Analysis
-
max time kernel
133s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-09-2024 21:35
Static task
static1
Behavioral task
behavioral1
Sample
ea031e84bcbca334b6d6bcb19255ccbe_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea031e84bcbca334b6d6bcb19255ccbe_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ea031e84bcbca334b6d6bcb19255ccbe_JaffaCakes118.html
-
Size
175KB
-
MD5
ea031e84bcbca334b6d6bcb19255ccbe
-
SHA1
d823116c71ecb210212ba52b779e48876e829171
-
SHA256
dab46ec3a62351124f01024f93260a9187d138865d48f32cc3bb582340e709fa
-
SHA512
f9e19dc8766afeb30e7c95d58c925fc492aeb91ebcc6f16d8f4bb822b75a7c6030f67a129a2540eb8bc24d15b4f938919d31dd4ff360686e60e453c5e9f4e7ea
-
SSDEEP
1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3WGNkFHYfBCJiZL+aeTH+WK/Lf1/hpnVSV:S9CT3W/FWBCJiSB
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432857194" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9366" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "39412" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "9454" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "19370" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBB16BD1-7605-11EF-81BB-F2BBDB1F0DCB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "19370" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "19288" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "492" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "9448" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "233" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9448" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "29479" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "19370" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "9448" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "29315" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "407" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "39406" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "29397" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "20527" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "407" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "407" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "29315" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "39401" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "233" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "19376" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "233" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "9366" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "325" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "39406" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "29479" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "19288" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "39401" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "29479" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "10500" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "19288" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "29397" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "29397" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "39324" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "9366" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "48358" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2072 