Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 17:40
Static task
static1
Behavioral task
behavioral1
Sample
35bb405b50532296123aa9f7d009a527_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
35bb405b50532296123aa9f7d009a527_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
35bb405b50532296123aa9f7d009a527_JaffaCakes118.html
-
Size
13KB
-
MD5
35bb405b50532296123aa9f7d009a527
-
SHA1
c1c3e3cf18eaeee24be41e24e2514909a1414f66
-
SHA256
d55226e0d5a09fcc165d307f2a0be1a6cd1c6b3ab3c2d367c42cab5d9474883d
-
SHA512
3d0c97d435e2b24fbd482542a354abb86f0f4f831587ddb3e7e35d8c5c50308be2da4cc000dc610766c6a30228da6f20e07006434dc3cdf2650fcae9bbc16950
-
SSDEEP
192:f3Yak/aQ1otdsQvMB/4jPqw3O62TBTTThT8F5I34UggBjFEk65OL+C6SH02KPKb:/GhotytQJ3tcBT4uB6DsL+CGPE
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426795101" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B0C32B1-3EE3-11EF-B692-6A8D92A4B8D0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401f4354f0d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000005a05cfc0253a66a6070ec5ee8d4d01db23340a173d4466994e6a3f77b6f9ee6e000000000e80000000020000200000007d91f772450821eae2e55fddc70cb1dbdc486560390f861bf6be2e80fa9729d4900000008c77584a3edba30ec8cb19ceff71df553e7e5c9a558aca10604001ac36400f497930a7ec0fda52a684f1f2561ba869efcc3e584afeb16d5933abfecdf19b98c3b628c1208dab7f3117031fe55b598d4f6929628f05686a0f7553edcefaca83ff6a19a95c6f340a46f343cb13d0b2ed84ba5529a289af69e49be61a602cf3c57a20c936435ca1ad27a19a8cd3c852191b400000009e6f515335fe15bba61189a4ac1c240ffd138b2172a23ddcdd10a28591ca5d6442c28c34bb125a8e5c74f837fa166eccf934b26fecc2fff865e0402616855b74 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000cf402e803723a50462156b33bed08e89b3250473d2ca6cb329c715eaa10f3a1a000000000e8000000002000020000000cf2835f8576bc5f84718da5185761474b39476435d106ea44161f6734a70c8aa20000000e163a05c726edbd9ac6f663eaff4e84636b4668abaddc1cfbc73b8db283ccf8d400000003ec4380f5fe82f9fddcaa363332b71a58726d4111fab8c11f2e79d5ee7445360ef9a04572a16e3d204a72eb0abb666dd8b56445de1b232e4f8ab0414687fb732 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3012 iexplore.exe 3012 iexplore.exe 532 IEXPLORE.EXE 532 IEXPLORE.EXE 532 IEXPLORE.EXE 532 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3012 wrote to memory of 532 3012 iexplore.exe 30 PID 3012 wrote to memory of 532 3012 iexplore.exe 30 PID 3012 wrote to memory of 532 3012 iexplore.exe 30 PID 3012 wrote to memory of 532 3012 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35bb405b50532296123aa9f7d009a527_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5613e1fcb6b679c2ca219cc3fc7f4cb71
SHA134ef140b47e9977bfde45d9281fb9ac54d5cfb0f
SHA2567b0dac30ddc956ca5f4bb698a190c8b4ba9799a11d9d695c7aba9e9371865837
SHA512ed21f9095f81d406b1ca324cf09fa4a514e52c8010157bdf747e887e4f6407693f24638d7b572aadaa95dd80d122e73ae885fb7350b866cf1ac160f3d93477be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5506d8c99c0ed99cb0a6a595d550bd5cf
SHA11149d0319f3bc86c2a9372c81ec25ae0591abb0b
