Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 07:36
Static task
static1
Behavioral task
behavioral1
Sample
2b7f1eda8ad59758dbff6e9db675e54c_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2b7f1eda8ad59758dbff6e9db675e54c_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2b7f1eda8ad59758dbff6e9db675e54c_JaffaCakes118.html
-
Size
9KB
-
MD5
2b7f1eda8ad59758dbff6e9db675e54c
-
SHA1
5affab4f2e4fb4b3a4dac77fa35fe857c6a00318
-
SHA256
ca022d56d5d766a6ed4cb627e9447cdd1a2eefd5569c5990d4fc5a6a0ee2cf33
-
SHA512
1a79f11ac96aca4982bb240166b6c41a5fb491276ad9bfab628b3c9ec4672c723b6ad8ab018e907e0b384b8c33e96b8331a514fd9f931d18f54dcf424cc9c325
-
SSDEEP
192:qmJed+pVA+4ImQFtBUrVT3R3JqIlp90tn6cVNf1vwf+tQ43C:b0d+c+4ImwUBThdlAtnZ7f13tQAC
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000004f183a5aba0616b55b04cf6cc257792b7b728734c178af60e8b0395d63904696000000000e80000000020000200000005e6d0fc7321ee2fb7a8988a9b4373b2511d5cc118dff380891a3d4590a79be2820000000231806ee168018225e9024050d9bd91b10fdeca79d38a2c063fe9459327934d5400000009a191ef2e27892cd37943a26481cf4d482279b3bb0d269007b470acb3f667b5aa40f55f6f9b8fb89fd305679d4a2df34c49ae47e9c07261bd7171015341438c0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a054338937d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000374d547ddeef34698ac29a25b14edab46e3c9a59715ba1b5533fe7e3809bb1bb000000000e800000000200002000000019bd91a68b533467e87e0601c066a4e7c6a86d459502518937e1cbdc389a30e990000000f20672b38edb0c3556ff69bc2fe130f41e7f31a61d33a44041920d3ae510216a1f8e25c7644d5e72212b4d3364555e967106ab9627eecfa532a5bd4a8b4f9abd63ddf4c61325a2c4991c05ad21c1e8dc5339f36a313158f9f040469957dbcc35a524d7ecc03f2ef7a9f55f5db0724d8264fa374d9ef3d959cee53da075026d19b6ca63741908e0efcecb0d545da6e7ba40000000fe5872ea34763fc6da024226709f6de66e7677b2a7350b3478bbcd17a6b8295f5af5867fc7c120d75b1fb82c068c7a830e2d2f55df6f3ce83f376b9a6c531ce0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426605775" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3225091-3D2A-11EF-8B50-EA829B7A1C2A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1252 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1252 iexplore.exe 1252 iexplore.exe 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1252 wrote to memory of 2016 1252 iexplore.exe 30 PID 1252 wrote to memory of 2016 1252 iexplore.exe 30 PID 1252 wrote to memory of 2016 1252 iexplore.exe 30 PID 1252 wrote to memory of 2016 1252 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b7f1eda8ad59758dbff6e9db675e54c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51682f74e8fdf1aa7f6d902ec6c578ede
SHA12f89cb919eb02c42b3e5455a14170f809482dae1
SHA25650cbdbbf19b801c8124076ac8f552dc5e38433f0e00098a9fecb77215fc30235
SHA512280f1969a2bd8a483cf87b455ee33871fcbe536230ae3284d90aeb36b48fa329456f3d5153a2f5ba8dd0558ac1f75fc3c5d816d4f1f4e6688e1aebe9c4de94a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc5f9654760f0d96db58f8d080141e8c
SHA134ec2bb17128fdd5e9d3faf062c38b47107d3f46
