Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 15:16
Static task
static1
Behavioral task
behavioral1
Sample
39a8e43a0e6e2fae14451e08947c3d33_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
39a8e43a0e6e2fae14451e08947c3d33_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
39a8e43a0e6e2fae14451e08947c3d33_JaffaCakes118.html
-
Size
6KB
-
MD5
39a8e43a0e6e2fae14451e08947c3d33
-
SHA1
498ce324c5d6e84b3a4a8edad09a076e7c752153
-
SHA256
d2abac8bf0f1bb532c13730dc9e1221a44dd3680f7734d063bf3a636a378de82
-
SHA512
b14a30c1e8e258adeb04daaacc97f9266808864251ddec1fdd983a9c5856acdda9020f99f72bdcb4f804398ea1220e7ce6ffab9aec88951df8707c43afe0002f
-
SSDEEP
96:uzVs+ux7XtLLY1k9o84d12ef7CSTUBZcEZ7ru7f:csz7XtAYS/8b76f
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000f7300c615f1a2189f5c08d79d8cd0edc32e5afee331a1b82c059ff8cd924fff4000000000e800000000200002000000003d915528288a9137120b51896318f92a6e75c615ff2cf6b4616ae3998a2ba4620000000c89667182aed42609bfc3bdce484a08b0be3cce68ebd51469657c64fde48ccbb4000000040d9ac30ceb86af084bd5abf4aa4b7a33eb2593a412102a34bc8f9aa7c7d38a9834e92da0ab25a455c6ab00f7f1a671698e940d9ce7e93aff4c57f85b67f3d6c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d4e163a5d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8CAF7A81-3F98-11EF-AF97-4E18907FF899} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426872858" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000dd57b547101deb64e59e118f7ca85d23f651c8df549c1c307c6e0eedca992c62000000000e8000000002000020000000d074c750b0a82941e3e864855ab7412ffd16fddb691c226379a22996494ee14c90000000988b49580a47b27346c0ebb78365bccab8a23e329ea3c09406e627973ea03f1b581f3874b5723cee2fef266ab3c0706e34b757f0954a15d53d19ef879350113d49dcb27af82f6de65bc79819d4d45409be3d37d27fc99803de78121dbbd6937ff49da4b28cacce5852cb7f146bcb962a0b4f615e5700ddd1bde6fb7d3e443ef7cf66b37e7aa8ca1473bc995da6ca4f0040000000c9162b9a2863bcc2ee5d4a6960e88fef8b033c1451554cb00baa7e0e8fafaa24efd15ead92b7e51bd048225e9c0b75f913c392c144218745a952c015d41a996b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2316 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2316 iexplore.exe 2316 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 3068 2316 iexplore.exe 30 PID 2316 wrote to memory of 3068 2316 iexplore.exe 30 PID 2316 wrote to memory of 3068 2316 iexplore.exe 30 PID 2316 wrote to memory of 3068 2316 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39a8e43a0e6e2fae14451e08947c3d33_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cbb833836e727d10c286d01e985a8ea
SHA17bf15732e21c95dae95a5b4ac77e87b298745b3a
SHA256fa097960792bbd935706784fc686ee3171b2ab4aa95ad69c976278e6372febe3
SHA5125d930d7bd5ea746be4e09cd2c60ddc6a5adc0a333b76ecc44ff00d4ba43bd7bbc6b2b8db78c540515cbbd1f912c3f186dcf969b634fd9763f1669acec58f327c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56898094b8b2a0a8184b61ed188c3fc3c
SHA1f0139f96d100a61297a0f02e2e8538e69ed4de43
SHA256453fcff7f5e2ee4f951cb69d28a5167afb7259c57e735765ffb1078110f4490d