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2072 iexplore.exe 2072 iexplore.exe 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2380 2072 iexplore.exe 31 PID 2072 wrote to memory of 2380 2072 iexplore.exe 31 PID 2072 wrote to memory of 2380 2072 iexplore.exe 31 PID 2072 wrote to memory of 2380 2072 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea031e84bcbca334b6d6bcb19255ccbe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
854B
MD5e935bc5762068caf3e24a2683b1b8a88
SHA182b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174
Filesize471B
MD56cb7ef0ae5fcd44c82cb5370339113fc
SHA18372f0f7f5ab76982b18edffe93a181d253d5b09
SHA256fca2fe88dd48105e28e1b897559898aaa8cbbf6680470649f7d0bf5bcbd2f5cf
SHA5122a459ce4e4678a1ecc6c9cd099e7d6e64d0191a83855c89a42150fb26df47307403ba5c4dba503732fd38ec50fbeab1565840109e5086db2113e02b42f136ff7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Filesize170B
MD5a5ed8f3658fcbce9e6e9ab8a36a305d5
SHA1362ed0e05bd802b0e08f52e8ccf4ded047d46dc2
SHA256c586881b2795dbdd569524098ce04f5fc5c6f64e2d4ab77e7b935a6f89acf8bf
SHA5120aa0bd9c36ec5608dc066f4c42ba8723fed15abe534492f3d227b4868e2b7e28e0dea6a039fa5a85e41f366ef213312279ea0a81d2d44bcdb93ff7643757fdd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598634e4fc5c9da4087417daf63e4162f
SHA1c31c887dcae350f7bf2829954594eccfe17fc08a
SHA256e98efc00260224f6b89c07946f6c8bec929d94f91a4242bd26b19899fe07197c
SHA51261814225846d6d3b1f06d8a80362ee9a2fce8be3a01b622c5ea631e7703188a66f928135e4360fa8545e0659a25035c336698afef2b9730f64a89b16581007ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5414c0bb9d9e3f151d5a618896a74e2dd
SHA179f6455f9359b1e0f28f1e59e540d612c181a64e
SHA256b5ea5fd6624a9e65f160ef104073a6c86c453de2cf225388590785164c74ceb1
SHA512f988298ddb4e53441838424df9106b37ce8039f664a347cf6836e76b46307d5c78f5c895c458b2395e38231b356ac13426b6402340d290dd5ef207d363cf62bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7528d6b4d709e992ae4dbca4c8adb65
SHA18ed24ff78e2fc16a8fb72a1d12317e3068e6f8e5
SHA256dce4f07565c3ef47932560576d9845e2f40079ebb43d7fba24c39c830578dbd7
SHA51295e6fa971a142fee3cd379ce74d0a3dbbca82a4e82925b8e932a28eb5fd9f2c8126b01ebe1ebc0e4ae008e736194ccc332581a5224588a35f8b1c4beefe56048
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c28ac92363dc5268c704d85aa736e27b
SHA117e51da0afe218954048f9f278faa1d928718a53
SHA256ba39f7af11b3e6c78de74e8d156f0906c85b8953755a47345e9d771b5b1e83e5
SHA5127d715ee4778023834fc2ec4e62f886ae8cc08715b93244462fab262cc492e991032581ecb255ef48f2d2f2a02878cb1f33d81ea94434c5339cfcc32544793b3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59525c5c4aef33b7bc945d8a70c7906a7
SHA1b1106b4c13a6981f4e87250ef5745329cf993de9
SHA256e60d43d009682dff5e373eb0849fded1c51f56998437b9b143f92f4b753171e7
