Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 09:10
Static task
static1
Behavioral task
behavioral1
Sample
120ac89e834ed7addcc6761bb8289ae7_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
120ac89e834ed7addcc6761bb8289ae7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
120ac89e834ed7addcc6761bb8289ae7_JaffaCakes118.html
-
Size
1.1MB
-
MD5
120ac89e834ed7addcc6761bb8289ae7
-
SHA1
cb470e31d5b052882867afa898f2f35fcb97f144
-
SHA256
11d144bbae237c3aa3efb5d068a3ed4da9cd0401db39b7047269e42e177f4519
-
SHA512
3644d3e6166e9a45cf5aeabc28c787e2a5bde2e2a0ee9758049eb6b31fad1108a4d94ee9de49ab395ecd00c6d6ae53a78081448316a700c0a030b285fecf0621
-
SSDEEP
12288:h5d+X3ZrscWy9dHE5d+X3ZrscWy9dHP5d+X3ZrscWy9dHt5d+X3ZrscWy9dHX:9+1ja+1jr+1j1+1jL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420975723" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e3444a039eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000026262b2169756218c2a3c94178156f5935de86e17241a1712dda08fc34624b94000000000e80000000020000200000009e77a5bf0276573769da3d7ed6db34c91b1fc07a824ad4b4a62913212d98199320000000585f4e370d8f44ff843659341b55df55d3ac7bf4bbe6fec4bd9fa0d47c0f599b400000004c7e400b0751be6bd94f13eb1ae9e18f67e21b5eb1adb0689cae2936c0fa50a44f5b91bf2b0d0a7b012404518ddacc9e685a2d3fda613b9ed52a5829579180af iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000a367713d9c7d0f51cb50ac38faa9c07855becabd9f20f52ef741abe67f6b9b4e000000000e8000000002000020000000237daadbf1950844a523b6ee2d9c5c5eb714d9da95288b5bd8706b8ad6e651af90000000657696680a283364826de43dc851a9ecddaa10ff8de03231eff60b44ac901e004d37b4a17b63732359220236873c070633f8e9a4570a405476692fea2d8b8aa44e220d4bbc2efd5dd620cf2c05bb0762b0a501722af675be339a4e7c5d9aa2bc7799d99a0d606aa1915ecfae9b04eb58b8196e9d956138d30cbdc555e8d09bdf53d95003f565ef9fa145af03fdec409140000000e07850686bb90c377c16d0c1dc5ab235bff63891ffd86ea98acb22360abedc49d11f4d83bc783b673257b2e059c130b1bd20734326a1ec8c26bad0a8099a9f2d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{368494B1-09F6-11EF-BB01-66D147C423DC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1664 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1664 iexplore.exe 1664 iexplore.exe 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2332 1664 iexplore.exe 28 PID 1664 wrote to memory of 2332 1664 iexplore.exe 28 PID 1664 wrote to memory of 2332 1664 iexplore.exe 28 PID 1664 wrote to memory of 2332 1664 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\120ac89e834ed7addcc6761bb8289ae7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5746fc0ae4c7bd319abad9b5ff1a70f57
SHA1c9ffa273e400e083b35fbb9e89c86c50d5e1e3e4
SHA256dfd45959431ff0bd5f5be5cecbadf0dcff4c31bb7e6fdbb349889b9f624d6564
SHA5120e0332e03102acef1ced99bc6272051a61cc89247d0646b3f9e1dc471ce3558c087904d20690df9bfb4ed2b07b2b3f852ae2ff4bc46a5c6101e8e431fcabcfa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505c3c0214e5ae79f9d65a72114f7722b
