Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21-07-2024 17:21
Static task
static1
Behavioral task
behavioral1
Sample
60bb8a30e31bc8591f16f3036a25db87_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
60bb8a30e31bc8591f16f3036a25db87_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
60bb8a30e31bc8591f16f3036a25db87_JaffaCakes118.html
-
Size
30KB
-
MD5
60bb8a30e31bc8591f16f3036a25db87
-
SHA1
886388940fe81b74bdf0121a5d067f04452607d5
-
SHA256
83497b2441f943be364174f57bcc01ace64d0703671c8adcd2fed331c5894b3a
-
SHA512
6811a419c986a0f75572bf8f3ce9201160b816537e2f0d679a53c3a4cdcfbed5aa10969238136bd6764303e017958dbf9226e97518f68718b35fa0c13acdf289
-
SSDEEP
768:SbSbFYvb7Y5ubDsDkAJ2dDFiN1YwJot8Lt/pZPk:SbbQ5usDk5jm1f/fM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9BDF8BE1-4785-11EF-971E-EA452A02DA21} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d0787992dbda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000002ad0f3b2829f91b52349dd2d88ed1d800fbf4a43944a0cb811a2cb5bc193ffce000000000e80000000020000200000008a3d428e24618b1dde0e69edab7f573523400ebf9dfee942e68f2e3309ec325390000000ea888be584dea57880dab8d09bf07a29ca11d198ee2137554243766d9a43fe7c51444758479f22f3f817e64c578eb46a63da6fd4d304bd5dd3de218cc2e8758271b5000f7d220fd862e7d23c69d34cb5b1e894053fa1729b602cc1a53f9d01ca35806c32531e1333c5ed933d79523da85cba387ce9f9b7a8956a651d0acfe26f33b9d73504a63e172f0847b6fba8a65a4000000002001e937c4ec60c23d2989a0ae5f32dccc0b90630e50fcd21689a8da4450580ca6facd8d71eebd9f0fc5dc4337b9e9d0e42d46f02eb35b8156eb26a770614b9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427744332" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000080312142d4d64ef71c44e81c8555a87f2a0ac9ef6307e06cf8c98ae3418a1737000000000e800000000200002000000062e64c048dac02200813f101ba5f3175f609fca97fb2833d22aab703d9f45b0b20000000f90aa595e6223fc6396625bc37cf4e476c83e6bc90fd2699bafb45004561425a40000000f43bc83c5a7e3dfcaa36d47139edd31137d3e42bf78d7a48f268ecc477140f67dd0e03069aed061be096e2721eb2f9179e2b3d128cd87f16bd3db40584ba160d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 1896 IEXPLORE.EXE 1896 IEXPLORE.EXE 1896 IEXPLORE.EXE 1896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 1896 2088 iexplore.exe 30 PID 2088 wrote to memory of 1896 2088 iexplore.exe 30 PID 2088 wrote to memory of 1896 2088 iexplore.exe 30 PID 2088 wrote to memory of 1896 2088 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60bb8a30e31bc8591f16f3036a25db87_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571fd73e88904d64b97bca099560fd38f
SHA1b297af089d1682be09878ce3a31e6f4e53c9aa0d
SHA2563dbae73eb52006c007a71a827319a922fa6fe569bb5527395014ee0a6b62cbcc
SHA5129a4d223f89140cd7abd825aa31f5eabea5bff4fff131b9482fc3d8e38c16fb15fc973b9a0ed1f5e5e048073c10eb5dc494b85a24bc63e6f3da84cdd6651bffe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5986e51cd37063c7a848c852465459ab0
SHA1b073449cc9a45dcfe30daf90920e16342612ccfd
SHA2569b6938d9df67ec7d258f236bf7d9524ddc1d46432d51fa56acced5cbab3f848a