SHA512d5a8f3cece80a22697bdd952b468fb62e6dfee6df379cc857938a35e0f23597390656eb119c06d615e2c4f0001670c9c303550558972722b5c54f887e048cab3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5540978d9c25ae68b3b8315287ca7afa5
SHA156d7caa55cf4071f41b875cc60fef71bd54ea039
SHA256be5b59de9ce9e8017f0cf1a86287daba24b1f3aa71d2508a4a71c7a1c6f13939
SHA51213e8a89c6da7fd6782a1c7891d9f3f4b70250412b8364bb8c3767255f017df89cf19f25c514725ddb510ed31b339681884a7325c5c725e5a8275e8354b5c0db3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c75795528dceff23e81d4d33f3f50e4d
SHA1fa78c0e3d74479059b10d4780a8c57e494b38d4d
SHA2562b306316885d9c1cccc8c81a084e6650912dcc6996cb8ef6eb834e3f82bd9ee8
SHA5122c08ae32f248d2a79bdaa2e1a8ad529f087a1eb5db6e3ccc97637b896949ddcddd0db914418f750ac972db6cd1758fa29096a0b712da77c7cb634895d44d1968
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584c524d5ebf4dc90bf068bf0e30acaf5
SHA19f36483879a8e59af1203c59d5c9cf15939bbf04
SHA256a9d546a7c2568ee5e36015365b86ab90539589dada37839321e9c33d9f8e0723
SHA512912a7c1c1cc4d70ebb6fb4bc76b3e3497e13588cb8efd9a2e2404d707e0d2251ec0867afc82aee7018e344b8d7677e1879e213476d7967ed7648394f23ed0c76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588b0b83e30dbdf60437a2c4ed7c5f4da
SHA18e7151dbd68b322fcc9f1128f2d28c3e39bf5c51
SHA2563ce544c794a06ad121d04c6a533d14738f5ac03b2a119bcb34b1533cfe557003
SHA512cc932184d17c180d96716301c6e93892432419f189bff6126c3708e56055ace5aa9e0cdc6ef16feead7dfc1fe55f47aee6608e2846fafcaf6e3e75fc2ebf234a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6300e17e843c45a24d426b8c71098c9
SHA126c5d785bb529cf03679f315998e902669984fd8
SHA256ceb498ab341fd1c0f4764ef38da2391b7b73e547109ed736143f677e7010d34a
SHA51217d49dcd88629d2b52124c919201a988ce3d22a339d5431c78db547e2d708f0537dd839b2c589f4ecaee063a91f8ff8067f83cbd9233550ed4f70914aa292a3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb8d23cbe7d92853343dfb0b4abe39ab
SHA160a7513c8d1e87f83fcbde2ab4f3cd3579e9d3df
SHA256cfbc5629fcdb97230ef739402d8610e141c9458054355c141b9cc9fa24ab202c
SHA512f1da36dfec16463b452d987582515c5fdde33fa401f5bd8a16f495cc88d92691a5a8affe1c55bced9f99628736d8362e2eed61cf9404f11253f7e56f635d4c2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5870954cbc132503a0f5a6f02fd1b3fef
SHA1e576481fba367cf9016c8a387dedf22ad1372769
SHA25612f5c49d3652c666480457aabe78819d80a38d53c62444a5c4aea076ed7400aa
SHA512c172600cdeb4bd68ca64c3bcd72d9d08475b1f090cdad161feef445a326fb69f4a13f2a47a3af201d8c10d9af11a42f983c854e015d091f962a7ce63d91c8123
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57edd5423597e5e3768ef5659bc09a72b
SHA1a49f55bbaf233bd11672b9631b455ce1bf1ed14a
SHA2565007d14f6c15108f0cf468c29454eac557c6b07237e93bb3a0e27ac58dbcdcb3
SHA5122849293e636c55adbfcae1670ce60d95e1d95b40f86ad6cd499f83b5719c06f83aead7bfc82c70a1257cb1a05e1e9e6bf960a0838921fc2480fd95bd40041202
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515b8a602d11a9614201f8cd199bd36dd
SHA187b1e3dd3fddb637f3e0910e3dbf6acecc04afa9
SHA25660d68718f53b012ec9fcb75669ad7764cf4aa67447a05549f172b92bbd4b0d8e
SHA512f2f78d99d0d559a8a537bd87b26861ba66c4f06db15969b59f9b499c04c4c4075b16be6988e2e6a36be89ce78b6c73d05c35bd551a48af473976ad91d8b83668
