Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
432c288d2ec1492c6d5e1572af95d8f6_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
432c288d2ec1492c6d5e1572af95d8f6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
432c288d2ec1492c6d5e1572af95d8f6_JaffaCakes118.html
-
Size
463KB
-
MD5
432c288d2ec1492c6d5e1572af95d8f6
-
SHA1
79c63cd96d018a3b203a4a9f39cc1923bbc0809a
-
SHA256
44975c4ce82b90620e4771f6f2a2c40057639c643e4434970f14ca18bb5ea3c5
-
SHA512
298822331fd7ec0bf8b8f5711bf775f4acfd19023a3c63ca43660ce65620768924e7c152839eeabb281c4eff526e7b87ee8cbc6981b916007cb46f26fffdbce7
-
SSDEEP
6144:SJsMYod+X3oI+Y0sMYod+X3oI+YMsMYod+X3oI+YLsMYod+X3oI+YQ:u5d+X3s5d+X3M5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009b09cedf33a22c204223f84cbc26bf3c3aa92d84c9aaa6c4d9f7d5a141773864000000000e800000000200002000000022311fdc17a110270590f7413c54254e1a8f561dbc577eeaf8df622e89c184c39000000050a0247025203bb3bf00414d03029b2fbeb90e6cafb1ddeac2e526a89026ebe4749c66eafbd4a81b90b6c59c897ab5927134e1eca70dc0a7d776770113359415e42eb8b4c8a723db07dd5f313c1767830766a862b4cd417e89f95ed9c67666dc8c44060d89a81a7d543c28c250e2c387914bef71503d94588dfc923ab4dfacc217b0c05475e300edc09ebfc1ac44433f40000000aa5aef726246a49f2b15e1dc74312857fe92dd38aa294d6249945f792ea3b70687e07522723157c883017d1311da2e422bb48c539876755dff6d18e5997a5611 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000056a363e769e1a931f372af513a03bf429e88c466907dd2bc7a3447b9dfec904f000000000e80000000020000200000002a1089a1215ad72c463744efa9407b8a0aabcc2a7816c3eef961716a9d04209a20000000df7874850afd4a1e16eb3f0f6b8868ccdf477f8d59b7659e7fcfe1bb1f73f4e0400000003afcbecdebef710d69247e2e2ed4aa8743bba06cea3c432c179b0e23c246721a6ea04daac2f9b34a366260b5a7b8d949f6ac209034e5bac26119dc8a7ed36495 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EEF9B201-1239-11EF-AB01-4E87F544447C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209b86c746a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421884417" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2056 iexplore.exe 2056 iexplore.exe 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2648 2056 iexplore.exe 28 PID 2056 wrote to memory of 2648 2056 iexplore.exe 28 PID 2056 wrote to memory of 2648 2056 iexplore.exe 28 PID 2056 wrote to memory of 2648 2056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\432c288d2ec1492c6d5e1572af95d8f6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5951c74dd3def6a400c7407b76f0377df
SHA171d5cc3ff82a08459cc1eeee501b6505e978ec92
SHA2567195de0e4d5aa9f73df4fd481997df77520e1f708c5306df97c596bcce5828e8
SHA5120f7039120cc0f934f7216bf6199b0891fe428fbe9ec5e85e7544adb650f08c67b218777a78ee6450588212e3bbd997edca32b5ad848db11d8132fbce2e49a971
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5814ec44d81d43d217b91a23ebb5c2884
SHA1b93a49c456f6d7080dc9ee4c4e59eaabd0a37b86
SHA2565130441cd1347462a724499b11b5c680afbd3d9c0915470861a86f0982d05f3a
