Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 11:42
Static task
static1
Behavioral task
behavioral1
Sample
46051d8b0026a815a2ce25e8b644ae15_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
46051d8b0026a815a2ce25e8b644ae15_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
46051d8b0026a815a2ce25e8b644ae15_JaffaCakes118.html
-
Size
460KB
-
MD5
46051d8b0026a815a2ce25e8b644ae15
-
SHA1
36067eeb653bb29deab1adbfb6e8381047d7e0ba
-
SHA256
4f2ccfcee225f1ff885aba8a4cd4c093055a3d72513c8b09c8abb59c2decdfb2
-
SHA512
69ed6d99bf3f4274386f667b419579cb87995d4e2293e2c4ac119d36aed630f85bfea391ed3abeb701ddb3264755cf692640985cfb208044e2010b2bd9f3f9d1
-
SSDEEP
6144:SRsMYod+X3oI+YGQ0sMYod+X3oI+YYwsMYod+X3oI+YLsMYod+X3oI+YQ:25d+X3O5d+X315d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000072c75c34bb7138fc8017f8193b78e2a672e5e049f6a83d451ba82b652f90c739000000000e80000000020000200000005e6ea2d838493111789f2e3bdf7c2d062f24fa4ad0bed017904a9818906686c520000000360220ffa568306c1ddc202310da4fc0226a7050b65cc9142f73e91ba32ce3eb400000000d6e1fea1f24d4d4fdfd963924b0cad8640681fde41646ea2cf69d7d4e8c3a170ba3284982542f6eee95defea67790cb67ec125e8d80d7c4578d09d14a00927d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4047CC71-12B0-11EF-8C93-DEECE6B0C1A4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805fc718bda6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000dbbf41d9c36a81df4efd16bcda2009faef3f897b6d25aa2d0394cbb865a71cd4000000000e8000000002000020000000c47400533e23aeee0adc6576e4f4dfe1987164d050d0614c512dbc441d5097ed900000006153577d11898f26a5bd15ddd6597785b0883d7407bf1ccce802d042a123b40f8bfb828db0b1c46c40021aa472f39996d248f11f7c17715d36eee8e9b07fff1842e6c1a76867a98f0261d3b2492b1ca398c63f8fd7f0d5a470c3d94789a4aeacd66ccff6f473a1bb09650b5487c47ce0e7f52b8e79125292f72d9a80c709c6d95988f18d82196a2f35c0cdc4a528c5a94000000012b052563566bb2cf44877112b25e5fa498dc431b980bb4f63657d4df768b0e4492ff355b55db2dabb7f6784b532f2cd793dc321d495a3b6f20a4f58c48b83ac iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421935234" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2980 iexplore.exe 2980 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2936 2980 iexplore.exe 28 PID 2980 wrote to memory of 2936 2980 iexplore.exe 28 PID 2980 wrote to memory of 2936 2980 iexplore.exe 28 PID 2980 wrote to memory of 2936 2980 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46051d8b0026a815a2ce25e8b644ae15_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d583c9b11aec4473438f846bd16ad7d6
SHA1bc33ba96e613bd4106bab4782e9d03ee1ab66114
SHA256f28e481fa67b1dc1e9a556a6dd1bbf746ec94e5349d65e6ade215486e0763223
SHA5120e52ecec4a0a50128633ab0b2d4d1a8ec038b2d724fa7a0eb1bd6bc2137d5ff435dff501d25c5d552e488b785f0f5cc71f0154571783da412436db674c9a91a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564d2e5ed78b93f09354560b40a450386
SHA1faa508d3252dfdb3fd3b1955861f55a29f96e734
SHA25601756dbd9cd67908c6d4c81fd614ebd48e3f87fbcb635180d438c6d90a6e52eb