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf9f57df691efc70e7a69644da544d3a
SHA1413b934d7bc5fafea398bab7890a2bcc011eae7f
SHA2569e08cb2ca32b7649203870be1857189cabd08f3e30a03c8f54b7028f646c0e25
SHA51290124b8ec37da1c0b4241da8855e9bc5cd1338a5aed10b80b7d229b614704c829da0a584efcd8f3a12db274d2e00b0103b9294d33b29571c5899561e04c30b23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b4748888bbee86b9b78cea754715336
SHA1c57edff86f495f2a323503244d79c74505f6e752
SHA25695d63c0eee66b1e8fbda8fbdf717e80f5d0ad18230ad2a25ce74a865368bebe9
SHA512a031a31a39d61835d4977a557ea84ae0ddb0aa785d8458ba779696747295ea928d567a2f15080b4f0e162576e74158b6bf84956c9afaa18c5e362608206688d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5322d4ca2bdfaecd029dac314313c75d9
SHA1c90964049701ee9f8afeb0e36c8bddb4b8a78625
SHA2563d13954f5045d2043b798ceca16d42b946acdea79224f3d9e07d14093fc9e346
SHA512b9c4bf16582ac989b4ea42b212565fa06f3a8e8d421a17bd15d9d2ba3338b04fe40d5f0df323c3100df34e46570d765f8e887c608991110515400882fad80e98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4dd5242df9bd5d7c1df8274f2c58014
SHA1e522d787badb4fd18c6aa9c85886418258e9c762
SHA2561e0933a1a5a3cd27bf77e9867de6e8ddebc1c17df3432b0fb2caae329172ad2c
SHA5129f15fd101b15c46db6ab5df6fdc21ab19c1aae0d9e18289de4e78d28456036a76b8fa6b12dbd3088613aaaaa55ab746eca0e5eeb8642be8fb39b32156fe5fb4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c626fbd3621230923a68f41ac2adedf
SHA1cd9f246fa6089ad4139176d8e67444791c5803d7
SHA2564aa3a99746639941df4dc518fc6c8c64fc0ca2d9c06d755f69d75e1489e13714
SHA512ef1ab4a7be7a74897f078a9339b55951a5fa6d4e422038aa7851b2d43996148dac418006fd84f1fce67db0bcbf302a222233197589e3cd4bfe6b1fee656c53ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55179bac66426273d5674a769794d780d
SHA164ccad60bc099daedfa284c1708c7039f4162856
SHA256b828775594725c29dc747d06bbaba62f1d7108512e90a3ab0dc1b7e60e38848e
SHA51236a9b368df676aeaea03a5edf2f5e0c03380517544527bfe67280b6b23bd09a44f0922aafc271031bc0779e4da8ed15170e1434ca01b9481b4c29ad763e1d1a6
-
Filesize
990B
MD534ac16bb500a8421c4a5175ec67812e4
SHA14708c7a8f2e42ce7129081b28391360e471dd6ff
SHA2567a75624a5aadd017eaf74ce4ca73e4914efc5897eefd1423793bfe7dd0f391a9
SHA512c1106b9d3f9eb765012fc178430e6a41e0595f61917e7801be0dbef9ee8a1f7a792652531d011963c6a9a074aa85ffaa00f2244d10c53c13a6700840daad1d4c
-
Filesize
990B
MD5f6d6c0b15d3fe0242d747b9c45e83c30
SHA10f8a879ee20bb1f82aec8c969fc92a9d42a2c9c4
SHA256ea8be60767f76ee3f1da0fa3e958d2e152f2cd1abd062bd77d058a4963326aad
SHA512dd97d9a6b957bc73c9972b6fb221c9b10f846b573270322503ee5710180ecda8b2d46fcebd9de273c4faba53bc1df7245564b2fdc1aaa65e3b4387c7b623d8f2
-
Filesize
990B
MD5c42db7512900ffd06a596c323edf1111
SHA1a23a8c6997b7d854adb99d7816ab9763a2e9b029
SHA25634647b5b54c6e9ea138878616163e247e62a9304b7c5cacf8dfa2798d18a9075
SHA5128f9742a05921f99b8c9c0ea4f4dbf26ba5c4235b80233fafdf8ba934a827372ecf4106f0eeddf930d85726878e1f1305e2df43f77a6ec6136836bb7b5bfb7e11
-
Filesize
990B
MD51f63a256673ae4551d343bcb17e54235
SHA113e01bae306ce3efb20d24cbb79ee05cf2aa43c9
SHA256dba39c21be47ae4539cc32bc956a3d9d3f558eb06bf54b39eafe2d8d70f8f3db
