Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 03:35
Static task
static1
Behavioral task
behavioral1
Sample
c829f61cf8ccafe403fd4ce04726250d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c829f61cf8ccafe403fd4ce04726250d_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c829f61cf8ccafe403fd4ce04726250d_JaffaCakes118.html
-
Size
7KB
-
MD5
c829f61cf8ccafe403fd4ce04726250d
-
SHA1
13b00d46aa700d28835a78813f1f783297bf2fd2
-
SHA256
fd61c75a103141d60d7dffeb2f449865588ef7ed987e48af2d0880962a57716c
-
SHA512
325736775a3e5bade7d1fd3c1bcefd570689afb4644591aa2469a9743a92187c01f7c8137e6b5e4cc1a7cfe510a358122a12decd86ae775f74d2a73db4ea9253
-
SSDEEP
96:8hcm7ZkxiozuWXKca626WjHnb/BTXyn0wC9pBq9pa5J8IgKISMQ3WNIYpoO6RUFZ:8hX7Zkx7ZaJnLBTCesfdVoOmUT
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431064429" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09bfba4c4f9da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000009cd511f774b514765620962ec48a1cad12b067c60a291dcba6b5bd359a1ce699000000000e80000000020000200000007a58e17fb7f9f3e8b937f1c23402f31b4b1f3eae7d2f2362ac0d5c3d13efdb6690000000afceb59a08f085f41d6d75257bf08c6bdb346e1c5ad7fac2074f6ffa3b36e7610c4721a9f0234918bb6ecf92814009e5335d23d3ebc77b412c6c6a9e61721952fa62be1b24cc5a48bdace3f68882620ecb070bac6b9d9701226b6c80590126eee67708c70e6ec064775c386d638555ae6bec6f0e01abb4a27b3b0e440549f731841440433d438aa0e61295cc125c5d1d400000005084b82bad8d07af5521f8f5ac4223d3df0b79008494ad8a2915174e5d071939ab2386e502b8f2a7b246eeb11b420f6d5bc785e421672c4931b4ab0519b78bd5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CED64481-65B7-11EF-B062-D6EBA8958965} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000fc99e39fd458279da2e4e5943bef195c9d7c36357a71d8bfb61bd9584e1a06fa000000000e8000000002000020000000035afbcfdbe52d4511bf0e7b939f439e1eb1f750e44d6cf0b69c8c925310592c20000000c2e72afa436f493ee18a0e31de7655747dfa624bdd5c68c29796bf736135673740000000517aa562f0cd11d71a6c4a34caa9db7c0723ef5abd6f8eaf541322591cea94bec42df63728f32ab2f2009b301e0e04341bee6d83d9d1b2b13c9befc3764791cf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1896 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1896 iexplore.exe 1896 iexplore.exe 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1896 wrote to memory of 2300 1896 iexplore.exe 30 PID 1896 wrote to memory of 2300 1896 iexplore.exe 30 PID 1896 wrote to memory of 2300 1896 iexplore.exe 30 PID 1896 wrote to memory of 2300 1896 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c829f61cf8ccafe403fd4ce04726250d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1896 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c772b4e0f193d18cf4dd1887267bb3e5
SHA1f2a378d5cc546c8bd30a983f3e3b3d4750c2b10c
SHA2566e98e211af71a3557512cd1f23c779df440808091e525aea65c9c24643281625
SHA5129c13431de5773ed6d2f73a3ced898863a7a6e8a65b400ece33c80cbedd274544611624e722fc25b2d4ccf881cc9cb27559c60538bb0f66865aec692a1fb4437e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f3bc247fc6215d9b83dec79e25bd6ea
