Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
3085ec92647f0d3d679ff0d15547fc35_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3085ec92647f0d3d679ff0d15547fc35_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3085ec92647f0d3d679ff0d15547fc35_JaffaCakes118.html
-
Size
460KB
-
MD5
3085ec92647f0d3d679ff0d15547fc35
-
SHA1
b32744a97a1a9e7bf36cf1e2e74118ecc768dd7b
-
SHA256
69abf1d3ce776120e57d76a9b38bcd8fe35307997e29523b71b607d0703b3732
-
SHA512
e67903e96602cd5d12720dbe371183b7d3473390d1cc077dc824a70662df5b8def7772d87f2259eb8d2d51057db6978abb49deb2b6769e13be09b97be54a970f
-
SSDEEP
6144:SosMYod+X3oI+YdsMYod+X3oI+YosMYod+X3oI+YLsMYod+X3oI+YQ:/5d+X3D5d+X3E5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000dcc38d852129634aa20b75cd635ea39d3a0ed013bc1b0c75597a5b0d4adc0b22000000000e8000000002000020000000d20c3f5f46ad6c5cf364dc1c044405ee09e84c6a4ad4249ccd708f9f3b3928ee20000000fd4b6413c663a959e13ceb2937fabe75d87ac10f369718292b0012f1bd6ba18e40000000b68387b91f05f2b83a0a28df13c8ac3fbeeffa0cb60c45557836202e4819f4a7bbc0a3a47b16be6d8d9667ebc46323ac52905a11b7fe9cdb4a51be7b655f7bda iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18407431-0EFE-11EF-BAE0-E64BF8A7A69F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0fcb5f00aa3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000001b91563db02e41ff56fa9f3b3f2c3a9cb1dcac48c483e3fab80e06973a7e3ecb000000000e80000000020000200000005290e208915ac660153f3bdbc3cd5071a9e4c537acb91424853065be3b7a735b9000000036efe25cb5175829c147cc10f2be38baea55c3f7eae8c89c0126f2fd42d250cb5764ec79139cfef656c31466a214fe4b15df1d901cb85969b15bfa711166d6ea36d684b319dc630210747c4541ced7cc2c670f44f149b3b87604409c35acf7cafc6478bcdb425acff4f9c9ee9d93298327dcbab3722d441e17fa6327f9d47e91cced3e9a42dea7ca740a1582fd1e130f400000006ecdfa5d4c0344761c75a44eb1178a69ea466529e667a59abec37a26b4889d5666d8d970f006a105e97bf2e471326777a002e37b75195154b543e80640b78cd8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421528863" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2284 iexplore.exe 2284 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2304 2284 iexplore.exe 28 PID 2284 wrote to memory of 2304 2284 iexplore.exe 28 PID 2284 wrote to memory of 2304 2284 iexplore.exe 28 PID 2284 wrote to memory of 2304 2284 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3085ec92647f0d3d679ff0d15547fc35_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58330ca6ee337a8e53639c3ffc4c1681b
SHA1c68a4e516b4ed5963b28983e71d2e0793e27f9e3
SHA2562c955ac47fdac2b890e813fd9db7e6c24b6c5a3c48ef9a71eefb9c9607402bab
SHA51290fba7e347302d11f9926f1a6e6f644d97bc6281441e09a0ecfd0e52885b1d38c535c2aa125db64bd376cd6b73e6f16b3779e5a9080bcd50b610af225c554789
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548409aa3465972e83e79e5102088909b
SHA15e2e0fa2b738b78f7a6535ee91951057d186c15a
SHA256af13b6f9688bea88e3d4b9d8a0211b2c68529cf758d288429b72cfcb6e8752f1