SHA512c80927bcaf62fded393051a54e5f01d3d176e8e992e7b6834d46aceaabf5f6b5d1d6a79a819940069b4d91d94eb19290df734aa235db36532b141d0cc6215490
-
Filesize
990B
MD58d2e2c41a85b6357737cdb96ef28bb14
SHA1e1fa911f1ce5d26447a387272ab9dadfa0d71b79
SHA256f7be4f557a278194356e1d48014ab784210b485ac74acc4aa879859cf371600e
SHA5120715854a810c4beaee45bcf7f2c90d593f93a46d5dc928a9a3afb6bf587d950ba93fb69433f001291da42e025ccfba09b2ff3c31c507892d41f91e76c5c3ac60
-
Filesize
13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
Filesize
990B
MD542f905404a9c2ad6ec7706a2eca5fd0a
SHA1b1f618947d617ae31ff83a09a379dcc573adf85a
SHA2568cdb75c2be568404cdd58c3ab921fb4eb3e256e1a41e4c1fe423d07790301834
SHA512a4ed597d99fb1486bdcfe325b178aff04e85fc8066e5c123e241c5752e8d645ad2bfd82e4af84f032a825bdb9fcf76a4a6e2bfe1ebf81d96572c39f316950451
-
Filesize
990B
MD53e9af6bc7de0a1ebb9748832fb928825
SHA1bfcd9c3ac15a86cd7ea8159bbd5fc86de4ac7ca1
SHA2561e3b4fc4aac273e0dfb77ddf6edbf69e6b4198a9f9bd054a524f66046610e649
SHA512eb0102f9af03970ba8d8f4357524e4af4458d2627cc57f35eaf9618fb107a578671e9f6371c961330ecd2776493c2d09e83ac82848e48af56c779d19c1ac072b
-
Filesize
990B
MD5c86ab8c262db8dbc3cc6b3aafa859355
SHA1d65567a9887ce5e9a3118ebb788d2a30efcf7b4a
SHA256c9ab8e74b28e96ad726397a8554bae8c7e518e6f9eea612a6f7d331c2538a71f
SHA51260d22d03c6f542b07cf211b494d64810470f3835a8abd9d4d22d568fa61b3d51283f1b8dd40974b946fa3e65b82397e7802b7efa41c3e9035541d64c1427a2a8
-
Filesize
990B
MD5a86eb3a3b68f118a8131f758f5f8f9d0
SHA1308e632218333f6772ca2f368e0e2f7dfe5959bd
SHA25650233aa9b49969c94acd457f2619eeb4c381ab815c912697085bf3cc4a115724
SHA512eb6060f59fd803b27bbde3f07a05ee2d729dbe010b285540888fde0e489ffd1db6ab41bcba7c48fa07f88554454f2f63cccb02df80481d4bf74c12385924ee16
-
Filesize
229B
MD53107010a6faf72bb525f2307a1a36f6f
SHA1233e1f66bf0aa8ba20f4c152202f79cba35e14af
SHA2566900a481b831ad3a9b69fba946280d1a1ab9436b40c2fe25fad1f609be44ae8d
SHA5125994db354d7125f1c1ebf5abcdb3a63613c27499d9b8bf93ff1c7d35ead1a270ec84fc6b426d1c209bf8bd7983583c2b82c276c570742dff7724eb74796e5815
-
Filesize
229B
MD5de9288c1345a085c2df71664d0ed023f
SHA157e8cc021ad1c4419540f7fc500e3fcbe7d17536
SHA256b10d73f30a407608447044660c77e416ef2420054c97dc031bee9bff551701ac
SHA512f86f6262c496e70b5e6124cf0a3ff9298e79fbd64eab7a6012be0571baf87cfcdb0b6e9b5c9cdb681ad4b782a805baf508e0fc2ab27840898baa6844962bf40b
-
Filesize
229B
MD51f826a6ae8edea7215e2342a6efdd78d
SHA17ea7f200abdfa14117ffba7d098ff39f0db0b180
SHA2561b20ba7957c901492cfb66f871643016e96e8a3ac1296fcb4e43309822edc03f
SHA512797a650c707f20e7c6d9d9b20240ee3ba4e6668fed9ec742bc1b7a0ef8d2ec0cada3d2481bdea5713d73a86f89c9187ef78cada88eb431e5f00268ebb97da136
-
Filesize
229B
MD585d7ff23df23ad635041cac4a49ce9c0
SHA11f6e41921e41c59aa3221dec14aba4fd90afb4ea
SHA256508f46558fc8304bec8ca32bcd6550f22be7b65b0190a8aef18c853c2013ebf1
SHA512a01d8770f043130daf27704873870287a924a1b620c9ead3823da7a5710b0b600a7b94a56d4f822f032abca8c622d22ae51181bf508f262b81b8b5145aeaaeda
-
Filesize
229B
MD547b036af840d405a97072308a25a423c
SHA168021b1f75cd7103096ad344f82b5ec54299c14f
SHA25665efcd77db80694440a77cf4334fb539779478455016d4edcae0d3d0086bec0c