SHA51287d0fb6dc8a9ea938dc625c14971c9344d14348a48119f825c28d3162174be1d4d478e41c8925b5a2c5f0d6f8b8212d33f7bf95792ea584e2125d899fbbabfae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c216807d15eb9d062bd966ce84d9873
SHA1e5b87d898a2f4d81ce0bc98ea442e80f017bd0d8
SHA256596cd6df26c2464a2f59397ab35ba2857bf5b07beba4ebdc463c88b190c1a361
SHA512449ff0bc435f5c82ecc2affa49a1498099cea08af8c1178752c388886c5d615dcbb8d079ae4cc3fae302cb9419f6e2dc357a00f4c6393366f8d22de7b64c98a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc311a246b0bb6bbbcbd81697d9222d8
SHA1aed624f850e0bb4519f6d1f62a04471bd1839d7f
SHA256b1d529eeb9f16c91cf4b51ae12ac511635bc976b2f264eff3ce3ae9c79559861
SHA512c310d0b0c3cd4a03e282998eee63f4183ae271f06237ea3dbc6a607c29b4d1ec938c82b7a8230cf4a3df771f9c83d773b4564541dd6f29b23c83157f7e7f2ebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5511d1662065fca45740f67e2c67b423b
SHA1d37f36f77ab6f414e3e3e0cc795f1d8110837c1a
SHA2565c5226610d27b6a2aebd7f40256524d0cda0dbc9b170f6e1eef95e27cca3df21
SHA512670fc5445db15aca62e4de6a7fdb7f59ae0eac8ed366ed4d27632569ad06400a3d9102229423cdc841f8dd8562bec74458cc846fb98965b85b124475bf281942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5169a1242c43e8b7c81048d558698ba51
SHA1f9076f21c38cdc041676c502f9a647371ce55801
SHA256456bdc75f760153e6c6c696a9f1c84791aed8ec62c0fe011449f2ca56282b851
SHA512057d5a36db0305dbcb8bfd8e2198c053dbe6592c8736db506543ac477f28a93420ee86b9a202a3ed65b7b0e023728c8cdd1add1af15dbef02903b9a487eaf168
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c9ff383ecbcfe7fa11ec2e8224a7fbe
SHA113ea292a23d80fa11367dc3edc41848dc7fa2faf
SHA256bfc56d3cef657cd6dacf54e4bf763562c8f1b726c9f7cf4e1a5d4292919c6196
SHA512c5a6e902a4a559431287456990d2d2e6b2de970ed09302d60849f21ab23f6e599849f66d817a9258861feca7615c76b93cc2a058f311bab593fe2dd4c000af28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5276bb1660e5a9b7eb71a993d2774062a
SHA1b5b1df3926c05b66374acc51b68442f6083bdb30
SHA256c201329ac9349efe462e544c475415b3c5ea3069a186baedda4a03e2be26a978
SHA5123b67f656e53fee54c5658bc7c8276666f222d270b135390646722d59a9272b7b04dffce343695b41d76313441a437d855936a0b71ed638e6e780d17945b77d9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5821854f7131f41b7963bf0adc7cb64
SHA1c80e0cdb73d215004330ae3b67e2a1085ac96f4c
SHA25628cef6a84d4a53ea6f738e8ee774a7d9377ddd55f9ac39e42a2abceab60033fd
SHA512d8985160a7406dfeee8c7ea8aae1aebc7e46319632edbbfcf0807f30363ba57dab86e39fd3b1a9e72fb25741694f7db98ca682bcbdb91c14f0ff11997a4159ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56163ff12a3cb83288cb668186d11397f
SHA1206826667f567c51bad4d6357fc6c92aec5fa247
SHA2567248db4a87720ad9baa3bde12f4f4b6316e7dff0994e230e6ef82923bbed97d3
SHA5120ddb8f70b6b1cc497f630250c35f6ebde09525c390e11f6bec53e909f5fdc6c70c023ed376b1a1c37702d343afb0dd125468c028b8f29141c028fc9760e0a3b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3d9e593fdbbd4115eb71343fc743f4a
SHA168c7901c42ff11429cb227514d95ec022f880f68