SHA25653a23638923f0f6bff52503a7dff63ac86e6114ea8e0f901c97fe2d24576925a
SHA512cacb35abf2ae0fce90b70f68fd64c41cb16e99fad594caeeb0f5bdafb73d1c3474b627f2675559c40cd0ff7fa4b758591a72f281d046932418b89aebc5877c46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5147e79913adf5ee9d6475c7c58b43306
SHA1dbedc5cab3843ef0c64f9d7b3f6ef924c9573002
SHA2561bde9cea0ecd6fffd425f7ed725f47b588f111794eeaac553b1ad1032b6a2aad
SHA512d2402c0c72ba2e1e86bf33e8dc411a1ae381793acf2ed546663e2375a36011eb39fcd1dc5f6c88c8f12ce8e03b128c8fcb7eca1197086b53d38aab457b555dce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae0af46c58bb182b61ffa315a57381da
SHA1fe7c6ded00a6855fa15ebe083cec9b43d4e56c64
SHA256edb59269c532bb3ab5f43111126329546bf5a7c9f861649faca92702638d7c4a
SHA512b275cb3186b93a5d916ffba1126dd40b49f4d78e9191ff0b40f4925053d98b4efa3d03c9f6997864004551c38954ec4593ea31bdcbff2da1f96593c27e4281f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58296584f9fecf214e3ec4723d5afa93a
SHA1b75491351c4f0ecf036ecc8c6ecdce6c87d5ee65
SHA2562a588d32b5da8742a24a8a14f74965da0d947b3184b2c0b7b6658c3333af2dcd
SHA51202af635b783805fd756f5d614e495310e7ff611d64b6b70616abc9e400bbdb2efb324e8abceb7c38350d2768a1345ce6622840c33319c10a293730a5d104d785
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526d790caac8aadc64fb78f8f3f0ae469
SHA16c056293242992253bc5338630536a392c144fb4
SHA256c665ca7dd4d2db06e0facdecdbe2d0e75b444177221b828331973abf47fc7bf4
SHA5127036a6d5abf03cae285170c85716e6bb4ac01dd5ddaf9f527dd8f5d707094631bf70433f2c501f543a5e0617231f0475880f146fc5e2e10a14aa8963ccadc06b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5448fdc8e78799292e37265ac22d7285d
SHA195c274b28829a65fb3645e2d3924f11c30ebcb99
SHA25604b34fb79e17af18503b3ebbf25b80edf7ca4043f07d3cf2fe158be8e8a84483
SHA5124c55101570c9343dd3d93b98b99ae47563a32cf3be91ce9c4dbffdf23d44ef52da85b58c64f122436d1a513b8f453fd3601e965f5b1f1677682d29515a72aab4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583ccf3d910d867f4a29f30c157ed87ae
SHA1040cb967dcd8b614268ac34d198f5bb5ca3fc5dd
SHA256dba2508b4293bf3722a852d0c94e1a3f260ea705f2faa05290206241e62cd745
SHA512d9e15d34791a6e3184b8e945efea7dbf739e3bcf02303d1b2aea0ea2f8f431518f6d8115b927e664af9071e9f9ddebb3618754ef6da0fd6b8a1f13bffde013a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5e7f027303dd4317290dc42ae2cc6c4
SHA1e1d8d8f4aa05b0e2f19813b5de50f278a6c59ac0
SHA2562745699f4af8ad7fae738fe0421f5790ddbc32571a24e748671ab76d81e095e3
SHA512240a0bce15e887809e591013adacffe2bdee8d181e1ec99782a4475798f42f983b2de0275a99c18509222c1c6e441137b690036d4d5fb84e837d94525acceaa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9c068ef5a2a80b3a6e1097500febfb7
SHA1765cae6820a373c44232902381a1f0899e862efa
SHA2564792740e426e3b55dcea0b422b76fd2d8b2982da7b706eaa11245403c4592d39
SHA51227f06cde22d0907e1f028261238c645992128f8e6a36999c3cebff84da3c445088b53f2c747733e90cb8fbe5ec7032b9e24c0d8c47534984ad15fc5a56c55750
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511baa498175eb962eab33f56ba308312