SHA1025d1a91a1fe18bc2dd6e6ed11586970ac725b05
SHA25677b1ef74481862b5d801895ea7c5fcba7b5535ac361ac6406f44c9dbc0e2f059
SHA5120e2a008f2de7d38b9eb0d895ae6db832f1be568875fa8e6d79854292a1476b826c8fe34b75f8a3fd8ccbb5bc8ab623e48b46294dbe0c402b1df83ad390e913fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1b56fa68bb7f333f6aded47d89fb234
SHA1d81ec789f3f44785b014ae491ab4e20ab8e7119d
SHA25675702235d8318d4354ae3b0959599c7551830b87b85ff772545a7065de0fc984
SHA5127c324199e477acca962f6d4246c521c9e6aa74b35f6df2896791efa537cf547a5b7f173a9d322ec0d2f0144764469bc0883ee22f0148c8a83806adbd1cbbbd8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba6b9941144acfe000be019a87b1246e
SHA1611b08c29e175824956d3a967dfebf719f8fd0e6
SHA25696cebbc97b41aad4c876fd5d4557e471672e1b307621ec0d825a2e2264ce3392
SHA512ea2e7a008fc38e5b01d311302c29b8e870c585f4ed864fa29b4ae539ad8531a7abe1dcc154e633fe977b1a0ca0b116346cea2e898c93ff0ace22c35541054b30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573819b6bd5794d491d40bd01354429c6
SHA1baac2d907f18f393d2692d0ce5b5547ea1c9b4af
SHA256fe82c9b395fdc68e8c27b78cff3206ed48e73bd864631344375f56ab232f3582
SHA5122090f819631f7f422de877f33c3b062afec3bf3715f36a1948783b2d0612836e40ba0d87a3abe7956bfbf8aaae51b18e9d35235d3cdd7ae2b633249f95615ea4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c65413edef509967c2fc0d721b3ac1b
SHA1abcd58c2a0b791b0d86f4c59f0e7d2d20a534cbc
SHA256d2a0e2564f027f8ea4b4ee69243bfd28a135523e09005c57409ef5c6842bd509
SHA5125930cb9ff1232492bf37ddfd3318c66d7281524020d498f8bedd089ade086bc7493ea432946f40eb7652b72f18bab6b0d32bf6d840e8ca98ec02377ddf28e5c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b76346ee4a60262ab5f216c5e754ee43
SHA1e2ad8b64b85de7439a79aabbeb43e86c2be959d7
SHA2564b9f616f966c62a8825c0e31924b4af1979da46b0771c417abeeda5a484ca7be
SHA5123450cbd3a9bf5a45012f073303a8a1223be41fc88cb33866a209db8ac88fa5667736ee63c9b1790cbc9bbdff12394886f481bca208a70e93b3b6198be38ea9fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb5844b0de9f10ca33de4b71053444f6
SHA1a2ecea684e200f3c1473a219c97bb050334a5816
SHA256b9863bdbf5cce8de312eb30b83c125aa0817499d78bf43c7c61bc19ed01b71af
SHA512546fa66e83f741ebde176008de591533e09c0caf8de40ea9efb4dbd8ee50f822e7ea438c95c4ff8613cf6972311634342fd274c37b72616f2d694fafaf7b3616
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572aba6ad20b2a056fd19f8b89d68ff2f
SHA10799811e0edbf9b1c1cbd0f4bcbe6a227a247f81
SHA256891263cf0e6db7c31515f98bcb6bc45a38cd62a034f76abdc6d938f26ca3331a
SHA5129af2baaf1c1d420d9d5fe900557f362e35709261e8a555ba1243ce3ff367665fa1ccc578415a0f7266c451ffe4bd04c44add15d93c1fdc1369f7012402f80e07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5353866eb2ef6c6777c39d179c5d2c6da
SHA186061bafc2208026b3f0360df861b78c5d7d02f1
SHA256aa43f609b5ccd95d9ae26613ca4282b6e4427c92e76ece312f7266828f9ba8ed
SHA512d66f41326151f28ef698d76238942b6d8d40b6d76d3f8a30a2bbf5681d415b4015bd8eb45f5e94ffd3d905a48bb636bd1b7cc8abe26e7be5dbefc7c5e37b6150
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1b0a8b2f0035bb571c0d00bf9ed270c