SHA512cd929e08f4334e13c923d97cc0f7fd93c05af57b46f2ff439761aa6cfa4393de4cf7910cf6fb01dff65c4385f2c5ae361cc11208590e2856d6bb509c0a48afee
-
Filesize
641B
MD5bf93752b6e61f900cd719173282568bc
SHA1334d4b50cf75f02d7f8baad50655e1eb00e8862f
SHA2563720f4b6ea1fc2b8da80a3d3dfa1052b47ce1cfc95bf2ca63104fee0444ffecc
SHA512a890b7a04e5ab859068518fa45f0f769697bb9a3387136031c46fad58338f7b018f433a24072443f33988b820279902925fdf05c64e9eb8b1d64855f96826e18
-
Filesize
641B
MD59c307ac938aa86b194909a53087a9659
SHA1d36af1f19f8dc4794445a99ec609685f7e4056d0
SHA2561eaf85d01040502bd0fd5a43ee0b00135f29ad6b3f0c614a06f34f982129ccba
SHA5120fe7c586234d906e9023bd48390a91f3a7fe8749818b7f05e77cba53c00782426bce3bc143d7e4ed007b4c862ea7510063dba08ef18ab388ba181ae782f3e306
-
Filesize
14KB
MD5c5c935e3d61fe80d56473358e551b661
SHA163d54db6b01a5d7eb0179bc5b523c00ec2545f13
SHA256597d06d98aceb4ee3c9f8c5b990164544e973854834283d640283932548b25ac
SHA512230f87c0af6370b825303d6f34e27bcb641afb22acf3f53664a21121fe06ab1ba5b07e6128fd82bdd2276ce5798b90ce50c69ae254c710411c74bf1da934f118
-
Filesize
814B
MD54ae31f55e869a2e8d67db8c6e11a5e5b
SHA158a1b6a317a1a662033a3ea7cd87f59488cd197d
SHA256aa66623f72eb8b52e585d1441abe398640c5fdf0f9bb0b26ad21f4e428ea7266
SHA51279bf9a63c9a0e2ea5a6651b5666c5105773122ae7a653d94c43a91c4f8f1a45ec12dec0db94922d74c1389d47ca0fe1244eb02194a402ac0c183165501fab6ac
-
Filesize
45KB
MD565ec3e9c48e36804f6bb8409bbebdb77
SHA1c98cf9bdcad7c2c6a0c48e58e39dc77938cf0566
SHA2562e83a3c5807f8aa6c32b156122433983e5a15b906c05fae783cbfbe158f32383
SHA512f2a0092137a2381483f1c635d9689f4413b045809d9775815096d3225e6d85b5386fb7b1b2d96631ae0fa9bed3c2596b2c3d0574d5a10ac44bceabf952f3f073
-
Filesize
60KB
MD563a12754771aa354cdd1b928612aa0e8
SHA1d95b8bfa5114754cb7520f8b4331958d5fc4b229
SHA2568a3e88748ed20a002f827375c1c4f31aa03cf6ea491057d78303cc87a7ac9443
SHA5128e93976382b6f99b45ababdff55ec251134909f1aaf2b81fe250179487d6f6fbc69f1829131d778ea0334908b5222ff94f5810e572161928ae5d1c2d033995cf
-
Filesize
74KB
MD53bea249e59f64857c90936429c6ffa74
SHA120ed8975ef50c0790be080220d1ac12ce377d5eb
SHA256dcae60963c230dcd27140887cccd7dc867108b8fdf4135324ccb7aeee19c9d58
SHA512e2ad5dadb54316c8167de27fd90f3610604cfc374a54b0ee5339f705fd242c1fb028386048bf81b156bad05d655e9749f04300c41d15d2cd28ec655896de2971
-
Filesize
60KB
MD5f2ed2a3d08aa9c4f7642b034b7335dc1
SHA1d9150f1ec0dc56cbf8c541a084944ec621860566
SHA256f093f7e87cdfe89bac2dc0da8e1658a2aba394cd6852763da2bef626ddc6d887
SHA512fdf74aa656269529f9e42cf03335a384a4342e7785f730da28422ea9021792862791466d8225ead056a348c5fa3d4ce8180d13c1a8e0a7a2f706e257f2045a00
-
Filesize
814B
MD5d30033fb715bc13ccdb9e390e036637b
SHA1f8c140c8632bc0f1c8d0d0900be6e68a0508f3af
SHA25671465d2707ed19cd44b35d2a95bdf6c08b37a117a8bc9b879b98da7c7bf0ec13
SHA5120812c3965128f14727a4d21ab09118b5796db8021b8dc33b957a41f4f59d3db245a1908ced81dc2f94e0cc76d165be7818c38eaae1e339b3c76f90cc85d0477b
-
Filesize
31KB
MD5e0c81e8215140f30e977f2e50552c691
SHA16040ee07f67bba5caf9455fbe7655df0f521cf98
SHA25652d8acdc21a9f0c7dafbc28bfd1c4bffb74fcd607e38c33ddcd382f3a003d5ad