SHA1938c77b79c483d54f2ef9829fd9101ba2e5e83b3
SHA256dad90368b7dcb9f82f80c4b8afd15fee485efd00c8d42ea6753aa78aa84e81c2
SHA512554311be876deae830efca46d787ef2e199f24839c761a3b910e2280364aecae677fee651e5d1d7c62a8d68a23958273a61b4d57df3a14d67eace606a9c1f02b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59102928d4684c4df9f32fa5b06b49f0d
SHA1bf9d2358ad3d7d944b42f1a5986c4ee0c89b09c0
SHA256f91af604df8800e3da551e4e2cfeb29ea50f30d79d6d55051d1346c404b24011
SHA512275fba826b6d89d8b9d269f58fcd557f4d073abce6a97dfa003d0d309e86c2dadcf3e580f3cbfdedbae49d463816a1812914ff9b0a08a1c487b6e3a1f83b2973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5585fd67dd6d9efb4ad36fd21bb1a95
SHA1e49ed93f848844c87857886808e5fe551c615d93
SHA2560d3a4e753b39364f41c45197f02f04add7278977f3e80a7b39a96f5329ca839d
SHA5128a37cd2558940d2e233b37068e9493c4d8cf9d46be500ca77cc6cfac1fb2f93d0253108cb9ca1834d528d381ccab60be74ae031f82ddb02ce62090a519c1c448
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e5932597636f0fa33814800c645ae74
SHA14dadeae98375dddc8962df5fd8e3ccd803df3914
SHA2564d2d94786a95a4668fd37e0c0742d2c61b6fb9ee108be8324479ae840b12f84f
SHA5122964272eed6641b3ef5e3848cdd13d29b24e5ba778429759f2514b89bc221c4baf3620e1cd87d5f8128558f3340c00809b7ce762e45d48f3efc8980acc4012cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5246c8ea3cd3c607d81d5a54d8bd0674b
SHA109864f9eb5546121f05da96e6c010c113f04cd6d
SHA256c63b26be126bae541254227b47c9dc935dc6d98bc1b66447c3476524687e5ee9
SHA512f2e151803c18c942c6ed888a46374e419c3de17dbe574198ea3086ec077441618d6d8f6cb00edf8e439d73a2a6f6ca001af5c54a73f1a218ffc8f51d5c80eb2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b086cb0ae1c2a404187bf0db2422204
SHA11fbbfb64dbcace5aa5ade8a06d0295fe806cf158
SHA2566feb09614187dcbcf1b94863575d8a79c665c298383da004f1c445d32eff0f5c
SHA512fc628ef9f9c7e19f0c78dddde2f26804a8e29319f8a63b6654d312de340e3eee683591cb1b566c0e14f41717b3a34808bf5ccb6800c935dcfd37c93259b1c793
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b266482cebc15937b42a0bcc493a29c4
SHA15cf7899286bd785994ab20361418b6a6bf186662
SHA256f55b65d79e2d5d17578c82853642f106200410319bb77e2eee98a1c3332a2a9b
SHA512b914cd35141dd173f9d4d71f624c65b1683a4d60c5e5f34314d3e4fa79544b675100fab9b4834d11ea32a76f2b97e65a57b153516eef9aa42060ea985dc74cd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522f3f57f14db30ba7a56ae22d73ee134
SHA1d9f849976bdbd4c43977cf03e8b84cfb31643e3d
SHA2568c39af1b0d12d60e8a074326a83fc39754f422e4b73dd1afd47c2c078b15a2f4
SHA5120be353033e465b88905215099029de59d951d64f536e119ae0d0364cc5657e3d357007b293f76538128f2f355cb200bf4ae72825c8e8f4d694a40fe31891893e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f37c5c1bb2202dbe0306d5891a85c0d
SHA1f3f6cf828f2f6071d5889131e28791322b2c2962
SHA256220cb60b66e90676099bdcd771e021762befa23396e665c8781d50c25cb86199
SHA512e3101d4b3c9d660c3261f6519600166c4594d5920d73af63d206ced532d2c007aea4cf7ec0ce6312d6358e98fd8664baa15539705fbdfa0668367d0879edb8e8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b