SHA1034a23f46c37cbbfb201a794011630a302eb1e27
SHA25627307f1bd3fb21deb7a7d8cab81cf22efc41f32fe5003211c330a3af2e7b1805
SHA5128a58781d5b5f9b179a15dc988d95c9121af10f5db0fe09c8ae9833ecf91b78a958f95320da0857dd2fbd29960e9f01eaf1d749ff856fdb4080207cf927255578
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506deeb3591dfb833ea433a1c30ee5ceb
SHA125d532f8371f58144cada48c4b3cf8b210229fcb
SHA2569e4c3f5284f9412dbcbf150ec3f952960c02c5ac1b7750d76318cc956aff6a97
SHA512c6dbb380f69be54ed71e2c361347e5887d58013af348e555ce0a454baaf52d32a3883e553f9e27a74282e4178dcdf41ce59b1ecffb354f111d5b2bdb662b0ebc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1d6662c7228c52cb1521060bbaa423a
SHA14d9360ccff909c65d3900102adcc372d743f4206
SHA25614d27b32aafc0abaf52b908a5c662818aaedcd42d49be63c4d75d62796620934
SHA51276844f938fd087d12c45ee8cc7afdce797d31867be8d91d9a0d44bf0b47a850a7694d559857ffe5ae9741e271c33b6e7ae7f750ecace1cea046af13f570ae4a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d65db45b5076aff534c92e13160a6e65
SHA1791e664814d590edc66a7b716825d47e1dca571e
SHA2561b7765c239b01c53ea9a445b17fa20a765d68e8af53fc8c8f14bf07df2cf8948
SHA512f1e0001382cecd902485356cad2f6990737b8ec28b9797d3853c3e314d3eba9ddf541e1ebc4b5ca71dc26357d71f984572d7e49eaf400934ba2a9bbce26c7d3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1a22d2f82cc1bc0e9eb9f2f2eeee306
SHA1d54188fed00b9f2d4299ad412adad1e58ee19c66
SHA256d0224eb3a594aca79939dd94ac476537a768e253e479f3b269b1be882554fd0c
SHA5129a3e91d0dad9876c60fb7a46a5ebaae421f068b3e5ab3f40f5a6f4df2581dbe41de220b62a0a1d9a69996a694f78e713d0b0ebb3c4fd8431686dc402eee55675
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f26c52d6fc668edf6488585a334bf896
SHA1dc71c97f4155c4b00adf3061f26a1620d1c0445e
SHA256dec439771160f432774dae87cddff7e4917cf367231206c3f221b6ac314cea90
SHA5120ab84e618fd4d35f0608a3b02d67901d9e2bfbb882b0ba670ce7838affbfb53d5a7dd490bc7e605dd8a665419bb85cf9bfa0c7b66f879789a8938083864b21af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bff890f5bddf70607ae765b3f3dfec66
SHA17285644f853e7c56b29245151439f429cae95f88
SHA2562d323cfc22f2fa7b48721e2ccd45047a24ef25228a1a2277fba8e8fe09719cd1
SHA5126ae0c68d43950b273e6ba8335d99175d2acd85d76eca01e74a67db6779a77a1d9e167270042657e5691fc866cf4de2a696779ca259e32094bb34f5c494bb9493
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aed2de80101a334f34bfc5b8e67c27c3
SHA1b3d7568c3152773491276eacb63c812fc1867f68
SHA2561d350a54176d9a0568ec98cc8b421ab47fbb1c5d90bbd76a3d600c1e5f152de8
SHA512925ae02a8285d16dba46a394ca8b0897cdb082d5d3565321b09614347abf77b939caaed9f0e2528629cdce71d52d0170bf5e34e5af76e5060ee5c7695462b1f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d527a037f507fb4defea1453660f83b2
SHA19d18dda661250bf383351aa89fc76db9f039ce15
SHA256dd815d32952d2b61dd59501a6fcb72bf7ef5c19cfe3b2d740653bf56c8ad7af6
SHA512f9e5082d41aa348168aa4be6a01c60c14bd694d9bd03fca0ff8e4ec9038eec0ca20476a81640ba0f3f71c1588dca010bb5838c990521a04d1cc20e14660390ec
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b