SHA5123d16d6c41a59e9d5c6783cf0d1727a053d8afbb62134022d7079a8e6096b4a8db547b3ebc140efcd0007c8dcc6cf05ce03e3ad7eea642ff250191f5956d2cd12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5c6186f83c3d38e652f6a618967c158
SHA1fb5faf41f1585942efef9fdde0fb4e18c4368554
SHA25695e795d1eba97f262b334da80be97c33fc9a7a778f7654bcb9f178c5f35d6127
SHA512446bddbbe83189f9b6d8ab9f600cf75d4935befaa280336d82f05e3ea27e6926151f4fb23c3e52c59edbba37c02a0c5ec9b04299c3f353a53d121237b653c933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53926685e5c9245ed09d9b3fec524c58d
SHA1d811f1cd750c55270b9b1c1bd766deb5e49a0b2e
SHA25692c840197fa9739d776b8047abd8cc3f0ac100b197a4a8909ad85d4531926b9f
SHA51231e8ea361076899c12c945eaa6cc53c9128913bd86fd8eb52ffbd2399cf61f733d2c9a27b980bb0dd85f59911ce9f9b66506a43e87e109b3073354bdbe1cb5cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ba5d702065c2017b1abb6020cba1f62
SHA13f60dedf202d1632fdd5de60385aa80cd88c7e76
SHA2568d95ae9994b1a5cf12665e1e02c432d23a573c1a61b0db789ddf4aaf194dec8f
SHA512bbf4585e17e6b5d327a9c9c106db211142e8ea23520c429fa062f938080abf306aaa730ade9f15eaa5ae431f14dc27e5393b89b59e4a153f1f6c2fe577f6201c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc072695030ce0aadbc24c642bcc8b3c
SHA1f18d0c824f942c3676db7bb6a607d94d4c27e458
SHA2560afab6ba603365fab66248b7ec73ab4a86f5f603b0f13de5f62974b5b5bb180b
SHA512a3af2d73b39374f50bbaab6381cf669f93d27c5aaabb3c2deb91328fdb2c31a82f22f11f3a4f3dcbe589b3d722e7554b209cb96f077f7f57040be76236d5deb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51353a26405874fc3c3872bed31e28ff1
SHA15f848e9a5972ec58ed48172a25fa300525c970d6
SHA2567d2205b7f74ea2c4fffcacf4199ae4170f10e581ada175f7933f28b70c150ad3
SHA5127b3ceccf1c93b24d479a8e286d309d302b7a51ff65b1dc8c9069eeed2088b481306ea9005d4b7416fa37d77452cbec81b4844bc235216ec4c499def5272f523b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ccfd2b046f10d879ca2786d5dff095f
SHA18a7a4f56639b594ca388bd6a35020273efbaab1f
SHA25635c6572a918b18d0d080c2f7aeffa71ad9de980d280620bbc897160fb501bf7e
SHA51206c47189a659de6c53b0bdc65b86c942ea8b26489f3fdea7a65beca86c4e05775cee6f7a1853584563701a17f6d5038200c2767b54cad4fd3121f8bd057a286d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8c718715095343efbb26610afbe4341
SHA1f89d2248aa76d3b7b9c469fb43de67dbc008cb8c
SHA256bf24fd9497ef8c58b7da62f53439c4e3cee412322a409fdeadd3f9560a905231
SHA512c7d58070e895669ce1171d582bc3c3eea1461b7f36d2d4af8f8487a81f86015d7983611f8e0e333bb01155c486bc57cf38d2654ec23ab69a762f9229eab07d1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2f4fafbd4c920cbe2ef1199b8eaf548
SHA16bb779584300e60d970393be2b76bd6928e64911
SHA256c4d24881bf658187a07b78f7007f74c7bdaebd8cb7fe6d9a0e7f888bec747309
SHA512dd91a8627634b12f2a9be21ce657c5e7f38764072454426f170b37ecadb9d220fa32c4038b57b7356bf57257cc7c79491c09dfca7fedd4351072071a060d30fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506241a5994ed1575427683fb32c364dc
SHA157f0c3812f3b1f6ef3aa95ed9a8faf2249ded3cd