SHA1b62f93def2af94db67dcc4923f650b861f1fab7e
SHA256b76b1c1d510fec1507a2610650d3f051f5dacdf04b93e3af995ea60f12fd8b6c
SHA512e6c2be7f768e2ca66a1bcb839f7b1bfa2f685ca49ee6c9ac5293c3acc14fdd7c040b26a4f0da0d8e9e442fa19875a654634078459a991a9cf6adaa570591e083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50614e68ad9f7bc26128991b334fd6d5b
SHA1007f2647a16239b6a51ee56a1bef27bb7a223bbc
SHA2564779a30e83eeddfb40bd6cfd49a7b36849b234f701847105be489bf61a2ef932
SHA512480e397d0527b5af496905062535e6af3afafc73dc3e86d662d116e8bd7c2f7db419850c0946a101b4ba9678171b3b85aae5595e9d60fd73d1e2334314dbc855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55423d1bb2f1d40013469ee0ba4a6eac0
SHA1d4c17407b7c801ba5ccd484c970234ddde91a45b
SHA25614694f1522b6a178d146df39c5434243e1ea1c1f7c8eaeaf33477cd4e1f21b3e
SHA512ca3b5cf23cfb0dacf0f32c21df01821640dfe0d9f3011b178f35d848897be7594d80a3d91de1b25ee91a24a52f22c809afc90fa69b1e8761432fd3190e9d5f46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5013aff289433fe7f43ed5eb9cc4302d4
SHA102bccb1bf879dd4e777e8976d4a7a28767c646eb
SHA2563e965f32401968811c58c75e0927602fd65332e8274f83bae74a7f51093f833d
SHA512e4ce91223ce39fdd670ea858f0687d1772d9cf640a8d5de862a82e611b1a79a3c923b92ae30c7170d2759334ab033342fadf80a15f14e72347bde1f3f54aeeae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f53c0f10692aaaeb661196dcd20a3f8
SHA1ef8fbf73dcb9258587c8840ef5e8daba2c0e3508
SHA256114e1453d148c8b8ffc7a5203eaa21048f7067eb2fcfe1794d341ee4275c8ff4
SHA5123317c9f3ade1b0a1b7186b4a4a6036181affe987629b566ebea8973f869026e13164669c3cf0a027cef3b6fa3076556dc7fcaa2dff7cfb84778c4bc9b69699ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab390571c3dcdf2a9dd348f535b5eb69
SHA15783ae6e77cc150b7c7f238045c73e85eca4ba36
SHA256817180505322886f33a8aae434f93f7e260b20c3a911247371a055cea2a987c5
SHA512e23741d5441f88908fe0afe7f2e34bc027cff012e6325230f8c269181d40bbcf0c658a2cc3dafb9dca6cf67b790ea197aac914b95d95865c69305fb22aaec768
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eec252219fc12e5aa830f81e6d15b629
SHA1bd3f5b8bac190db912847a8a3d2cf2f34d83eda3
SHA256e3575ff966aa482fda0014c8e2c7978f0f36998d3267f6120c0000676e1fc3df
SHA512639c307ec7cd994481f87379d757fd64e0ff5de5f5c00c5c7c0f2bea76ed2f16042d79cb9f38f9dbdb45a3796dfceaad126d4320f921cbca0d88cf1cdcc69b14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f39818a0605017937284ae80d2fca08a
SHA11786719b2766ef37baa49d52636a12422cb4779f
SHA256ad87debd67f19f32764306e426cb6b1774b67921a956fe32396f3060b7cf9c44
SHA5123251a991421c88d0baff73df211fe630718ba1b92780ba7ecbb4202f78071179769af4a0947e82844fff43bc834ec17328b1de18cf3baf29eb586bfe00657f76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6c933bb74336b6b6769e580dd10205a
SHA112c50c706a4455a23d5f179fc822c0b064e7abd1
SHA2568772bec6907913680542b5fe4b4c5bb1e4f9d254aa030f328e5f027370dfb07f
