x7ffe6ed74708,0x7ffe6ed747182⤵PID:632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:12⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6316 /prefetch:82⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6316 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:12⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:12⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10274604002735175533,12980243533004123818,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1356
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2836
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD590b07c2fd93ff04987dd8bce7a977d41
SHA1828f007bef24dacba2ed8539f28938d0d986de58
SHA256a6db626b9f2aa90be09901609510a999b4813a0fb6c4443724d5c4ee16b5dcfc
SHA512c2c32c35d2c56e4916fd244a1417579ff70bce5cf9170bebf5268e97d1836fc5249b851da961cee0f79221b0a044faf7b251bce7493ef828f7368e58732c31d4
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD5f3a18e5d71be74e9a3c1a470b0dbf057
SHA150923b48b56e590169e45a39557ad2eab9acb033
SHA2567c5b90dd0f6e7a1d620c1399f97ff1987159485be45f7da6c4e9a772156e9400
SHA512277828b5c313cb37e62957f0a4f47344f52ceba4b1f0c0978c93ea8842195ebbe5b22228ee91dad61483e5ab06dfc3c1d439b46b9d484f95563c4ffea1819d17
-
Filesize
5KB
MD5bb399c6aa3f1cefdc122ab54513ad5f2
SHA1ca2ebcff0543c5a731429a68e57f9473673d73c6
SHA25662442dc3c82c26ab87e39d9a7cb820ee6563d3a5a5d2d757d464928215d75b82
SHA512db19892718c51c1c32eabf6a75e136ad4bd58ac9168d14b78903991b17d114f0528e15adc44cdd65eda4565221b0cabec9384f4a10bddcb8694ff83f94331fba
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa0d5f57-1a5c-4f00-ad49-b03b06f0f593.tmp
Filesize1KB
MD5f8189c952a33a2c96a7bc24c9d396191
SHA10eae1af627e579c8eaae5f5f2fecdede1a6073d7
SHA2566497fd53711d45574c692f42361e1afa4ca4ce3eaed49fe8463c8c66faecf726
SHA5121f524857c01eadc918439abebcdb74d9fbc264a0b649c4141bb552941b00f66b860edb14d78194adeea36efa8ce858183aab33436f28dcc624bd54f2c2e26e42
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD531a6363438d5861c2de233ce903994ca
SHA19dab1f5479ba9f5cde90c6bbec5ccd26ca5decc4
SHA2566bb52e5390448bf62f8c947f14cb1023daad37df82abe45f1a808b4808f610a7
SHA512c50ed570bc3f3d846617c5a3834bd35ad9c4438acace467f4af88faade535aceee8db750389dc636e9e86fdb4f31dac1c220fd725e0d9b78762ec6351242e36c