Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 01:36
Static task
static1
Behavioral task
behavioral1
Sample
3b859f44beaa5be289295d10f0f7aeb1_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3b859f44beaa5be289295d10f0f7aeb1_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3b859f44beaa5be289295d10f0f7aeb1_JaffaCakes118.html
-
Size
6KB
-
MD5
3b859f44beaa5be289295d10f0f7aeb1
-
SHA1
9cf86e39c15d4abeb4a2eeb6f13ad2195e52242b
-
SHA256
c0246215e395cc0256f1b95a75f07fe6d520a9ec75caaf0932a5462c582444b1
-
SHA512
5ce2e3efb855dd2314f44f2ceee39e7fb12e3149eba16d2589c083593fa406f3742533f24b7ca767d08bf92ad6e83f86251d87a1577d5201da334a8a8e6faaa4
-
SSDEEP
96:uzVs+ux7VkLLY1k9o84d12ef7CSTUcZcEZ7ru7f:csz7VkAYS/Lb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426910076" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b023890afcd3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33F01381-3FEF-11EF-9CC2-6ED41388558A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000e8b860028e2b6d5bbfc5823ff1930476365835dc9a1314765eef82d5053ea48a000000000e8000000002000020000000579a95ecb8757085a4f4125207da2e4218c7d1e64b8b2b0bc19718e1e738b7c890000000055871ae99a5079511ad26046a692ca3f996d349ff003a39b52c31595a398ddc0c160e6cc7d25626aba56e80d9f0e0eade810a943db34f7a53f02d1d3f0c6cb684878cb92894542503ef8f06ce5f8c0086eab02b7e489cebe30e205a070a5ca887d8c7ad7c684f913977064dd6889a8256c40ca050f8c965a086091607a0c2aaf2392114474923d111d9ff6c3d8d17b240000000951b142fd75ff36ad6d5ff7b1dfe54d0c5ecfbda3f50c7dcec890bf1155f5957eafb9bd673791871fbe87987010b296bcb9398565dc95bc3aae409b1e5f08432 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000089970c60490b4b0a9643443fac147507031cd446eba6490a43d52b6833cabeb6000000000e8000000002000020000000da22f167f4ce787d281ebaab9c1651c2bd8553dbccbdac1f0967e15ac8442b8c2000000027cb07a85d6991dc21a5842c2a892b9530e03c89def2f020680791fb947f2039400000001bc0618acd7e944f4b598ae2aa2254e6e382d6fde6fdeeab4677f3777dec0e4ee50f8905b692c8fe486480d066dd024672389bb2d69ec4bf2ef52fe56d3aef9b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2548 iexplore.exe 2548 iexplore.exe 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2580 2548 iexplore.exe 30 PID 2548 wrote to memory of 2580 2548 iexplore.exe 30 PID 2548 wrote to memory of 2580 2548 iexplore.exe 30 PID 2548 wrote to memory of 2580 2548 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b859f44beaa5be289295d10f0f7aeb1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c3b1723006655914e47e43909c7cdef
SHA10e1e526ced4db58c7957c00faf76d3c68239c191
SHA256daa3872318f2d5ef57cfc0e02262191816314ce28214b840a9e51e5715df5389
SHA51267c080c90636efbbe1b7ed4525298a70425e0070702af9c49124a585f57c0d4a674d75c0bc86c5d4ed87312b29fcad60a35d686d84bd4ce54dc55a50d3338a3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593d2e45aaf25cefa6098fed36d2bd447
SHA13a73778bde3067d9ef099783f10ec5df81b00ae1
SHA256926ff63493c948ac21d83cc7ea175ee8770c7bf69e417334979bc6df69a9c319
