Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
1636c4c2ea65f6af7740986f1fb9cd70_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1636c4c2ea65f6af7740986f1fb9cd70_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
1636c4c2ea65f6af7740986f1fb9cd70_JaffaCakes118.html
-
Size
6KB
-
MD5
1636c4c2ea65f6af7740986f1fb9cd70
-
SHA1
ae2b85ae6a8a4a4821b5d00d1b7527d194b654f2
-
SHA256
10050b7ba00a4a4a659edfe255694b6fbdef89908a84ccee2fada7f37db9ee83
-
SHA512
995fbb0fa03f44196bb2c83dbe0517be39c86b821bad8799ea0cbeb805de54347d5cf6c07784d1eb675bf83844d7ea39ab8598a094ae8386c952c82830cb40e6
-
SSDEEP
96:uzVs+ux76WLLY1k9o84d12ef7CSTUO7aYcEZ7ru7f:csz76WAYS/TaYb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80788e4598c8da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425657763" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c7347915898a887f6573627019e1bb74e7f2cbfa863f8fcc3b07e05c5d5e0fb7000000000e8000000002000020000000a7adc58d0feedbf31554f5569c8c5027382d09e86dd27f35ab9bf654f30292dc20000000683bad64f674dc3b1a87cb94a3da0c3f2caf96f6389582e4eb1e01fa1599c6a040000000db3217909319f1d20571d119c90fd1fa8ed19739f7b8b9c3eccddb778d9d474d8646c56dd483d36f60a4003f99cbf8770b507d82fcb23c03e769413f6fad3d75 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c802a603c7e2feaa40955d066beeb75ffa7efbc64183391580405e0074eccda2000000000e8000000002000020000000f76bcba1392f4904a938c4e7eeb47d06b72ba4b8a531306cb3dca78a63b744d090000000089eac4308e87fd829cc4b47c31306b085e2a4cd4b270dd5560c35a1b14304412911e8be6a23257f8176b957327907d4d3d804d241b34053f8b5e04d6bf28dc913e7e8a83754543cfa775ede9bc9be6c0fdfaf533ad5abadf52454953b9b71f181d0787a9022e73a39caa9d22382b25ff3cad2c98b41af6dd398e4aa5c80259ebf6d45ee78f137df69941a47e81c790b400000005b8c60f5bed4f2f7cf58c58a29cbf2eb498faa40dfb45b56be37612b2cf3503d7d7e0b934aa6f11b0b331c511d8092ef0d62bb306552e5490561700818eb7602 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{706B37A1-348B-11EF-A759-F637117826CF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 iexplore.exe 1936 iexplore.exe 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2016 1936 iexplore.exe 28 PID 1936 wrote to memory of 2016 1936 iexplore.exe 28 PID 1936 wrote to memory of 2016 1936 iexplore.exe 28 PID 1936 wrote to memory of 2016 1936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1636c4c2ea65f6af7740986f1fb9cd70_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d80d4ce6a9c2e1051bf4ded53577030
SHA15df4168ac20aa6b368e59df6632fb78776d3193c
SHA2564d923b0d85302a2b9fa5d89278a68885ca7e8c456cf973fb1c73931a7fe61609
SHA5125623bb75f85cbc43a24aaa9b95cf314573df0e16e92dd7efacb60ab5a75ced3031be2ebda3961bdf6999d49dd2cb2c03dc535c7e1436c3dbebdf93f1ee310441
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a520b8c93c5947eaf4774eac88700dcd
SHA18e71d4955d1f30c886cf7aa55cd464d1c0b4faa1
SHA25609bb797e1e3a40cceb98d254817a3aa32ca0f1dc2923625a58ac57823f620985
SHA512ebfe26fc1581a7c245be1ac314b713f4696a5a0c8b60fcf8701ed7dd392e0176b2a9da38ccfc506b431b5f869e0e7877dae68fbc43b6f44773b02bde1cf2643a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502d33f4105f82d7c324366bf61e75f81
SHA1a95e1c5c8515f736fd1056bcf2c64c107f356c2e
SHA2560963f83379c576b5f17fee18266f3c79c22d318cfc8afdcaefb4f8b20f7e8a1c
SHA512f33c8e61a1233ada70978152683d98b82a230743b4f07fb0f7b43971cdd8e9e1d15d6ebcc35dd0827b3de78d81806ff1a7452bba437f69727468609c91fe9022
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4189ef46172bc691204be7d2eec7067
SHA195f647998ef1464d64bb10f545b4f60d2a715243
SHA256e60ddc9feca41a1eb766817d276aa7d35affe67181983f6c3871b6fb7e7080a2
SHA5120166cad59d22d857b7e8660c24bb5626fa3b933d09013c6a58fd8fbdd3cb7aa7addebf79b8d7736d3d0e038e24aa86124659d5f1401203231536fd9609357f52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c8ea8e7607e1a98ee53cd44a66605a0
SHA15798430e1050f4493acbd6c1e5ccce17ed3d8f49
SHA25608b0f1f0f076f8577f87e4923a1b8b534633d1a87ebcbbce82939fbf7cc7256b
SHA5121bfe061f6dbbf6cfae3fd4aea52eda25a539ea7cf6c6a06e54a5fea41d7f8e7da8826f6c2067ceecac975a8cc2ded4969369919401a042e1ec4d73fb6eeed77d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586d5771b527158869e5ca1fb8997acda
SHA184c8b1e09acb41cab1090a13d05faebe63c5fa4b
SHA2566b362f0f8ebf235500f9c33575349c26bcfeccb81dc46f7dbcb317c41eeb0d69