SHA512af09a60e04e60333db5e2f3333566e1756c270d854d2487a01b43a4f5c5f1fe3c7f37d75494eaf04c4d73fa84c845162afec3c68be244a130d5edcd12dc9c333
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b33537b72e8d853876d9321fddb4d540
SHA1377d8dde7c84a0b2a8bed671a4bb24293519f25e
SHA256084cbaee111e3d82891f4f286a2e36f7df5a4eaba68b908662e92819330ecc49
SHA512dc41ba59536b988f9ba3f224b2925960c28e99f5037c7e38069a96cf7a4b5f9ea38ef3310b04c886fbe7f78178e0fcdf847a94241b9ee799a8be8b03d11481ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a49251893bc4f85188a274c818916517
SHA1033b812a89515647e9ce06434ced1ee2f54929e9
SHA256d941443cbd0ebc1b550e0555d6c27514dd6faf3147b600630936c88e3bd341fe
SHA51237dc4fadbf3f0b5ff560c89298e4a4c23b1d4144e25113f0131e12a60965714e3393ec94bf15093caecccdeda75da138263e4b34ba31f34582fa00019467bcf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0e6156c02de595fe1457711644c361b
SHA1b0d82a87537cd87688724f350ff27acf9fb4defd
SHA2567ab77f60a6d8bdbc0a20cacbe83300aa61f9b2fa7d413cdb2c9b9d1947b54cda
SHA5126de610d1cb30f4eedd646a5a41cf5974e3715a4dfa9b135caf0447add017e7a35d87db2b914943b357ae5b9ce6c0a2b0e032181c4a7ea8d568db042b9229e3f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fde06936c9727381a51ce89dde08b197
SHA1f67270c947606988b7b7e1a33dfee9afa2af8b51
SHA2569299368a2c732c6a8ba40f231dd4cebb38151668c5bae013a1f02d35ece9c379
SHA5122e282fdeba31586f9aa4b3f7cf97f52aa5befcc669dff22dc85c652e03c3fae5a4ae1a27d4ec8b2bcaf4257ab5a0a48595f317584c97ef5e83f2bfb44fc0795f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593a0ae707dbc1865e2d4e9fc3e6c90c4
SHA1b95f307b0836d301dc080c01ec2822e13c857438
SHA256030cd000ba0190f70fa73262ed11c9bf12905f02258b9ca51b2e627842d765ff
SHA5123d57909523cc6f8ec8d70d0a42aba9b39236908882a301d3ab6e5f6e0d70f323ef56eac665966397a534dfafa8813ae7b123a7a6f8ca7082d0645d5a3052a02f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea86743a6db6e823d1748bc51fe1c0ec
SHA10c4b5d87d980ce573cc96150b7effe535eed5c59
SHA2566d90d80bcb3490e0989b2811fa1a6f092a15d458bbb6f12811999094d90d1c73
SHA51297c1719628a470f53ac468cae77776262b3838a53e100870730f2b5dfb8dfbf56ec03fc89163961234cc0371c69773ed057b38afa2a6a61a783420accb5bc57b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bca8a4e342a87e4c5fa1f7b1da469a23
SHA165ae10a3b2f1b4f0b1443bd9a6fe5262e2836bb0
SHA2569d117e5647e46b26e5520058d20cef8cc9282b1c7040f0be428a2e104abf758f
SHA512438e06e6e67230b61f7c6794c00a6a527e0c2efcaad47d5ae03fb70738dc8bc2a872e6742d3af9a52182c332c732850adad044487ba6e37c60d679a7de65bc52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56891fadd05231a41eb9635e863276b4b
SHA192829508e46659071ffb5c09facc2daf424e89a0
SHA256fbb71a4e7a925d6595a6e4d975e0c9634c82d2e93bd41e5b043dc9cca3a3e1b3
SHA51229b09f27fc31ef079f22878a8cf7293d10d3fba846cce610f9dcf96c280fef0ffc78d5541d454ac6e0c66a8652f7d8945d322347cc8dc48eb9d110ff737918d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579061c7110842db03f73ecfb50f7e463
SHA174127371aa9f15d32d9ba8b719e7acfb4a95e434