SHA512a4d87ca18bdf153e990ad6c9cc9a47da04d0072e3dd499382daa53f1b900f5eec986f0c4bea5c084c67d89cb19a41caa5b2109b13a2ce1654be6d30a1cd670aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59eeb098f77b77a49ce37c242b7111ee9
SHA16565f019c6049dd77bb8c3969a186c56c8a29cc2
SHA25618ec0b84b1a990ff8d2e18d6aee4d5ff0d080b42653a46d8b73f09d0077132e1
SHA512535c5821e49936fd590ac833827da965d1a3ab21192381c89b7ed6a2bb2783ff5729901169450b89320949473fdcbd25104d0562ee32179df82d42ffad90ad98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51446f637bba58bb5d0d37bc9b395adde
SHA17d3f0e7217cabe976bbeb048e39db7aba1015270
SHA256273d24c64c4efa277546f85c0416e58cbec384f7084d524f1da77d9982e1e03b
SHA512dcdfdbe0bdc3d02fee3cd98a9cc3871876d24ff0b02a0a8f5eece64c478a9888ddfc9a03c66437de95228da31b312b0a0adee752881065b1252bc54f402a54f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6a1833874fab3e9af9e6fbb34825653
SHA12a5ddce087b34db3dce58ec515d84f010558b14b
SHA2566e427e10930bb849cffcc5208de9370160dd208bdccb3a627cb6b314a25c3ee0
SHA512665540542f244200aed4448f6f1807bb8dbdb8abdb2d1c2d164145fd961f7d4a42160e155b3d542d16c15fba01498a65299a0ef69165246a58d37de2107da5e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58423d3241ebf596637c4de26105e3590
SHA19e0e44019f9e97d164949f354e7fef058817e50d
SHA256d55c72533279e7975371c7563faf40a963e3e0c52da3de79fb09f2e8002dd4bf
SHA5125a664a1776bb5ebf32b616952c4f355d1f9d88b8f49fded21e8a96618d3a6a8921764870f06169508845149f8be5c891aff8d0990c6abbd76ab5b7e6d8166a8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4cfd145b9c8c990b12869cfb12dc7bb
SHA117850757eab1ee936c5569c832280b8fc02e7b76
SHA25668af511e786ebf7eaa6caef780c5cf2734f3569c7249464b1a2b49944dfe0182
SHA5126922fe323fb48bba217d092e57d54e30cc7afec2399c4c919319820d36ee937e3a4bf33e3162aafd7129d11bebd011bc7fc47fe96d782a95860be2f3a12cb231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8eee1b36cce6fed8f86da92037cfcf2
SHA1184dc9f68e6787eca72671355063a4b143f7e4c2
SHA256a1f0eb7f15bbc4a58ec91b2e91b2e9aa49bb09af3c0829edbda02fb4a46107c3
SHA512f9d5b7ddbc6498be46858feeff849a0acb2efb1707dc022f51e552fa9047dcc519506d09989cc689bd4cafbdeb8e548b0a950ff846187f5f520cfa1075249ac7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5047e92571b96d0b9782fbe3f7fc5e99a
SHA133d0c11c71a2deca983c26e01063da6a452a6d57
SHA2560c7e592b52943cfcb9b02a8eaab9ee070c468f92a9fcd5863609ab0a142e4d7e
SHA512ac015a1432232a0048aee5fc572e3bab13ad932aa91825a97073fb61d7f8140aa9759ad7a855bcc43946e32bd7a5698fae3f966a3c4927948204039800f85ee4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f70c0c1fab120c054c8e136742bc6ebd
SHA1471d9de1ecf061a7056f1c1b1c5c9aca0a8f9b05
SHA256cb2328cce0f2e6bbdaba574c6ec0a1b10f61d7111a50f6127c80d0578e339b49
SHA5120696bba0bd301aad6c7c27b2edffdcd1bd2bacaf64a3ad7d34686428aed60061f9ef736aa3fa3980c4470fe0cd648c763024d5f52f289a77c913b61775a56068
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5609f303fbe891492dc31e2479eaa75e3
SHA1e06800b4e382e9eed04b133e97cd5f203fab33ef