SHA5123c3ae78a7fbcb0988fe7cdb68f8968c2d733a0c2e9b440cb04cfbe96493e12b0a0fcbb0b99c26224a4f3f8a43b15322a9ae703834333e447c77c815e63d5ecb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bac2a771bcaaa8f686a5f76879aa65b2
SHA194fd7991c79030190747501dcde0d26ca820ea0b
SHA256505f35c76da0c5326ccd84d78f24e7fd1402b770d13ad6f3d1cbf701c8fb8259
SHA51279ee4a967c80f19668f283f3451387475366aaf9cbe5cf932e13530442b1817a1b8dbb9be72a97213769c9e68e90836f4fedd816d80caf32edc9e1874150810f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535d4f49cf5eca1c55252deb162aa4880
SHA19e493e6ee3e459f4ee14611caf409bd2f831c95b
SHA256690d21451e81fa76f4696f8064f6a58cc28b21675dd8247db51104efd9c3e480
SHA5129f665b446dfe584880bcf2fd858660020f86d977deae3862ae510b24cc527ad3936830507b2cccb1d59de40a5159c2d5b9ef433ececec439b4da9d81784ce2ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50777c73e11e150c345bedce144523c97
SHA1077924f8cfebd5f927be0e3fab4ae14104103b3a
SHA256b37b0dbc72e95ac573fdf993ff20b6b652aa7d063483c9ce69bd9e58d4841fb3
SHA51253f0db888648527e02f0bf95d022062e6a7efe2ce79bdc8d72b2db0c24eed24389cf8246eaa658894388c01f27c24c0b1f7c60cda166fb7e10fef6f6e12a97ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5057e4b028a703e23c06f8d56da45a160
SHA19092206105a180d40434296f732761fbcab8c287
SHA25614ff9ab1e4788179fbf0c6b99e5e426a432f347be424712d832b53c19ec08d61
SHA512a52192163b22d9523f09f41a0f3691ad611fe25895b4a3961af33d5498b4ac1084b2b16f4eae67a3946a0c3b8977b329f17919a18c3d222851448db88b36b39e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59055dfc509ef585b9247049b432a33be
SHA14fb18861ea6f09c2724dac4341e2f4f8811e3970
SHA256d37e7776ae33a5e71b12643eab62fb1f3cbd655b7ce881f881276f40c654be5d
SHA512038b79c103a97bb407b25499e651664451153fc7ba951dd87353f82ab763967f2d84bba1aec1555df9333a81693d4169edd1244a6157ce3a2fb029e928e9a070
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564e47d5cc1c6cfc530c3fb7a3846da86
SHA1d4c36b78b261c7b43cc3d216878fe1bf5c16212e
SHA2564dfb11d1ea4f1815a07a8e6df33fb8db61d375c559315ffb425d8f6dea61b95b
SHA5125be3e27ef31e6143e18afe002a78184df5feee3f2faacd925c3d653938ad0d1004cc90f7830d7bc55dc58f5be6fd42e0c85c325b47c285cc75077255b8f9e32c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6bb9fae98e30eb03d03460b2d780432
SHA16696d235bd124e38c8e65e41e1c6fbd0ae43899f
SHA256d7b9c4e993b88ecda9edd400e1621c1b2fa25421b888b8ef236fa718329b8c0b
SHA512036f3a01f2b106aecf409135a08321ba100613f444c5712ae11ffeafa71691403bf5bbeb807255c4c6bc35041c83bf45568a41e3ed2bc72ff69773b04a29d78d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5163a9f97fad58efcb481c4e1d7b800
SHA1f844c01747a3f271ee24faa1bfd1370ccc55fb03
SHA25683628ed9f2362467bb9f596425d930922fb77d1816224cf9cd1cd5c8ae15ffe1
SHA512d26fdfd9ad6e6318c47fe168ed169bf27473fdfdb84f059a37847bf176a6c671ae18c65b868b3738eca02d52f9fde241ddf1af3841bcfe9447f6a56a704a66f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5b36f947d2a98a3e935a63bb4c416c9
SHA177f938e683c94dfd3bc7066ea82e3853e3a51ab5
SHA2565a5e24d7ecab8e38f4f38d2fe3b70a838be014527af4d04b12acccc62d2405ce
SHA512e23085243f04dc20984d15f0ce273101f23e22a02def13fff6b444f4ca4a5bd58e1f8ea111e099c1b2c5a0639d87434bff38c1162b3a178de3f5d289f90d2ead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f24438ba3baa3f0c7c9b6b9667f9d759
SHA1f1f8b3497a17adc9c7d6c76c74389d11347e902a
SHA256095c73c439bf2404d4b4ef11f8c0696d512402a70139905627674ef61f25432d
SHA5129799b63fe0396adec57b61f59e907e83c124dbec7a1745fc9af08780d804f203efd56e9ea64530f8df5b80491c3e32b118cf7148c9cb7fd37c4f27cb371ff688
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbcf2c2b18782cec931763147a411cf9
SHA18b699dea1668607ad389fb3fb96a164992d9f418
SHA256084b3bf43d634c86ab59353b6fb701ac5c4f8419c50d0e2bbf34311e34e63856
SHA51290954fd2d400e1e47779ae7dbc68b9756a2dfcae77ee3c600d1f05f3c80d8417c6aafde761646dbd09812ce033afad43f457b81882c2089315fb973fe85aadc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573fd9a1536618bb6490aa7e40296f0ce
SHA169d7c335b72173007866c95938f7936b35cc1272
SHA2565084ceb16c8e220314c6e88f7095b199268032303c07cc8ad95095d1ef3253c2
SHA512f0b33543cf52e1c3d2516042bd3b665df0e94b91dc7cea9dfa78df612afa3550eaa9e54bf78019fc3fc28e2106018c23631953e5b41f1576e4929ea85b939284
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b