Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
350080735ac73e44c523008718cdf4b6_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
350080735ac73e44c523008718cdf4b6_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
350080735ac73e44c523008718cdf4b6_JaffaCakes118.html
-
Size
31KB
-
MD5
350080735ac73e44c523008718cdf4b6
-
SHA1
577465a13832069ff810eaa887dc03297aea8d50
-
SHA256
5864d9987aedcdbcf64f1f6a3f3984e649e4b807e0c99c94eab67b4c74278d88
-
SHA512
b3b3ea70de833b0821bf76a69ccad0f33b8ea2dcf2acf6c00963a94ba019483523ff1bf322fcf2e5adfbe27954875b0dc84fb58223fa9f65e2c0f96d33ae7934
-
SSDEEP
384:svlIcytn4PWGTHVWl1NeCI1lm5nakto9IATGJTHlSqIhiB/gcXBxon0xfDlX0BLu:SNWHrylWnaEJE8gry2ExLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000002b9169307f08098fc6e0f4303e585a95ecbdcafd788e088382c0673f585adc94000000000e8000000002000020000000d04dd241879a1b7068ffe4bcb68f75d7cba028f5beaf41818ad9e37ebbcfae5a90000000fa69332c6813e49ff7357aa88463b8465393ae913e3a7b3be21b27bfcf256cff9bac1c5c9fb874e3f4df2fb3ed8cf9deb573c555942e2dd322dbd8efc9afc7653fddb8fab656e25e9fa8bc0f76091393699ad8d9dd6e7ef35f4c20f82ba2d41ff8402187b6b4a153b0285e39d4f808ba32e121223a0252f324cbf1065752e1c868f125f68a7a028ddb7cb188d517559c40000000fc7128e24fbda4862292e04db2aa492ec9372b3c5d1dd58f14a9825da0da6fc01bc6eac26f1c0990a2f3693b472ae828952fae32291aa0a2c1aaba961adc2fa0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C69A16D1-3EC4-11EF-B39C-C278C12D1CB0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000036f6a65ff7fbd1fc4b6c3642b2f268becda06ab1deffce6470c8a6dcf3116258000000000e8000000002000020000000bf0b64aae73da2510fbdd0fde1d62ecc3ced1c31d09e6b978c7aaa61d04e8ff2200000003a37d406fe6dd2d61fbc348424237dc89f95c376a74210d9651649c07b63d947400000001babe3e3a8dc75e5ee72b8606f145b7991795a908544f147947398c756b2d2a3227b39920370ae199be32a8c8481de085fcc5c74d7bce3e2a04f7d822739aea8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1079bdabd1d2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426781903" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2904 iexplore.exe 2904 iexplore.exe 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2264 2904 iexplore.exe 29 PID 2904 wrote to memory of 2264 2904 iexplore.exe 29 PID 2904 wrote to memory of 2264 2904 iexplore.exe 29 PID 2904 wrote to memory of 2264 2904 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\350080735ac73e44c523008718cdf4b6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b240ba14d515a8f3ffd041da9e0b4b7d
SHA142ed30b17ab32ce8630f6d03d9ff1b13b1c419c6
SHA256f72d8c3415e0cfd03a171314ee47b4653a21999358cb6dc52eb0b214328dec31
SHA51209acc8fdcda90342618a077e50320aaa679aaee8e11e99eeed7ae577495fd8c864a976343b762af88dcd319e9c8e62b3df82e64cba24f770510c73294b1eef1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a5c0cb0d37474ee518900b055fb3953
SHA1df7afe284c6de2c449cf4825d46e80a2f59fcfc6
SHA2568a999ab2b4a0832582601f0385025335d9370f620b29c74a1200e999a23ba359