SHA2569226dff2580a8107be60ae1d7cdfa5324739c11eb4759c1a17749d6ab1e2e844
SHA512043728e4ca046d864a87545fc800a4c1940944dde2b6c2aa92daedae4c7a03f26b78205f9b6d3724a8430c09087194fdc5726e0a2feef04a7a8fb3a90714ca46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcf3ca8ac473a2268bdd322d504a475c
SHA1cdc30d735a0b5a973e1e7de7af681756bd11d57c
SHA256f0f5139b515fd135b3f6f326569a1eb1236fef8bf29c9d7ca1478a2673e71cfa
SHA512f3d446103501ada4e1cdd49df5e529ad89de2a81cd1297ea0aa4726ccc51b58b0b5c74469fdc5d0a6521f51b179794ae8c2eaf71c1eeb31311013347d2963973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cedb264e3712d74ab20fe7fb74c717e
SHA1f75724cf60afb68c0257d32623452964a2abcf53
SHA2560c4b6292a98ceed00636bfd7e4cf6e6a29387bcf46319db5e3c8f6901bdca393
SHA512b462dd9c7ca32560ce579818dafb25d7b11d4314b5f1b468933e94e8302a37124035a32b70bf63a608d69572a956fabf5d956d9e01d6d5bbef1324c3fee0c0eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584e9ae550cac3191a904d90182cbf150
SHA1e8ee5b9fe4f750a29045815307fc032272c273bc
SHA2561e466ac903d730d48c3c12b61d697acf1a0bc227a0c92e096beae443bdb125db
SHA512caa19cc709f3eb46826ce4d74438619f5aa25f845c15e38b3e21d00aaac1480adc7d28f86d422049cf43df25523db0faa4331e74b381e27894c23bd8ab12e0bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9cd61a42a26ac1d8b2d375ba9bf9858
SHA1685983ab765e6c34147ca0b032b69ef4ae6ed269
SHA256de65c55539b0baf175356a88f0cec3b71599f06652fcfe36a9a40d25d386c540
SHA5120fd8933f187996c7dc8d7ad10ada33fe9d5ff430382c88fc4da94599ce2cdac5276517adb0c391ce5627a35da61951fac292620caf957d715203193f9c856a41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf4aafefe0d8bf99d0cce4c3c48efc6b
SHA14855bea97398f1de498f3dfeff5a303fa5d505dd
SHA256e4ac2182dded2f88c92bd28fadc0c6ae7444b495c2f37a50d2edeab4161f96ca
SHA51261e504232fc9a280f79f096efca548fc21acd0c1c76bd02d0da76dce854744254e51afcff308f061d1a8127a3d1bf6168ca12f7b07120946ea484d2c4562782c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a82dc9cfbb2f3d59ccd458997a57be22
SHA1b3b922dc81bea6b9e2fd88cc5901c4913d27d40f
SHA256733ffc162e18e1d73d1e58241b6159afa1056700ca011a89867c1c05a64bdb02
SHA51299be89a0af60cee88600a9622c7ecf75e240d986a48ec9c4a6033789329d1c407540ff996e63791d2551dd1b6eecfa292b1b1beebd717844b4faea9852d3be6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54cfa3f8fd111955aabaf5e3916a61b2b
SHA150428724f82dad9a4310c9d0038b8f81727b396c
SHA256f2fc47abce7ea63700f3fccf42d512c06a278079b9f29557399bdacd3f67e743
SHA512f8611b8f88567ab921a7b2dfee508b7b2a00e44d4ca218bfc6f5e55aa168ed7f3ec14c1d0108dfa50bd1d19386ae7ea799100c0fe094f401b623e7cb86ea0e03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5434618033d72ab69e13429db1a877475
SHA13e8edbab79a3ee433254b6a9bca258cdafe00f8f
SHA256dcb08f118c6a9c77f102d7acf569013d2527ecb49f45ba171d027584f0fb23d3
SHA5127d55684937b834d0879c45e385f8432997fb0bb271d5e33b16820e7cdade0293b675949db82f93fda4e50a0d4b49defb00b2a49ae6ba47ac3768c1980215fda1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b