SHA51249eead2598c47fc5082db1e44407fd4b4d8f8ae6025756dccbaa77cf9d6ccfe5d7152c71225c5c6ce23c24b9fcd9455dd5b94b89d8dd9f304b712209898369c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4b0bd15d375e11c4170b39a71336efb
SHA16e7d8b45443ef57978ea74db10629c22c1595dbe
SHA2566795b3af80cce23f01efe06e0e5175a2bd2a5e99b101f699e4cf251307377dc7
SHA512480dd16ffe6c27aac9fac370ebcaa66ec86c6942e15598b16e9546d608c0e157edfc99127e0a56b0f7854499f89488154f74c0755475fdad822f079c4cc26c1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518ee5a9084b62b2c4b4d15fbd0b07b0d
SHA1e44cf568772d5ee0ed3f351068446ff845215966
SHA256ff9c89b9cf100d8adb6fce7f07db4c80471dc9c6a949fba393dd601b26d947b7
SHA512140d4cb4a4beb707c896a958aaaa96ccf088a5f0a46f12c927f689204f93c9a1da2165573c38f41e7b384a11fc5d499debf83c93a21903fd45e9f906f30c4483
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc01a2fb5d9d1811d5e92baca5694a4a
SHA1751d68ba761bc99eb2d5006cb399c695e5fd2998
SHA25646e7f470c8c50bc33bb42df4d23d13bfcf24a655f0f60be764659c43112cb58c
SHA5128faf49f9cd353352d81c922788ec42538388a6a8ca4ab9f16bd3f263301e8c7db63b741e327e545e40a09703605a23b4d1605cbbbb7a6804d7bde3b743ad99a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5366de06fd6f764a5e86b99ef169e0d1f
SHA16aec076de2e148d046cbfb72c15aef8c8582f573
SHA2569f8b6e5adad56f124a3376892c4493df93d1f35d51f2b226104d7d756b4da019
SHA512866d5d9853e72bf6c4f97117aac401c101708aee77a753687f8024e1b20e79034212591b467902a3d371aa27ccf383749f9122119fda06701e07e7ddac917ea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c314827ab14ee019e6d7f4cf4639cd0
SHA1be1aa859ffd35997551aafee54d19e0d25361915
SHA256d1fc24716b103e378190c264a42ae96b5bae569f8b43fdcf155c94faca5e026e
SHA5122230942783bce5fb2b7bdb5aa3f1a22b9225107e64f8443905496e0182094c46c8e2b9cc04c8926a8e020a017e5382e147639b851b11d3d6c2c24303ec44a955
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53255315be6b59995347ddaf08df61817
SHA1a8cbed20dab433afce40aa23c8fd684c71db3dbc
SHA25648d74b04e278ed058c27726f1d5b75706272c815c4f7b2033fc6c9e2127491fd
SHA5121d80c9c53e5c97479d0219107887de1df43ea986a62ea77862ae0dae91dff8de788da647fc023a5cb68f68b3ead06992ef9db89481c61a277ffe86dfcac56c34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d0593bbc84db26c6813d12eab0273b5
SHA1f5244656ff04cbe900b7a8f24a3c6e5363148636
SHA25601e449da987ab63cc9eaf4f83b875fc6e8d4321f140021f17e7bca155be9ed35
SHA5123285155f8f819def09545d1a50f081dd5693abaeda80089f08706a498b14d167286e1e38071eb5913236c0d22e18b2abe8c25779112470292b08bc29b960f608
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540f526c7fb6bece4ad19f2fe4356b118
SHA1fcdc6362fa9fb864d604c116b54963145fce0a38
SHA2569a1d29daea910dfef797405e01749eee19ed101b6f0b81c8417b2527ef1fb641
SHA5124b016dd5d22b4dab7e4ed471830625a27f2e6cdd46ec95145500f679e548b20f5fce7b46efd10c7a76b0912de8636c18ea4932dc047f916f2dd107e8860bfbe8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9ea90069894e60029e72513a567f2d9
SHA13e069d7c035db88796d6512997b0c0b51a3b91ee