SHA256cdf8efbb04c5e71b07df56d4914da2db137988264bfd02547afb23267fe6fb87
SHA51245667aae738caad80b3135d7b0e464dadd564b54a70142236bba3c789f89d00636ce5347dfab53e13b1d978a1475494f54302192f11e68396e8ca332aed9c2f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6a7f8ef25fa4727c09c16da698ce9fc
SHA19bf0383deeac201195e8381bf029adfa3cd428e6
SHA25697e8963ee00c709aac9a3e3e46104c78c839d106eeff8d82d446f2471acccda9
SHA512dfa440fb78a58ffd13d0f43f24346ccf5ba58463cbf9485f16b458b045e2ed0601023d0cae19114e1727e6bbca8a43afb424419f863acb07265359fd7c8eee31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea2b9a72cd0084eb0930d9bfbdedf7f0
SHA1b2631e8b09bd99432444cf4f6948d34886bed8b7
SHA25622c5ea6fa508c065e9c6c31c21489029ff96b6896ab56e2a1ed1f0b5c389bd0f
SHA51228dc55605e55ab055e778db78dab1f44f9e4ad4aeb2e648c6de5d597fda64af0f4bba8b3e38ebd824f546808994f7c53cc033c514e047ae56902b54abc5fa668
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569128581cc92d8404b7696696db9d70f
SHA119c8de53fcc5911769eeef0fab14a623e510c8d0
SHA2569ff8aa1e27ed025e370617d5fd057d7ac594964d1c5c8b491b73c82e8e4890da
SHA5128890ff0cd9ef495222f1ad0dd8d47f2b99e74f0dcc477cf63b96d32a644d02d8b8e7a24bb11f0151d07a4ace680222550f327a309db20183688ac83014debebf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516d825ab6c254a3c6f9e2453cc72f8cc
SHA182aeae35c27e208e7ba157143fa6643901f73549
SHA256575d64fdc9d2cf45e0b2a52e43d3b926cd2e8cac44a260cda6248134686301d9
SHA5120071c399bae6224bf15102ec5def5c949838005019103b288a3bfcab53819629a19e57bfd4e8513b33f1e10110e81dbb9042f8cfff1f0f012f522cc66a54c5d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4604d8e0b27a9e5d0964e127837c24e
SHA14fec5f204e1ece9f3367b5e9fd071b720cc3e775
SHA2567ebbee966fb93468fc20bce1120d0d8865a44fb0156b4b99b98f012dbd27b7ed
SHA512aacd4d6b7e3c1cfdafb2f43e11df9325115e95f83342d0b847a9b81589d504300915bdd86905b2ad9c15d75427238a01172709410997e884da6eaa3a31592bcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5643b4841687df413999e0ad2b5d11d20
SHA104bad61eddc08f2f3ae960b985054e67f0d09ae2
SHA256721c5c3d96bb856d66116153eaffcbc1bc017348a0b79330a6bb3d8782682fe3
SHA5128fe747796f036025a860397a00f2a52d0bc4459538377cf7542453a6042c004cf13d4d9d6a39f040d7e32feebfda0eefe5b157d85673d3f8f343859b453f0c40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9798047b3e749da2ef507c9c33d2fcb
SHA12f3883917920e59e82c6e4581b49221665ce13f4
SHA25684e3f034d7e2c3d2436bd1cb48d5d3a9d2098a25e3fa18d940fecc03ba252014
SHA51283ab77b4fe19bc10788a375ee1c78c2a94aac57db93b2c0123cbfb0f83cadaf8c0a2e7c9e9e881284f128c7000fffd4bd8842f607d33a4c8f8f77e862c01e237
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e88045c042b1b1d9987637f70288b35
SHA19fc389db15e8e1daecdbfa90fe58525560ed3100
SHA256e33ff51e2a172ad421007d8e59ca075feda8bec552471efd7d9b1ebf4e3c37a1
SHA512a94923531099cba0dc088eb53203d85cd4824ecf5b68852edc9289905e6d098475622b43e8e1ba96b895840ea02491474283b4fb53c4bec606b1849bc0a5e7f9
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a