SHA25643bd5fbbec8c9e489c120fbb25af705b4448c0a8dd3601f1454f0fbf73fa5eee
SHA5126a46bd6d82a0c29c4ef66454aac3b7581aba4438520ff36b048721fea65dd4bde860c186666195d6e0c0adf6fb51cf6cdf890200bb69d2b37577e22987b8e444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebc0802b5f3cd7a514ed6d68fccd2f02
SHA10cc9bb8722d5ec541300b685de3e8a7775a84a6a
SHA256b1a93c6afbc3bc751be686cca140450f794188fc9a32aec131ae956789d904f1
SHA5126ea341b4f68950908b450e9650af5be48f265502d0519a2148a9a6e4095e551f18838c82c4f70ef60b0573789a620a5907503768a111fe5cf7b35e50a118c924
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54cc055383eb893f94007447a907437c6
SHA169b79027d4add401fcd171e9fa3649f48842e479
SHA256531a04426cc4c58e21902106692dccb78c39f52e41245fabbbf209117afc0877
SHA5125071d0f5d3680ced68f7e95c8c16c513ddc38de2b4acee0856e42cd73bd43f68c10460d5316cc42d211953059dd066712a00313a304a26182d7608ef1ae217e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5888ae857bbebfff26291f9ec52aec2ea
SHA1ccd1b8ce158be16908e9dc3f3bc088404b65313a
SHA25654d6da446874b48e5c9e6c25cd7e252aefd62d48f0f14a6c218c47a08018ff00
SHA5123742df47cea8d53f279827c89301683f3eca3c8c8995d191a103579ad37c8d2b4c62d7cebe4a5a46576469d4306ec83cfd15479b14c9be694e161aa2e7a270f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e11dff5e5ba09767396cfe5565c2cd16
SHA12d8fa32f5bb89a9cf81fcadf8b095cfc675a2dfa
SHA256cfb32f557afa1b05724b0378eb8717a601d1a2a6f8f7a2c7b8a1c720d835b883
SHA512532cbc20afcc0f368999aaceee68682198cf8b9b4672c13f62b7d33d234f17287d0fba3ce6bfcd63514ea14d15b7c3e18a6744b4caff7437470f3d794f528102
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ccbbac196f5e6acc730d01f220f87cd
SHA1d95b82c7340d92def71b71c43551b8dfe4c3a964
SHA256f194947f5b1ebfd5dd1e16e5e653f2a5a557e59c78d72d05bf38e0b3ba924744
SHA51233962bf0913e201ea1a5408db616cba91ea13a4eac969d561d67ee66bdd8ef45fde2f824bb300c8e55f7e746ae81dfa541ba8cd0d98bc7a229a343e4446ab2a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2582cdb6ed14f0bde154efec47a4244
SHA159d55d9cfafa557002a04181697a4906a8cd8413
SHA25666dbf607b8409778f8a80464af11efbe8406e91ae3224b6d1d03187142c7dc81
SHA512874c16916a7ed2047f90c69850e5bd727be1c75d1b60310d5ee49920f2edc2322ff811aa35f4e26124c7e6880f4f4e9eeffbf4c145db7580273be1403b2919c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc4e0afb10f0e4be6add7e690cc52ac5
SHA13b610dbc79d40bb70e18834094bcbfa8d6cc6d08
SHA256cef4900bb804b14cf0a0de9a718de80adc1db8c86d60694419bc6f4b9b897331
SHA512b23496ea86d58a9f09e628ed4b10d519fb4db53ae6b25c2e7a6de41acc1d6fd7aa5b7283fee5f7eb23497ade02cc2454412aed81943ec7cf2611d2b36d4d5b73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5221260329bab7e6012fd12a9610d54b6
SHA1e834e1e01f3d654552bf385406ca9b1d1fe89634
SHA256781c1671981eea2dd156d8b284fecf0839c57aaa1e05e9c05840cfa34d09d320
SHA512156376d0fc7f8dcdbc64c598bcece97961a4b07c0beb0b56523ebbca85367883ef02240938de24a4f5021645737844f6e74492cb652b28304d930ce157c63c86
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b