SHA5122c3e4276ac0dc1f0617a161509182480a0e6686fd248cca9e888599213b00cad5e1cbc1beb2cc2d82ca8212c91f5d268892810603657c5862dd72e2a60767699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528c692a25104486941f5ee04395aff27
SHA1617328658148c4f94c159b394e727150d3effcba
SHA256205c178cdf563253f753a6b2db50e1ae5c2f1ac33c7a5c0e19844b6366973fbb
SHA5124aba3fbcbd8acce90957a0ceddf553b5a382a18ef18991be8b4b434dd6006a6541f9adcfaec6e9ac7f3c8764d93e936edc1ad7300db793e83fc34d4b701acd32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5983ed3c99b5ea908477a2a226b2668cd
SHA14a04505c91eb93521a054f08b15ec1af9ea5fd6b
SHA25681792442610aa92483b29b5ac66a8211ce8cef26fec9b0705f1fbdcdc99e8781
SHA512c61c0acf6a23a0cbe6633b533870fa27efb9ab4b54fef8eb898918edc8770d1892c4ead050d7c0e2ec78243b80996f1a041dbaa9099cc9b234cd3ad66ca7268a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519ceb60ff7235ff6f12e3075781f9b54
SHA1de824fed96fb1fef6bbe66ce67a7d982e7964734
SHA25633bb08187112cf71124bfc304f7a684a846032a74c0c69fb37297d05ea738622
SHA512b8ed078791be4d4d0775f9a16837ea9cfcd8cb84a173b86ef0e08b26a0bc6619320665404359d345a8900b8f7f7bfa7c73ded495bddd8f0c49789331044d2387
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd9bb249c7fb44d9c0bd85fae926661e
SHA1026076ce5c17155c82a11930c05dc9841ce6be50
SHA2568c071dd7fdad4779ff4b657c2c6d67b5524f202875bd0f0e4c2a21793f4a1e64
SHA512f73b578de9edbe394b251a80775fc50ab1f9b0dfea85f17a0c0d30f08ddfd61b609aaafa63c17c8eb9dc89c4a8af72591fbf9716bc965a224cf5637de03d4b4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52986bb439bf8cd00362d70ff535363d1
SHA1bd6dee9e4faacaf54c0b057c2ef332cc099892f3
SHA256baebea6cb4951eed6951237900bf9c8722b0a7367f3d8532d0f2d7eb403b7407
SHA512b840a09afb7bd42086d2329396091024b37587411d09b53c24dec6301db23a3f2a84e97b77a1219a5573d6bdb5545e0d671208176b7d042a1583ef2be3ae7605
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520414ac31cfb51849d4c488bf09f2886
SHA1fc3e47453ef6f107f4764487614b83cfe96defec
SHA256229dea7c13c0a355c3771a6350f8fc01781604d981af7a1b9b0aa4efc5872d6b
SHA512d62680fba55af60555cbc9d437b651d725f2b0e40babd3af6c58cac69e4532f848233582deb3a2abbc211b5488fcf586895e513f38e4fedb6e3c3f1ecd4a1bf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa5c2b6a6a31309cee1ae6e1b5029b1e
SHA1a88eaf0cbf1d0a3ee40f75042cdf705c9e85772e
SHA2562d01f038d580b725061dabd759ddcd08a608cc655e970c4237e9d0bc6f652436
SHA5125fafa87f3d953c9936dddaa2c8ca4a71e77eaf2acaf0965090929b4b93c6aae14f56b4ea7cdf64d6371ecd1f18aa5d7c59343d11ded8619ff696c3ba004be7d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55401931c595b68cbe36d52b1a7a78b0c
SHA14144021158326d9b91eef7a9b4a02e06644bb975
SHA256fefabad4cf23b8b9b133cf7043e53c57d750b1a13b3bc7a8a0ab279362c4f193
SHA512248d504c680f057384d4c4d6a994f90dd105e9f37d1ca8178205e4644fb03eb67485fe8e29670219059e7fa87a74ab3aaa4f7fca3c83276f600380f3d1d21871
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb06a9693f2955fc808ef7d5b2f48898
SHA1564502e0b0e14a57ba8faf31048a88b6ac017712