SHA512f97b6d8ecb4b245380f62319fad1fc8f581a92b36d28155adbb90abcad83b5ef05a3511af5ec6b9b488e350979081888c10b957fecc0adba9ec78743122e3709
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed46732ede576c0a93239177a525f6de
SHA1480d44c2584fc5d07255d5e7587fd214e5fcc067
SHA256d16bc5d9df62e2f2bf914af63c5c7b41a2aa21d63198bf6902dd617dfb59bebb
SHA512a793f6d997dbc0e069f7dd19318553a019fd32bb93e5af1ed17ab580061049ce971c3a1efe686a3fb105a299efe8c654292fa4898219168c6e0a6a88d6cac931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ecfd7793c6291f1cecd33af01d7cf98
SHA1b1913feb296390de0d142a288542f5e65d14795f
SHA256cc888e70a293ec2c109a8a4841c2f2ae77b913cd5634275aa549cb218a467948
SHA51232654532c233270ff787db200d270408bd2fde63aa361fed73ed4efc94b15990d1825f9226122b99046eb926aaba9149910f203315e7aa6b0fd3c3440b34bce0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565328cc793d465d9836dd6cb72048b95
SHA13a853f9dffb5675815e0f3e8292d645b0bd4cde9
SHA25670c417d212d36238f4ec155d4e9dbf6dc33b7c1798b7d919bc1af6d5fcb0d080
SHA5125c8fb50e43d18cc2949b7fe029bd3e42f15a2e046cc91155e476bdb42629d16742f975b405f30ee5d6e0295563367ad093702075799d673b4d0d816daa944842
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54eb5a92e7f39ef5a5ea497e403a9baa7
SHA1c9d70f0d81b3a8542a96725d32bafe0ba94e3ab5
SHA2560b0501bc438abbc408e17d0c2c4b506d26d616399bcbc2fbc8dc12653250cc70
SHA5128e95ebfbb7230794318c647828995827e84c70a3a2ff8f97c9b18a5736acdad82e01257a44174cb76210cb10b7b0cb47409bbddc4e389941f4b62928590c783f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffbc9e88098ad9f5243edaf1b0c056e4
SHA165efb0642a21f95c8dea78cc2ef8c12d25614671
SHA2560fb4c61a50a02e9a0784c9915b699f52b1c21c8cbabcf4539fb47e2ec8b8ba61
SHA512550f803788a6bdc80f9cf22570b61d6c9bde0f8d4b877db1c3a8814827da2ad96da1fbd5c118e26d8daefd906a467c9e0b3528e89e1c85547572c404373ba459
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514fe9a4fff1fd44f83ad752606c411c1
SHA10eba8d7341b5c1356364c9db58602a007b137007
SHA256d00c72e63a5947497e58ae9e84dc42f5af117fd71dbd0c0e116c6fad780cef15
SHA512d3175f61a57d469a400b3ddebd60526ea4250675543b6d5da84a162d81f253268278b6f55db0fb5c6259e0f877401e5d475c69a10eab03f46f58f450ef4ff1bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5169c24e02caed85a59296e62d3127619
SHA13be860af51851dc5cb0dfe2429dbf54aecfa0088
SHA2569f802ee439b09a5d99a9c6178b9eefbee7c078d15840d1c16f29cecc57c22fcc
SHA512d52c2c32c72ea2da9f8dd7dca60c6ffdc6abaf1e73a7354a9c8ee11d113a90dd9c60ec966089d08b63ea205090691e80703f89be15c374fd0286dbba20187997
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acd992803864aa2dbb550696683d4ad8
SHA11d51388ab6e8728b488cbdc9bc61cbf9a0009d51
SHA2563a10dd8485fcf67e857068b8659e4d5fd6da54543e0f069d8f3f5dd14e17c15c
SHA512ac53542e701612c6de09f86c600d6da2410531e185d31c3d34049ae9c44ba320560f3978ce9e2c2e21100859c2b507352561f97afb0e41bcec63ff9ea98ed138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a98398453c1a3596b941586a1c9d8aa6
SHA11f09aec72e112e945af26d5337ab4f3f3b785a9e