SHA512492704c9a4315b2a28ebe6d52c3ecf328cfe22a0aca49dc2b2116621ea39e51bd26e331d55da2b228aa907d606155c4ac1f0fad4fdf9836ee98ae5d8a2625401
-
Filesize
990B
MD5b70bd4edd2f76431c58dce27e4c31e30
SHA11c64d90008ea74437f273ee4a1f650e13a7f19df
SHA2568bc4eb9462862f6b473b13e0d2c8ff09f195efa0c873f3c2d75e44598c7dd1f6
SHA512b2459c8cef413453bec38b95a9636d4077585a86a25da09d5cb23cd332fecee21835c08fb33eb75b1899fffbbc057e35d0ff85b8c1cc3baf14d18c026720cfd0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\ad_status[1].js
Filesize29B
MD51fa71744db23d0f8df9cce6719defcb7
SHA1e4be9b7136697942a036f97cf26ebaf703ad2067
SHA256eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
SHA51217fa262901b608368eb4b70910da67e1f11b9cfb2c9dc81844f55bee1db3ec11f704d81ab20f2dda973378f9c0df56eaad8111f34b92e4161a4d194ba902f82f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\base[1].js
Filesize2.3MB
MD555c5c38575a62555892b3df88c4f3b38
SHA1ca63f2fc4b27efee78ed605ce8d1e7d0eaf2205d
SHA256584de41efcbb83107455a965e3f27bcada7033cfcf288b5992eff135e6884350
SHA512da821710c256651a671b391f91cf69e96ffb0525875547429d541ff3d594430ae11fb3021b1fb2d15cfee572e7d4bb085ea496155e81b4e3670e1c0fff6aa9d7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\embed[1].js
Filesize66KB
MD50de9ca472ec683fa79e837c13442d9d2
SHA1f8eeeb4b77a57a9802400fd6d6e47f351351f6ae
SHA25617a6e70dd727761474172c022777994e91eb3716ffc278d05883143e65c98951
SHA512ee222993084ffee069ab01f2d31fc5591c20f172cde12dba3ed7c7256a27fc89c61c4712b1c3016bb9a820727cc1d93f0d8bfced36d345dfb1814b0f756c08d7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\www-embed-player[2].js
Filesize331KB
MD5e05ae65e7290835392021a7595916b92
SHA1f1a340473bc52f98f2e73ee422b5b10d246b2fa4
SHA2567a0c22ec1c43c774664255605c026a3025992bee2a2e1441d391e58b30cabbc9
SHA512c40fe5dba0e7209ede7845892a3a5c92085d88263efdb3b6b9929d1bc269aaa517d1dd218a449ffc0aa3b82903ee5a840e021d6ceddefd57aff6d0419a0e3d9f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\www-player[2].css
Filesize378KB
MD52e4117c51e897b0cbaeed1dd321eff5d
SHA1d6010be53e4e0f1cc5b951663c14619e00b9d519
SHA256462d837d5eb151ebc17aefb77ded3dc9bf3edf7a43e0183800a54a1de3a58caf
SHA5125684c70d9a7e1e6bdaafe80cc35fdbfe9024a3f3bb8899116c301b3023b3818f93ca64f6f42aecb99fca6c8c45aeed946bbf5a8db8fcdb16ea0f58373179c58d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q0WBLVJY\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff
Filesize19KB
MD5de8b7431b74642e830af4d4f4b513ec9
SHA1f549f1fe8a0b86ef3fbdcb8d508440aff84c385c
SHA2563bfe46bb1ca35b205306c5ec664e99e4a816f48a417b6b42e77a1f43f0bc4e7a
SHA51257d3d4de3816307ed954b796c13bfa34af22a46a2fea310df90e966301350ae8adac62bcd2abf7d7768e6bdcbb3dfc5069378a728436173d07abfa483c1025ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q0WBLVJY\KFOmCnqEu92Fr1Mu4mxM[1].woff
Filesize19KB
MD5bafb105baeb22d965c70fe52ba6b49d9
SHA1934014cc9bbe5883542be756b3146c05844b254f
SHA2561570f866bf6eae82041e407280894a86ad2b8b275e01908ae156914dc693a4ed
SHA51285a91773b0283e3b2400c773527542228478cc1b9e8ad8ea62435d705e98702a40bedf26cb5b0900dd8fecc79f802b8c1839184e787d9416886dbc73dff22a64
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b