SHA256a4770d49c62d0852a7c0c647aee150a84cc6662f16486035a6e36e9a36598901
SHA512a49775ef2386400a4d38f7b2f337099b2decab5eb42fa18462f847ad41027fd9e54f150c85a6788597d6843be777bb937d3f8f37ff22eebb2e93487e8cc26a6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5834eb69d83f97e942fbd028b72771fea
SHA19a0ba1f1b1ecd6e931d80b1c7ffa347e275fd4d3
SHA256b76b506586fd0ed5b5ca67b49a397aca87e492a2ec4fb6eece607b77245d4a37
SHA5123b299f0864e093788c087500f59a479412014326506d06102ceb7fc1e13e4dca539555e2f6f6e0ec9498a2e049b3e228f6cb98b7fe6aaf772d0827c6487d9328
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c236fe2746a6134a2d57a50a51d43f87
SHA1df73881c0e3727fa2d1bfb29aa87c86384e515b7
SHA256626c30c308efa9eabf1d9f9e0ae6fd351bdcadb68dd77ec9a29330494fa9bccf
SHA512d6a5fa8c7df451246b2b58cafc79b71ab60b2c948d592d9ef5de56e0c5a4f1b89d84da9a4020c664299500827c8aae2ba8d87a6574b76da712ecdca8befb835c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524b18cfbc0cc9e60c7b60c553c805c68
SHA10ff6cc3973e4e1da7e29ec9d8fa6d074828a07f0
SHA2560eba7de1ded9c00a0ba1e94c00f1fb2606832b3795bdeb3a87ad651234ff5604
SHA51206c49c0586140ba64d3d13aceed82fd22f8b07d7e324a98fa3fafd8b65bfed582401782028042ebca5eb57cb2de4762294688c37be4af8497d725d6a54402859
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52512b2bfd9e0227e8d20255e2f5d6977
SHA19585379928098e3153a66f73f5e56d8eb42c6553
SHA25614cf779a5af0b0db1493ca022eab66eeb00113f7878a9f25f5758a3bd2002d6c
SHA512578e88b035119a84cf13e01e3079d4cecdb655d926ab142d3e10a2c1a4a02e10a0d74142152f06a0e85194d2f84e5be0b44e1f27578357bc836723fc5b692466
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f243abec3cd80c52bea7db76aab8f76
SHA1d2513721c91bc84dab59837f635eafdab53df31f
SHA2563c6adb93c173f9f36143ed2a0cb3758e378b187a7780a91412fd9f9be7fa00f1
SHA5123f6bfac1ffb97a8811308dac32dffa408d7ab6a6bd161cded68a1addb6252e06885c5bc43089352f96b90f296868c72710a80ac73226c251e19b0519e4f49a55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f50790599711bf068281e23f0440ff95
SHA1f45a82693dd4bfec1e9c85b8d91f454d95d52de0
SHA25608fb66df5f50492027deba19987a97b44921ce98f0996fc765a3163493f84f54
SHA512b73ed897949f90dc264f7520981343ea4d4a28af2a66bc81c8adf02f07da5f54211f669b89c31a573e1ede466b43324617db4a4fc16e7467b2604ed98b4fa08d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1f020000b131abacdeab522299b2c59
SHA19fd2228c117abfd8c4793ecb7510111d50961586
SHA256c766d3de60ed7ae243edfc71a9ab5dd36daa0e88f5345873f4d740370571cbfa
SHA512414b812ba08b57ce719e8cb832a835561f98d647338e8e518662138f3b0eee7ab122ae49bf54f142642b925795a726572c668011a5744a531845a3888d438145
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52704761f5033c5c572e09e594e0d8271
SHA10b962e4f24a6efa3079c744dea869be7548ad42b
SHA256d76c8f710930ccbfa1a4cf8741321e593fc0341abd804a64bdec376f3bd55e9e
SHA512bcf62dc844989c5963c27e00b27665a131a256763b69e9fc0ae169bc2a186ae25874db4034ee981757211ad6903a3cc7cd104c8d4e2141e3493d2f79fc562879
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a