SHA2563ae8860919c1bc56b2b77c2af18786ad43ab9622e8c06f13cfb69b189f95e205
SHA51229fa22ef88237644782cf8dd26207ae65c203946800bbafa81447c0873ab30ef4971378122c903cdcaa95362489d5c184e093cc3a07372cb348d332be13e433d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58171c78c92ca29fd940c2303b3c5d42b
SHA196aa7018a85fd92f817892779e6b910bea3ac8ba
SHA2562c77a4a365bd8aec9a1437558af9c36b9f32d03acabf10d9968508961d217776
SHA512407ba487b2580ac17cbdce2ef8a945fb40a6f2005e5d135081341f728164af47a958e27db8c78414e5b38356e79c01e5481b3257e79fa7fa5a4db8cf7cbab04c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551caa1b651b06d906ffa416e30d6153d
SHA135e1a7543acee02d8e826760587651ac7fc290c9
SHA2560302f60405b4635b1dcde342a7c514d44724aec52f1241e67193df39400096bf
SHA51225537d6bd61c42fdff1e1e3da1c3d89bb782154b0706f3c57426fafc634139b36cd1ccc5b3d0c27437c80234ea4c922a657273e9c054258445ddab4ef4e86c51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d137e08391dd735a117cc2a605210663
SHA11432b944e52d2c511ef2ce6ff1201b362d04db42
SHA2565a7d3e06e7e3c5767745c887bb9a6ca56fc3fcf8cd432f1800bc49a2c3402140
SHA512ecc16103e9ec184047011a736f416ce3c43c191791773a39019d879063aa8373844c468d946b98049af3c77af768048b1489edec5a86192bd9d25194c1dac6b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a243331de8139d60c455fca0ebe1dd4
SHA1b3f98687ad8a6d9492301fe06f420e592797bdca
SHA2563ba4a74b1ecfaa04c42b9fd02d1e9e08ccbfa9d2d7632d23c927c8996f1aa212
SHA51225a173989d429ba48fa716e4c23b6742219908f84a7b66edb32ff03f843e21446e6ca7f048acfc4b34ccb98f23893956a5831d2ccc4c478bbda50aa1160dd236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558da58c7dc88e8e8b57f3eddd506d265
SHA1853e8542441ee1f39454ece45d0ea7725b23d030
SHA256fe2af213720836c4225870735b5cb22720e352791397b279d26e0ecca4ceaced
SHA5129a61d08f16f23286beb6320408485a795f6a09782fcf31760b7016ec4b64659527afb6ae7b6b780e186596c97df590a254fa6056b2715cd10ecf0b28e124de6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523a210aff1d957792c75c4622b707431
SHA19254eaa81454aa45074ebc050c8925cc1a5d6aa6
SHA2561e47c9f24413b602bef192fa4f71aaad6028f56add3834ac005a76108fd2d610
SHA51269fb70acf0d7f322946951d7e8237e03eaa9d76b2f1efff054b1c3c26393f03b4f238a3d76e26cf823920b24efceb4fb868e1a55b1f34cb9e2d9e205192053de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587abf47a6c8a8ba98e1cadf209d0ed5d
SHA18582f48ed46cca8be0f33822be38ccb9bfd16b6d
SHA2562b818fdbb5d9996600de308ae67a9d1063137d08f3a7318dcec73f5d1126eb7f
SHA51258663c5ffea6f2d6149f347dce657875954368186ecbb96ca61d39fea57b2ceaf6c0d6c6bbff34485c4a28cb82bbaf357b87ed252f996a4ce255621cdfece301
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc6b5060077deafd2eeebb82fc74a134
SHA12fbfdc4b099ab86f56881d09c812137c29b2a472
SHA256ace5782a18ee9244ae128eecf2750f77ef7e71960cbafb6c1964ff1b3c7c4fc3
SHA5124582c6c1183a008dcb1a4fc585b597ad67e6b3b490e1942dd00c82a1c1b4a6801f78fda88d04cd838c257abcd660595a7bc1e70154e36320eedb3eef8a0c7928
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b