SHA25612beb80ea77c999cf40fc338a1da556869e6d475df3c638db072679bb1e87bbd
SHA512973ce79dd005bd4136d1efb5098db6cdce7594f5e8135ce9a1d0cb0008c024298e0a02d472ec8bae1d3bfb118328f378680da80105b6081259e5442d81a33fd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503ca4addea7332043dc51d85da77c9d4
SHA17d281e99694cdf7ee0314ad21259ca188098aa34
SHA2568140bedbc7905d5df177b349f058d8e834dd8bef59e0be48b0673a07fd960270
SHA5126cc02ad5d369791c5aa4018097ed381f5e8d370f2e226945e7b4a14bf898a32aaecf6f859a1b0524334c9d968bc217fa36c43fb08b4e57610072ab11d03de744
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b869ceada3df002c9b90954d0d93083d
SHA1e855bff065527c7d06b78631c8279fba569ec854
SHA256962833a1c9ba4df8f4c6ad995e4d9fcf82721deceed8f9aa9b2d08cff294ce0b
SHA512ab9a77d9f2bce594adf6cbcdb78fff2a39d989ab26c0110e0c89440d7ee05680fe97c25164e3c8316838da382cbc5bb2a7fcb2729fb68c2c910e31cba9ab1509
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ba710a63bf1362f3bed336fe72bc0c3
SHA1cd753aaa213feb30821dde1b2a3a402e77db1fc8
SHA25649069f1ea73022ea8ed9e0a9bcc8ce88c14a40d11bfef8f5ec6a7a22b18695e3
SHA5123b4cea05ea620db4922aab6df519cbf3e5803d2d2f9635b552b58c81d54137e835c286360863e0a55f272b3c82c9599318cb2ba67e63956396d220000c8f6572
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572e91362e5ee0b29581da4df3e397a11
SHA1ffbc211e85265b48b23c9e9dc44fbc3d10ca31ee
SHA256635a28b038fd6cf83d61ab49ed3ffd65fa1bce90d08b8a09b9c4b46083a3e25e
SHA512d6d21bb74194e84ff29d0f20ef81274c55de44d21945fb6a72900d6477b628bbcf74577be2038ae655128870d8fe275908ec8acce7709162d9cc5502fca6ce81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa8e2314993e71d829441c2d3f7c8dd4
SHA1cbbd8b352522493cb93624cc67b64e0a1333986e
SHA256924bfadad403a3f264728d0d4ced9bb50ff9cb81f89225bf6b2285674b930a97
SHA512ed262656ec4410c3fa7acf90185ab13a9ef714ee635938f942e1e39f25797373a2561b42207e3dbf350c29ebc11ef314e2662feba006aa8de7d10f0c00c808ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd2e66c492a800681e998cf12ebcf0a8
SHA153260dbbeb9abd0ce8e0333a5ad559348c94cecb
SHA2567aade1b3f316c8964e0c5cc9b7ff6eb6b2a7e529e1062a8e5ae7a925c5bc9e87
SHA5120534d6b8fc1b1e0d3fd75c56ec0fba823fe6baa070040db9d06648b696394b5df1396f53f678fbf33f85727d560dcd5e73b4677f093ea2e804180570e266cc03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abc5e4b49039dc9afe5d0801a3a6aed6
SHA1c632afa27ba6a046c5131bbd007c729fc1311765
SHA256f45910ef43abe93c7801130cd3e8d90977d5e700d4461d39047ff8d6649b10d6
SHA5120ca0e77bda8a9adb16944bca6535ee77e28409fae9172a717e54ccc58dd48e9375064a1319ed699d445118b8a7ed3b2a3d39ed41a982497d7b8810acc4b3fe98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53568db8c04596d4cc2e09647d017482d
SHA1390bff4f4243b94aff783df94257103eb875ce08
SHA25607c95588168c2a701ea3eea1ea52e43f9074cc39c79940ec8ad219380526dd2c
SHA512c53e6df1d4f3162352186ae2cb55acd61c505c7b8194e9c72c19df73910d93ea3cda4cb44e32be959dd28c7a9c71ee24127b40aac8e0be18a070be2322a59ca1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c5f4c0270bf6d0e62bf0e6c5218b168