SHA51231d4580fe6e19b860c23b15e4e15fbfcf9dbbd7f9b2f08d96da761c228101cf7572af7529ec9f169d7572987b9610ca2c1f21809816cd6d89d9d5b005cbefbec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e2beab68c2f465fe745ca02375de6a1
SHA15d67c58634e15db1ca04b311caaad7b168276e83
SHA256c037e5da0cc41799ac2b0c27acc7485dc69ee525cf40c330bdeaa0912ab003e4
SHA512b1294812d6ae6085789043fbf0a5bd4e465791cc051c07f814ebd1ec71f4256bc2684e009ce21c382fe4abaf7fcea8fcf9d2c649bcffe73d89f4b2ae20a8caa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5524a2b3bb9150cfd9d1f402994b142c0
SHA166640c5f6cb0ceea332b6927a4c9eda0588cefda
SHA256572cd5081dd8d15a7cb781007fd5504f746f27b67db1362144b54cfa42084e85
SHA512c2f2ebe853d83072abf31ffa1e20b09fbd209f358548b698a4b04b8d80d19769ccf6eeda89f756d93a3c00d8e70210333943c596c06c7c5f991b0b5656efed54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5574955f090f813da5508dfdaa7379109
SHA1c7936252c596e8cc39c7f0f64ef63a9642fce0a1
SHA25671c70d7aa5810f8bf04bf616fea21a70cf0b1bd86c059d8aecee411da15c9a1f
SHA5124d05e6e4faf484108fd849030e58f1537538cf22f9fde79b885a635c29b4abd5dbb4a1da4c18c05a85d0d05462bac7d8025633ec500fccdd1d08a2a876afd560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a88cf8c3afbf4a001a43c4c6d11a5cec
SHA10ddda3f659115010e639d097fba67ef94e86b3c1
SHA256ae2bbe1ca7b712658581f70179d3af7b6883af5766664a25fd2d56417f665070
SHA5124e6e9e6e1c8433c9477ac9a24beb3bcfd11768bf12b267503166bb88706f41269c34092a9c00a95f0faeb463266e5d36b3993092af4aa0a7eadccbe16c73dd3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0cd0ab8081793579f90c69a562456cf
SHA191543e11f14859f24ad5a1127294394a50c30243
SHA2563792881794dbb3da89fabe991e6c98cd23225002ad8de6f9099c5c85fe5a8f1f
SHA512841a939596d5d3f113bcfd441a16b789fb611d1924d6ff4968053ad139abd22177c4d1d7a65e92b55cee6bb01cd9d1f73d3863a2bf1233def95d8258e8a480c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c5f5a3cebd3e390c15ca0fa7a5abaac
SHA1b01b639c218b6080159309510e7288c19537c48a
SHA256fed53a9bc78fc719faf8cd533e7b0cd03bc3874ade1fe1b1fef46e0030bc539f
SHA5129c92bf03c0e88f6e1a013fcb2652a79816625f63780bb648eb7f1f62c72ac943a95ad49132e71c27e681ff6ee0e5632ce9cdeaeb59b9c6836c3053b447f43532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ceec5449afa127ebdeb2567dd5c98fe8
SHA1a40ba7a7981cdec6eaba65c26975ff0194c25a0b
SHA25643a16a6ba4efa55a4afbb7f9773e061360648113f6b5ce2e8145dcd43c6dcae7
SHA51245c9744bc408329b3a7cb10f3d96bcaec9c8c69631eb95ef590d1e57000f753a3c90403150eb51e8c8bc62a732a140e495cd154c8768df0a61ebc04b050224d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbf33d430d64f089cb895d1dad553284
SHA1cf6073f43e4ca5cfedfad97de88046f361356bf7
SHA25663f647b2f878d46a55f6dca9f3288cc7ae0368c51ac5ffaa255a157dc31e09ac
SHA5120d54bc7af5c3c71efb96530140c9a9d6ae1536d1a0e658ce54d1cf24be98f1ef8a3b099a14ac4e7d1961f08393d497441eda3beb2a85ecd34a08effa636e6446
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a