SHA256c32f534701044cb7069e954a2b6b5ee8f7c70f441826698d5f027b9e2fc5ba40
SHA512f970bf0e4e6af065b0ba5aadb7800a8172c35c5639b66f1101eafd91251b2fed639926ec5cf8cf963dba3e3e4a460ba85bce19ee8b00462f8731f07af142114b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56224b1c583dbbfaeaf9a8914d137abf9
SHA1ccf1d331448146f32d6e56df1726f181dc6ba886
SHA256e742611f5d7cb0ed5cf5bbe9c9fd41af1b0f23e4b7bdf84c1ec124e71eeb21d1
SHA512fcde33f2713697e424d374ca55a7f4adf032ac95fd014ca725c3d7c3a855a1bdc8818a94d3ad70f1c574fbd7b3f4f4fb9f7663f59a00df196155706d139a02da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7c41ea44c1b7380a5ca4bb05171a18f
SHA1730b8930dcbb2fef6dd27727dd6360ce48b6de96
SHA25656d87fa34e9877b3f15e3924f72e4a706f55598f6e661b49460d4b521702c93c
SHA5125d6e954e62ae67dcd8a051483b69c09367b34fba4ad5b43610f3358e55912f1054c2bf7f7272e25028959a18f01b034ddc39048fd6d02d258de03799265b0a93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5053ab4fa3e45d9e43cf19f0ae98a239b
SHA15d4d9cc63b0b2eb03c95359d68ae0e52b6e1d854
SHA256720255ea47d6fd04546354325989535e7cdea2d1edb0e8a1ae42ed19013c33b6
SHA51213f9f96d274875c5d10818cb1dcf08dfd24f246f720ab2bc9a953eda5dd00cb279b58218742f98f04983124e9538662266d9d619c5498618dfddd7588b9e1b5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504d0d423d16aab770e4cf13ecda0c01a
SHA12468a1939b36fe68188fc6a81cf72cef9f1aeadb
SHA2566322a29819803ca9e90243347d13c95b7eb6de51e9b9e0ac65a0e0cb91429732
SHA512bd29a37cc264ffcadf5e11b27c13359c70021ab9a240517b17a484e8a81aa5e00056c8ae40ea6fce954fcd916e66db2c665e2947040ce9921c47af72a5360071
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b9bfa9d1575fd6b13900c2310d0326a
SHA1f8c659175b29b2735d0ba1b4418714ceef4e7079
SHA25674c7b372c1649c0132be525cec2c55a7afeac3f66ec937cd77c0ec733aa33d20
SHA512f761b0a37e2032f087b1778d615f22eba8bc1794fe726644b8150b06fa692a593dedc30d10e358cd241107106aa16a57c5e85a4705428068aea98aea3687a33a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f5b1c46dd0e23f52f05e572cbf4305b
SHA13eb183796dd9cc81727cecbdbe87485905946e20
SHA2567f0670369e1054d4abd1a3d7ef9920b802c594ae977b8438ab2132c7f23d6143
SHA512d775e468e22b54c21ca6ed7685e2af56f7f43965e5069c3dace9e0853398b25e56a0aacb9b7d65aa0769a721f64be8875b5731c4254a541b8005f9613b540df6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b8e8587d71e78df5a7602e03103bb22
SHA147d1d27acb98483e705d071ebfbb3075abea8a1c
SHA2569926cd29cd917f9173ed47ee46832db9b1a9d7ab3e5b63a319162cb1910c6dd7
SHA512fb120ff66a156d97f930351b16d6b9f130714a95b1744e12d282a0c2b492369b17e74152dfbea325264236ce8b0c5f79e6586d0f7f4c26dc15083880f46d7810
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54586229f377702aa8e3485188dd140bb
SHA1ab6233d2136611b996fdcf3188f72958cbf25a20
SHA256d3fd65205ee2578df7b9c70e9c8df40a7b9644fb7db7fd3e59a35f1b3c6c2070
SHA5128f49222450a33e11ca43e9a1f9f08002e5660f8a6e7e419b8d307575d51eded32c5ce670fa2a63a186ac30dc43994ef791323858db8d999d9c268c152465d928
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a