SHA1f1d9fc1c5d20106a58b46180f0ee991990e9ac9f
SHA2569dd5fbf366cabfdb6c44660a3f4d6ca3b101753ea738e69b612129f895681bf7
SHA512dcf4bd50c20d3c4bff5077fc312a810e459d98910806a0610a4a1eab97c857ed385f37da7137cc8dafde4ccee23de706bc1f102844641741e677ac2f1f3e7add
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57509462db60e4fc1efab126662ba72b4
SHA128340888513e46165bc8abb4e3d4c3ec7191c6a5
SHA256ad24e50fd0c9c6b777e392e3b183096c22d92570fa633d458ff635d123fcef7a
SHA512a263e312a6f3b836c5978d5493b28abe63eea91eca8363d17902bda033fd7703fad830a2dbb4499cd989c9bb85ff4d2489a56f0a3b28ddba57f056c1e6e5fd4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dda33536051637c4190bca9671dd6dd4
SHA1f75f161d21861829c7450e27829d65c5e50e3229
SHA256ebc9e273a89403f509338950c9aad84df312394d2ba20cec39d921c61d38f428
SHA512197671919e67cfc331b8c619a987acca755a6b112b151fc4b208bec7298bb3b73b6384b0a0b98ef5808347da74f2146f9fe87e7d74b9b97bddd441460ce80655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbad60bb4350592858b4061e9458779a
SHA13bd4591ab890f9cbd7b34417e7101023fdbc3533
SHA2564929f6e96b42871756dc61831685d02de1ebbc6b403fdfde6741451402b28f6d
SHA512415759ea8a31363d00228db566e9d26a565a323c4dfd1b46a54819d00dc1100357dafb95eebae7eb52bd9a2cbe4157442a6f9e7512c6f964e76c2dc33066aa0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596b2545de7ea868f349c4fd4efb4dcaf
SHA153683fb69a88ce82ee1e91d43337f36168d8d08b
SHA256d50cffede02c181dd616ac495c8a4670475ed9244c1aa1f799d9bf27acb81b2c
SHA512f73c405efc5ce89cb925e0de1bba80bd444cc9a4bd6522ce10f36fb527b23b9f0f0526ab65b92d23c897c90f30818e75968119296869b20d23fd808900526e59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5463df3b03783ee29481dda220be794cd
SHA1206e32a14d9d093235415189678fe1f3b09c277c
SHA2560f92c02a07957cd3495e2fadcd1e123821e9177dfab9ac99062af5e8f244981d
SHA512217e0a738e1e2309c890bce3bd205733d6a8f8f380a83b6fa7125aa60427c738ab852f5e658200fec2aec2d95782c34df669291bc384b0f14470f4982f231aee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511fb5ff8e043630c3d2f530cd2454b0e
SHA1ebd51a3e42db12f5724cdeb264350f76fba46da1
SHA256112fa12ad1b350b3ee9aaa149794bd1b67068705cd88c5d92198910b2826c65c
SHA51291765083b4f96cb33dae13778a4dd0e0210482af11bc7c500b151acb914e1ad9a57fa2fec398764029fed3adfbe79bb5ad3f8eb20573736643a572f5d908e06c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50450856313f4185ee0646030ceb6829e
SHA12aa2fae7ccc19fb6ed7ff54d4fbd12a38a83d95d
SHA256d778784b402514a2e339ff9a3c50d7000892217990e371d01793f48790ef6862
SHA5128e13473c26dae439acfe0d38e60d81325db0cd2483060305e7e1a8d33839da27d8b169487b3726c7525adc29f172b6cdd6266cef96947ab8033defa94db2decb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d144b7159c37346ee4858d851a69f9ea
SHA1eaa5b25307a00c3600d6d8cee4ad28dad4b6cae0
SHA256527949762b92a74b71e492c7246ea828241169b63660315167b5cf7094ce6ff9
SHA5122aa880ebc5cb0b658ed48d569e96514379218bd9a31881860fb20e13ca84de267ed0cff1701becc23fcfd1619174b77143dc6fccc76334cd44516c2ac617d89b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b