SHA2567ae35d6f8bb8ee5858d480dcb63e08fa8ce6cc72e1650be2d88e5896e5baa564
SHA5127ec4cffa0cc950960e25e543257853c508463b86ddfacec23ce17462fa555a0be61dbe122ca3cd041546aadb7e8205ae2a070f9ec60a6a8ac95059f6c6bccee6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5009e684479b92fb267973a067cadd531
SHA147a55b794637404839203bd944b1ccb7c374c2fe
SHA256b9cbe33ac8d071102a9aee7f7c6c5682fbdedee01bf5e2a4be30bb55d89fea0f
SHA512d4360f8c7bb69683320b7831d69d7b9460c2561b1feb0f2352406c4dc3eddfc7d8e2c0e32ec344ba65d5f662eea9836489ce11d5580473c61ed651bc71c27248
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5201e79010095680299e703d18c57aca0
SHA13109a900c7dae89296977b426892a9888219e84c
SHA256cc91ba09ec03bd2d19beb79350e36f332dd60aa8364a8de0a5a4549088c42969
SHA51246310e330c73fad01e0c7d25dbff6e017c5c98d4fac01f954c01b2e9cc3aae02ffa3a17ed8dfcea8ee5d9ed8e43dacf6c7f50ffde4954a2c734ca508a61b7d6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524a0e5ed3db3d7be1f069ab29be7c9e8
SHA14b57847ff8a8fe83bb5152d7c07ef0a92795fd66
SHA256950dfa2a0c209cf6fb63fe6f04ea324b468103e7243aee7f8138a85657a0d41d
SHA512e7748157898705adb739fdd934a7f6cc23c99ae89e96708ad37b4ded16874bcd6a8cff4abe94a7e768380ccd86eea71c874f12861e56aa7338b51fb6e6d91f42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c06052fca6167c39748df5796cea954
SHA19552702026db05ac65c70e5aed6a58eed5c0a2cc
SHA256ecd278f18292d99dfe0ddc01a3884f4f03a6a0abd6d1973ec7876b9ad35bab86
SHA512cb32a3dd30901ed52a5352480d2ee6179f17f0bd44061f3f49fd7ad1722acf3153e78c11c868800ba134870036d8046e777ca6aa05037a899e273309b1cea693
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5700f4f7a14d4f2f2b4f510b1486e7a00
SHA115d0d1d7acf5e31e8705fa932212fc1d95b3ea4e
SHA2568356917da9fb8c43cfa932da42146cad850454b3d09bb3a578e089ba56b9f19f
SHA5120b3dbca5464a9bf12de3eace5e30b6fba3d8ac441a3807d9ace8faa61ef4bc8d51109aabc8704df7b962ecb3e9be714ba20e99a552828453cd0bf4e70946dfb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d3858c9f67f3d3a958c2205a280a72e
SHA13eaeea64710ee6c9378fbf8ef89c588aa8da357b
SHA256d83fa09d083de1543cfe7f37146679c0900558359a6346d0575e4e4fe629707b
SHA51248897bd3b61934ad0e1c920613e752782b7ee490b91fc3528343f385e4f2d538844926f543d21bc417a769896eac55fd1322ff4fb83733df6d875a5c35e47ae8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f685c0dd5c920bc59bce7e65023f4e6
SHA1fe927653f46cdbe626cc6c3e42fc7553e6a1775c
SHA2565e2af0727e443ae1ba25d9771d7812c03de618f82feb148c5a46561c6950e013
SHA512b1aefbf7e270b9bcba6756d37e2063d668debee20a2f96e0993aba075638dbede48dc18c7e0e9eec740aceeebadcfe827fca924ecbb00df1eee34628b9932bd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3719a572206771000448ae119c16b7b
SHA172c5ae02938793c77e195c266a5a7454f8d832de
SHA256594fd473b56e995dc1d70191f10b8b031d6afbd6da0217c0d6d42fadb3d0d845
SHA5129375c5a93b2de0272fb449ab98c72ba548edaa24e1e539b738e1901f7f0aa47d31261222d4b18ec5ed603c45f27551db1170a20696c3317bf5cc6ab20fcee453
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b